# ============================================================
# PRODUCTION FIREWALL RULES — web-prod-01 (192.168.1.10)
# Last updated: 2025-10-03 by jthompson
# Migrated from old server 2024-06-15
# ============================================================

*filter

# --- Default Policies ---
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT

# --- Loopback ---
-A INPUT -i lo -j ACCEPT

# --- Allow ALL established connections ---
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# --- Management Access ---
# temporary - remove after testing (added 2025-10-02 by jthompson)
-A INPUT -s 0.0.0.0/0 -p tcp --dport 22 -j ACCEPT

# Allow SSH from management VLAN
-A INPUT -s 10.0.1.0/24 -p tcp --dport 22 -j ACCEPT

# --- Web Traffic ---
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Allow 8080 for legacy app — should we still need this?
-A INPUT -p tcp --dport 8080 -j ACCEPT

# --- Database Access ---
# Allow MySQL from app servers
-A INPUT -s 10.0.2.0/24 -p tcp --dport 3306 -j ACCEPT

# temporary - remove after testing (added 2025-09-28 by mrodriguez)
-A INPUT -s 0.0.0.0/0 -p tcp --dport 3306 -j ACCEPT

# Block MySQL from contractor subnet (SHOULD come before the above!)
-A INPUT -s 172.16.50.0/24 -p tcp --dport 3306 -j DROP

# --- Redis ---
-A INPUT -p tcp --dport 6379 -j ACCEPT

# --- Monitoring ---
# SNMP from monitoring server
-A INPUT -s 10.0.5.20 -p udp --dport 161 -j ACCEPT

# temporary - remove after testing (added 2025-09-15 by jthompson)
# opened all SNMP for debugging trap issues
-A INPUT -p udp --dport 161 -j ACCEPT
-A INPUT -p udp --dport 162 -j ACCEPT

# Node Exporter for Prometheus
-A INPUT -p tcp --dport 9100 -j ACCEPT

# --- NTP ---
-A INPUT -p udp --dport 123 -j ACCEPT

# --- DNS ---
-A INPUT -p udp --dport 53 -j ACCEPT
-A INPUT -p tcp --dport 53 -j ACCEPT

# --- ICMP ---
-A INPUT -p icmp -j ACCEPT

# --- Kubernetes API (moved to new cluster, but rule left here) ---
-A INPUT -p tcp --dport 6443 -j ACCEPT
-A INPUT -p tcp --dport 10250 -j ACCEPT

# --- Docker daemon (DANGER: exposed remotely) ---
# temporary - remove after testing (added 2025-08-20 by mrodriguez)
-A INPUT -p tcp --dport 2375 -j ACCEPT

# --- VNC for remote desktop troubleshooting ---
# temporary - remove after testing (added 2025-07-10 by admin)
-A INPUT -p tcp --dport 5900 -j ACCEPT
-A INPUT -p tcp --dport 5901 -j ACCEPT

# --- FTP (legacy uploads — migrate to SFTP?) ---
-A INPUT -p tcp --dport 21 -j ACCEPT
-A INPUT -p tcp --dport 20 -j ACCEPT

# --- Telnet (old network gear management) ---
# TODO: disable once new switches are deployed
-A INPUT -p tcp --dport 23 -j ACCEPT

# --- Allow all TCP from partner network (per John's request 2025-06) ---
-A INPUT -s 203.0.113.0/24 -p tcp -j ACCEPT

# Restrict partner to port 8443 only (SHADOWED by rule above)
-A INPUT -s 203.0.113.0/24 -p tcp --dport 8443 -j ACCEPT
-A INPUT -s 203.0.113.0/24 -p tcp -j DROP

# --- Application debugging ports ---
# temporary - remove after testing (added 2025-10-01 by jthompson)
-A INPUT -p tcp --dport 9229 -j ACCEPT
-A INPUT -p tcp --dport 5005 -j ACCEPT

# --- Catch-all (but default policy is ACCEPT, so this is useless) ---
-A INPUT -j DROP

# ============================================================
# FORWARD CHAIN — no restrictions (BAD!)
# ============================================================
# "We'll lock this down later" — 2025-06-15 migration notes

# --- OUTPUT CHAIN ---
# No egress filtering at all

COMMIT