Configure advanced iptables rules for bridge network security and container isolation

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration
BRIDGE_NAME="br-secure"
BRIDGE_IP="172.20.0.1/24"
BRIDGE_SUBNET="172.20.0.0/24"

# Function to print colored output
print_status() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Cleanup function for rollback
cleanup() {
    print_error "Installation failed. Performing cleanup..."
    
    # Remove custom iptables chains if they exist
    iptables -D FORWARD -j BRIDGE_FORWARD 2>/dev/null || true
    iptables -F BRIDGE_FORWARD 2>/dev/null || true
    iptables -F CONTAINER_ISOLATION 2>/dev/null || true
    iptables -F CONTAINER_ACCEPT 2>/dev/null || true
    iptables -X BRIDGE_FORWARD 2>/dev/null || true
    iptables -X CONTAINER_ISOLATION 2>/dev/null || true
    iptables -X CONTAINER_ACCEPT 2>/dev/null || true
    
    # Remove bridge interface
    ip link set $BRIDGE_NAME down 2>/dev/null || true
    brctl delbr $BRIDGE_NAME 2>/dev/null || true
    
    print_error "Cleanup completed. Please review and fix any issues before retrying."
    exit 1
}

# Set trap for cleanup on error
trap cleanup ERR

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    print_error "This script must be run as root or with sudo"
    exit 1
fi

# Auto-detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            NETPLAN_CONFIG="/etc/netplan/99-bridge-secure.yaml"
            SERVICE_ENABLE="systemctl enable"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf check-update || true"
            NETWORK_CONFIG="/etc/sysconfig/network-scripts/ifcfg-$BRIDGE_NAME"
            SERVICE_ENABLE="systemctl enable"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum check-update || true"
            NETWORK_CONFIG="/etc/sysconfig/network-scripts/ifcfg-$BRIDGE_NAME"
            SERVICE_ENABLE="systemctl enable"
            ;;
        *) 
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    print_error "Cannot detect distribution. /etc/os-release not found."
    exit 1
fi

print_success "Detected distribution: $PRETTY_NAME"

# Step 1: Update package cache and install required packages
print_status "[1/10] Updating package cache and installing required packages..."
$PKG_UPDATE

if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL bridge-utils iptables iptables-persistent
else
    $PKG_INSTALL bridge-utils iptables-services
    $SERVICE_ENABLE iptables
    systemctl start iptables
fi

# Step 2: Load required kernel modules
print_status "[2/10] Loading and configuring kernel modules..."
modprobe br_netfilter || true
modprobe nf_conntrack || true

# Make modules persistent
if ! grep -q "br_netfilter" /etc/modules 2>/dev/null; then
    echo 'br_netfilter' >> /etc/modules
fi
if ! grep -q "nf_conntrack" /etc/modules 2>/dev/null; then
    echo 'nf_conntrack' >> /etc/modules
fi

# Step 3: Configure bridge netfilter support
print_status "[3/10] Configuring bridge netfilter support..."
{
    echo 'net.bridge.bridge-nf-call-iptables = 1'
    echo 'net.bridge.bridge-nf-call-ip6tables = 1'
    echo 'net.bridge.bridge-nf-call-arptables = 1'
} >> /etc/sysctl.conf

sysctl -p

# Step 4: Create secure bridge interface
print_status "[4/10] Creating secure bridge interface..."
if ! brctl show | grep -q "$BRIDGE_NAME"; then
    brctl addbr $BRIDGE_NAME
    ip link set $BRIDGE_NAME up
    ip addr add $BRIDGE_IP dev $BRIDGE_NAME
    print_success "Bridge interface $BRIDGE_NAME created"
else
    print_warning "Bridge interface $BRIDGE_NAME already exists"
fi

# Step 5: Configure bridge interface persistence
print_status "[5/10] Configuring bridge interface persistence..."
if [[ "$PKG_MGR" == "apt" ]]; then
    # Create netplan configuration
    cat > "$NETPLAN_CONFIG" << EOF
network:
  version: 2
  bridges:
    $BRIDGE_NAME:
      addresses:
        - $BRIDGE_IP
      parameters:
        stp: true
        forward-delay: 15
EOF
    chmod 644 "$NETPLAN_CONFIG"
    netplan apply
else
    # Create network script configuration
    cat > "$NETWORK_CONFIG" << EOF
DEVICE=$BRIDGE_NAME
TYPE=Bridge
BOOTPROTO=static
IPADDR=172.20.0.1
NETMASK=255.255.255.0
ONBOOT=yes
STP=yes
DELAY=15
EOF
    chmod 644 "$NETWORK_CONFIG"
fi

