Harden Salt Master Firewall

salt/files/ferm.conf

-domain (ip ip6) {
+@def $ownASN6 = (2a06:8187:fb00::/40);
+@def $saltmaster  = (2a01:4f8:192:11d2::99);
+@def $ownExternal6  = (2001:bc8:182c:2321::1);
+
+domain (ip6) {
   table filter {
     chain INPUT {
-      # minions
-      mod state state NEW proto tcp dport (4505 4506) ACCEPT;
-
-      # local (salt-cli to master)
-      interface lo proto tcp dport (4505 4506) ACCEPT;
+      proto tcp mod multiport destination-ports (4505 4506) {
+        saddr $own6 ACCEPT;
+        saddr $saltmaster ACCEPT;
+        saddr $externalFFFFM ACCEPT;
+        DROP;
+      };
     }
   }
 }
-