taking over iptables/ip6tables and ipset

bcp38.ipset.j2

@@ -0,0 +1,3 @@
+create foo hash:net,iface family inet hashsize 1024 maxelem 65536
+add foo 0.0.0.0/0,eth0
+add foo 0.0.0.0/0,lo

bcp38.iptables.v4

@@ -0,0 +1,26 @@
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT
+
+*raw
+:PREROUTING ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A PREROUTING -j NOTRACK
+COMMIT
+
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT
+
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT

bcp38.iptables.v6

@@ -0,0 +1,26 @@
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT
+
+*raw
+:PREROUTING ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A PREROUTING -j NOTRACK
+COMMIT
+
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT
+
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT

hphr.sls

@@ -23,3 +23,33 @@ configure:
     - runas: minion
     - require:
       - file: /config/config.new
+
+/config/hphr.rules.v4:
+  file.managed:
+    - template: jinja
+    - source: salt://bcp38.iptables.v4
+
+/config/hphr.rules.v6:
+  file.managed:
+    - template: jinja
+    - source: salt://bcp38.iptables.v6
+
+/config/hphr.ipset:
+  file.managed:
+    - template: jinja
+    - source: salt://bcp38.ipset.j2
+
+/config/scripts/vyos-postconfig-bootup.script:
+  file.managed:
+    - template: jinja
+    - source: salt://postconfig.sh
+    - mode: 760
+    - require:
+      - file: /config/hphr.rules.v4
+      - file: /config/hphr.rules.v6
+      - file: /config/hphr.ipset
+  cmd.run:
+    - name: sudo /config/scripts/vyos-postconfig-bootup.script
+    - require:
+      - file: /config/scripts/vyos-postconfig-bootup.script
+      - cmd: configure

postconfig.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+ipset restore < /config/hphr.ipset
+iptables-restore /config/hphr.rules.v4
+ip6tables-restore /config/hphr.rules.v6
+echo 2 > /proc/sys/net/ipv4/conf/default/rp_filter
+echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter