6ea457d01d
- Nginx configs with security headers (X-Frame-Options, CSP, etc.) - fail2ban jails for nginx (botsearch, bad-request, forbidden) - Kernel hardening via sysctl (rp_filter, no redirects, log martians) - SSH hardening (no root, max 3 attempts, no X11) - UFW rules export - Idempotent setup.sh to restore all configs on fresh install - Flask bound to 127.0.0.1 (nginx-only access) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
25 lines
1.4 KiB
Plaintext
25 lines
1.4 KiB
Plaintext
Status: active
|
|
Logging: on (low)
|
|
Default: deny (incoming), allow (outgoing), deny (routed)
|
|
New profiles: skip
|
|
|
|
To Action From
|
|
-- ------ ----
|
|
22/tcp ALLOW IN Anywhere
|
|
139,445/tcp ALLOW IN 192.168.1.0/24
|
|
137,138/udp ALLOW IN 192.168.1.0/24
|
|
3030/tcp ALLOW IN Anywhere
|
|
11434 ALLOW IN 192.168.1.0/24 # Ollama internal
|
|
18789 ALLOW IN 192.168.1.0/24 # OpenClaw brain
|
|
80/tcp ALLOW IN Anywhere # HTTP web server
|
|
443/tcp ALLOW IN Anywhere # HTTPS web server
|
|
5000 ALLOW IN 192.168.1.0/24 # LLM Team UI
|
|
9000 ALLOW IN 192.168.1.0/24 # MinIO LAN only
|
|
9000 DENY IN Anywhere # Block MinIO external
|
|
22/tcp (v6) ALLOW IN Anywhere (v6)
|
|
3030/tcp (v6) ALLOW IN Anywhere (v6)
|
|
80/tcp (v6) ALLOW IN Anywhere (v6) # HTTP web server
|
|
443/tcp (v6) ALLOW IN Anywhere (v6) # HTTPS web server
|
|
9000 (v6) DENY IN Anywhere (v6) # Block MinIO external
|
|
|