Hopefully no leaks

11 files changed, 118 insertions, 0 deletions

diff --git a/hosts/rod/fail2ban/fail2ban.d/rod.local b/hosts/rod/fail2ban/fail2ban.d/rod.local
new file mode 100644
index 0000000..b3d98c4
--- /dev/null
+++ b/hosts/rod/fail2ban/fail2ban.d/rod.local
@@ -0,0 +1,2 @@
+[DEFAULT]
+allowipv6 = true
diff --git a/hosts/rod/fail2ban/jail.d/rod.local b/hosts/rod/fail2ban/jail.d/rod.local
new file mode 100644
index 0000000..c8c0916
--- /dev/null
+++ b/hosts/rod/fail2ban/jail.d/rod.local
@@ -0,0 +1,15 @@
+[DEFAULT]
+chain = input
+maxretry = 3
+findtime = 60m
+bantime = 24h
+backend = systemd
+logtarget = SYSTEMD-JOURNAL
+banaction = nftables-multiport
+banaction_allports = nftables-allports
+
+[sshd]
+enabled = true
+port = 1738
+mode = aggressive
+journalmatch=_SYSTEMD_UNIT=ssh.service
diff --git a/hosts/rod/my_enemies.txt b/hosts/rod/my_enemies.txt
new file mode 100644
index 0000000..67cda83
--- /dev/null
+++ b/hosts/rod/my_enemies.txt
@@ -0,0 +1,6 @@
+# LIST OF MY ENEMIES t(-_-t)
+# Single: s X.X.X.X
+# Range:  r X.X.X.X-X.X.X.X
+# Forgive (´･_･`): f X.X.X.X / X.X.X.X-X.X.X.X
+# Last Update (03/25/2024)
+f 46.148.32.0-46.148.47.255 # 07/18/2023, 09/18/2023, 10/24/2023, 03/25/2024
diff --git a/hosts/rod/nftables.conf b/hosts/rod/nftables.conf
new file mode 100755
index 0000000..8b84370
--- /dev/null
+++ b/hosts/rod/nftables.conf
@@ -0,0 +1,55 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+  chain input_ipv4 {
+    icmp type echo-request limit rate 5/second accept
+  }
+
+  chain input_ipv6 {
+    icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
+    icmpv6 type echo-request limit rate 5/second accept
+  }
+
+  chain input {
+    type filter hook input priority filter; policy drop;
+    ct state vmap { established : accept, related : accept, invalid : drop }
+    iifname lo accept
+    meta protocol vmap { ip : jump input_ipv4, ip6 : jump input_ipv6 }
+    tcp dport { 1738 } accept
+    udp dport { 51820 } accept # WireGuard
+    log prefix "(nftables) input denied: " counter drop
+  }
+
+  # Priority 1 because iptables-nft uses 0 (filter) by default.
+  chain forward {
+    type filter hook forward priority 1; policy accept;
+  }
+}
+
+table ip denpa_nat {
+  chain prerouting {
+    type nat hook prerouting priority dstnat;
+
+    ip daddr 66.135.26.42 tcp dport { ssh, http, https, 993, 465, 25, 587 } dnat to 192.168.29.2;
+  }
+  chain postrouting {
+    type nat hook postrouting priority srcnat;
+
+    ip saddr 192.168.29.2 masquerade
+  }
+}
+
+table ip6 denpa_nat {
+  chain prerouting {
+    type nat hook prerouting priority dstnat;
+
+    ip6 daddr 2001:19f0:5:58f:5400:4ff:fe7f:fae1 tcp dport { ssh, http, https, 993, 465, 25, 587 } dnat to aa29::2;
+  }
+  chain postrouting {
+    type nat hook postrouting priority srcnat;
+
+    ip6 saddr aa29::2 masquerade
+  }
+}
diff --git a/hosts/rod/scripts/ban-ip-forward b/hosts/rod/scripts/ban-ip-forward
new file mode 100755
index 0000000..04e6de7
--- /dev/null
+++ b/hosts/rod/scripts/ban-ip-forward
@@ -0,0 +1,2 @@
+#! /usr/bin/env sh
+sudo iptables -I FORWARD -s $1 -j DROP
diff --git a/hosts/rod/scripts/ban-iprange-forward b/hosts/rod/scripts/ban-iprange-forward
new file mode 100755
index 0000000..7de1682
--- /dev/null
+++ b/hosts/rod/scripts/ban-iprange-forward
@@ -0,0 +1,2 @@
+#! /usr/bin/env sh
+sudo iptables -I FORWARD -m iprange --src-range $1 -j DROP
diff --git a/hosts/rod/scripts/block-my-enemies b/hosts/rod/scripts/block-my-enemies
new file mode 100755
index 0000000..473595c
--- /dev/null
+++ b/hosts/rod/scripts/block-my-enemies
@@ -0,0 +1,18 @@
+#! /usr/bin/env bash
+
+BAN_IP="$HOME/scripts/ban-ip-forward"
+BAN_IP_RANGE="$HOME/scripts/ban-iprange-forward"
+
+while read l; do
+  c=$(echo "$l" | cut -d'#' -f1 | xargs)
+  if [[ "${l:0:1}" == "s" ]]
+  then
+    $BAN_IP "${c:2}"
+  elif [[ "${l:0:1}" == "r" ]]
+  then
+    $BAN_IP_RANGE "${c:2}"
+  elif [[ "${l:0:1}" == "f" ]]
+  then
+    echo "You have forgiven "${c:2}"."
+  fi
+done <$1
diff --git a/hosts/rod/scripts/fail2ban-ban-ip b/hosts/rod/scripts/fail2ban-ban-ip
new file mode 100755
index 0000000..b1b97c6
--- /dev/null
+++ b/hosts/rod/scripts/fail2ban-ban-ip
@@ -0,0 +1,3 @@
+#! /usr/bin/env sh
+# Get jail names: sudo fail2ban-client status
+fail2ban-client set $1 banip $2
diff --git a/hosts/rod/scripts/fail2ban-unban-ip b/hosts/rod/scripts/fail2ban-unban-ip
new file mode 100755
index 0000000..6ca4842
--- /dev/null
+++ b/hosts/rod/scripts/fail2ban-unban-ip
@@ -0,0 +1,3 @@
+#! /usr/bin/env sh
+# Get jail names, sudo fail2ban-client status
+fail2ban-client set $1 unbanip $2
diff --git a/hosts/rod/scripts/unban-iprange-forward b/hosts/rod/scripts/unban-iprange-forward
new file mode 100755
index 0000000..22d6e9f
--- /dev/null
+++ b/hosts/rod/scripts/unban-iprange-forward
@@ -0,0 +1,2 @@
+#! /usr/bin/env sh
+sudo iptables -D FORWARD -m iprange --src-range $1 -j DROP
diff --git a/hosts/rod/wg-rod.conf.in b/hosts/rod/wg-rod.conf.in
new file mode 100644
index 0000000..227db0e
--- /dev/null
+++ b/hosts/rod/wg-rod.conf.in
@@ -0,0 +1,10 @@
+[Interface]
+Address = <ipv4>/24, <ipv6>/64
+ListenPort = <port>
+PrivateKey =
+PostUp = sysctl -w net.ipv4.ip_forward=1
+PostUp = sysctl -w net.ipv6.conf.all.forwarding=1
+
+[Peer]
+AllowedIPs = <ipv4>/24, <ipv6>/64
+PublicKey =