# Step 6: Create container isolation chains
print_status "[6/10] Creating iptables chains for container isolation..."
iptables -t filter -N BRIDGE_FORWARD 2>/dev/null || print_warning "BRIDGE_FORWARD chain already exists"
iptables -t filter -N CONTAINER_ISOLATION 2>/dev/null || print_warning "CONTAINER_ISOLATION chain already exists"
iptables -t filter -N CONTAINER_ACCEPT 2>/dev/null || print_warning "CONTAINER_ACCEPT chain already exists"

# Insert BRIDGE_FORWARD chain at the top of FORWARD chain if not already present
if ! iptables -L FORWARD | grep -q "BRIDGE_FORWARD"; then
    iptables -I FORWARD 1 -j BRIDGE_FORWARD
fi

# Step 7: Implement bridge forwarding rules
print_status "[7/10] Configuring bridge forwarding rules..."
iptables -A BRIDGE_FORWARD -i $BRIDGE_NAME -o $BRIDGE_NAME -j CONTAINER_ISOLATION 2>/dev/null || true
iptables -A BRIDGE_FORWARD -i $BRIDGE_NAME ! -o $BRIDGE_NAME -j CONTAINER_ACCEPT 2>/dev/null || true
iptables -A BRIDGE_FORWARD ! -i $BRIDGE_NAME -o $BRIDGE_NAME -j CONTAINER_ACCEPT 2>/dev/null || true

# Step 8: Configure container isolation with default deny
print_status "[8/10] Implementing container isolation policies..."
# Allow established and related connections first
iptables -I CONTAINER_ISOLATION 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
# Default deny for container-to-container communication
iptables -A CONTAINER_ISOLATION -j DROP 2>/dev/null || true

# Step 9: Configure container-to-host communication
print_status "[9/10] Configuring container-to-host communication rules..."
# Allow established and related connections
iptables -A CONTAINER_ACCEPT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
# Allow SSH access to bridge IP
iptables -A CONTAINER_ACCEPT -i $BRIDGE_NAME -d 172.20.0.1 -p tcp --dport 22 -j ACCEPT 2>/dev/null || true
# Allow DNS queries
iptables -A CONTAINER_ACCEPT -i $BRIDGE_NAME -d 172.20.0.1 -p udp --dport 53 -j ACCEPT 2>/dev/null || true
iptables -A CONTAINER_ACCEPT -i $BRIDGE_NAME -d 172.20.0.1 -p tcp --dport 53 -j ACCEPT 2>/dev/null || true
# Allow DHCP
iptables -A CONTAINER_ACCEPT -i $BRIDGE_NAME -p udp --dport 67:68 -j ACCEPT 2>/dev/null || true
# Default accept for other container-to-external traffic
iptables -A CONTAINER_ACCEPT -j ACCEPT 2>/dev/null || true

# Step 10: Save iptables rules and verify configuration
print_status "[10/10] Saving iptables rules and verifying configuration..."
if [[ "$PKG_MGR" == "apt" ]]; then
    iptables-save > /etc/iptables/rules.v4
    ip6tables-save > /etc/iptables/rules.v6
else
    service iptables save
fi

# Verification checks
print_status "Performing verification checks..."

# Check if bridge exists and is up
if ip link show $BRIDGE_NAME >/dev/null 2>&1; then
    print_success "Bridge interface $BRIDGE_NAME is configured and up"
else
    print_error "Bridge interface $BRIDGE_NAME is not properly configured"
    exit 1
fi

# Check if bridge has correct IP address
if ip addr show $BRIDGE_NAME | grep -q "172.20.0.1/24"; then
    print_success "Bridge IP address is correctly configured"
else
    print_error "Bridge IP address is not correctly configured"
    exit 1
fi

# Check if iptables chains exist
for chain in BRIDGE_FORWARD CONTAINER_ISOLATION CONTAINER_ACCEPT; do
    if iptables -L $chain >/dev/null 2>&1; then
        print_success "Iptables chain $chain exists and is configured"
    else
        print_error "Iptables chain $chain is not properly configured"
        exit 1
    fi
done

# Check sysctl settings
if sysctl net.bridge.bridge-nf-call-iptables | grep -q "1"; then
    print_success "Bridge netfilter is enabled"
else
    print_error "Bridge netfilter is not properly enabled"
    exit 1
fi

# Remove trap as we completed successfully
trap - ERR

print_success "Bridge network security configuration completed successfully!"
echo ""
echo "Configuration Summary:"
echo "- Bridge interface: $BRIDGE_NAME"
echo "- Bridge IP: $BRIDGE_IP"
echo "- Container isolation: Enabled with default deny policy"
echo "- Allowed services: SSH (22), DNS (53), DHCP (67-68)"
echo ""
echo "Next steps:"
echo "1. Connect containers to the $BRIDGE_NAME bridge"
echo "2. Add specific allow rules for inter-container communication as needed"
echo "3. Monitor logs for dropped packets: journalctl -f | grep iptables"