Defense in Depth

# Default-deny all ingress, then whitelist specific flows
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow-frontend-only
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-server
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Only allow frontend pods in the production namespace on port 8080.
    # podSelector + namespaceSelector in the SAME list item means AND; as two
    # list items they would be OR'd (frontend anywhere, OR anything in prod).
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: production
          podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
  egress:
    # Only allow traffic to the database on port 5432
    - to:
        - podSelector:
            matchLabels:
              app: postgres
      ports:
        - protocol: TCP
          port: 5432
    # Allow DNS resolution
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53

# Defense in Depth: layered Network Security Groups
# Layer 3 — Application Gateway (public-facing)
resource "azurerm_network_security_group" "appgw" {
  name                = "appgw-nsg"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

resource "azurerm_network_security_rule" "appgw_https_in" {
  name                        = "allow-https-inbound"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "443"
  source_address_prefix       = "*"            # HTTPS from internet
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.main.name
  network_security_group_name = azurerm_network_security_group.appgw.name
}

# Layer 4 — Application tier (private)
resource "azurerm_network_security_group" "app" {
  name                = "app-nsg"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

resource "azurerm_network_security_rule" "app_from_appgw" {
  name                        = "allow-appgw-inbound"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "8080"
  source_address_prefix       = "10.0.1.0/24"  # Only from App Gateway subnet
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.main.name
  network_security_group_name = azurerm_network_security_group.app.name
}

resource "azurerm_network_security_rule" "app_to_db" {
  name                        = "allow-app-to-db"
  priority                    = 100
  direction                   = "Outbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "1433"
  source_address_prefix       = "*"
  destination_address_prefix  = "10.0.20.0/24"  # Only to database subnet
  resource_group_name         = azurerm_resource_group.main.name
  network_security_group_name = azurerm_network_security_group.app.name
}

# Layer 6 — Database tier (isolated)
resource "azurerm_network_security_group" "db" {
  name                = "db-nsg"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

resource "azurerm_network_security_rule" "db_from_app" {
  name                        = "allow-app-to-db"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "1433"
  source_address_prefix       = "10.0.10.0/24"  # Only from app tier subnet
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.main.name
  network_security_group_name = azurerm_network_security_group.db.name
}

resource "azurerm_network_security_rule" "db_deny_outbound" {
  name                        = "deny-all-outbound"
  priority                    = 4096
  direction                   = "Outbound"
  access                      = "Deny"
  protocol                    = "*"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"            # No outbound — fully isolated
  resource_group_name         = azurerm_resource_group.main.name
  network_security_group_name = azurerm_network_security_group.db.name
}

# WARNING: an unconditional deny-all-outbound also drops DNS (53/udp+tcp),
# Azure platform health probes, and management endpoints. Add explicit Allow
# rules for those with a LOWER priority number (Azure evaluates lower numbers
# first; e.g. 100) so they are matched before this deny at 4096 — otherwise
# the database VM loses name resolution and platform connectivity.

# Rules only take effect once each subnet is associated with its NSG.
# The subnet resources themselves live in the VNet definition.
resource "azurerm_subnet_network_security_group_association" "public" {
  subnet_id                 = azurerm_subnet.public.id
  network_security_group_id = azurerm_network_security_group.appgw.id
}

resource "azurerm_subnet_network_security_group_association" "app" {
  subnet_id                 = azurerm_subnet.app.id
  network_security_group_id = azurerm_network_security_group.app.id
}

resource "azurerm_subnet_network_security_group_association" "data" {
  subnet_id                 = azurerm_subnet.data.id
  network_security_group_id = azurerm_network_security_group.db.id
}

#!/bin/bash
# Host-level defense — Layer 4 hardening
set -euo pipefail

# Flush existing rules
iptables -F
iptables -X

# Default deny all
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow loopback
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established/related connections
iptables -A INPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from management VLAN only (Layer 2 segmentation ties in here)
iptables -A INPUT -s 10.10.50.0/24 -p tcp --dport 22 -j ACCEPT

# Allow HTTPS inbound (app port)
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow DNS outbound
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# Allow NTP outbound (time sync)
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

# Allow HTTPS outbound (package updates, APIs)
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

# Rate-limit ICMP to prevent ping floods
iptables -A INPUT -p icmp --icmp-type echo-request \
  -m limit --limit 1/s --limit-burst 4 -j ACCEPT

# Log dropped packets for monitoring (Layer 7 tie-in)
iptables -A INPUT  -j LOG --log-prefix "IPT-DROP-IN: "
iptables -A OUTPUT -j LOG --log-prefix "IPT-DROP-OUT: "

# --- IPv6: mirror the policy, or IPv6 bypasses the IPv4 default-deny ---
ip6tables -F
ip6tables -X
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP

ip6tables -A INPUT  -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
ip6tables -A INPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

ip6tables -A INPUT -s 2001:db8:50::/64 -p tcp --dport 22 -j ACCEPT  # mgmt VLAN
ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT                     # app port
ip6tables -A OUTPUT -p udp --dport 53 -j ACCEPT
ip6tables -A OUTPUT -p tcp --dport 53 -j ACCEPT
ip6tables -A OUTPUT -p udp --dport 123 -j ACCEPT
ip6tables -A OUTPUT -p tcp --dport 443 -j ACCEPT

# ICMPv6 carries ND/RA/PMTU — never drop it outright, but rate-limit echo
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type echo-request \
  -m limit --limit 1/s --limit-burst 4 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp ! --icmpv6-type echo-request -j ACCEPT

ip6tables -A INPUT  -j LOG --log-prefix "IP6T-DROP-IN: "
ip6tables -A OUTPUT -j LOG --log-prefix "IP6T-DROP-OUT: "

# If the host does not use IPv6 at all, disable it instead:
#   sysctl -w net.ipv6.conf.all.disable_ipv6=1
#   sysctl -w net.ipv6.conf.default.disable_ipv6=1

echo "[+] iptables + ip6tables hardened — default deny active (IPv4 + IPv6)"