Disable iptables integration (was causing kubectl connectivity issues)

terraform/crowdsec.tf

@@ -231,7 +231,7 @@ resource "helm_release" "crowdsec" {
             - Alert.Remediation == true && Alert.GetScope() == "Ip"
           decisions:
             - type: ban
-              duration: 4h
+              duration: 24h
           on_success: break
         EOT
       }
@@ -281,55 +281,58 @@ resource "null_resource" "crowdsec_bouncer_setup" {
   }
 }
 
-# Setup iptables logging for port scan detection (optional but recommended)
-resource "ssh_resource" "iptables_logging" {
-  depends_on = [helm_release.crowdsec]
+# DISABLED: iptables logging was causing connectivity issues with kubectl
+# The rules were blocking legitimate Kubernetes traffic
+# CrowdSec will still monitor logs without iptables integration
 
-  host        = local.ssh_host
-  user        = local.ssh_user
-  port        = local.ssh_port
-  private_key = local.ssh_private_key
-  timeout     = "5m"
-
-  when = "create"
-
-  commands = [
-    "echo 'Setting up iptables logging for CrowdSec...'",
-
-    # Create chain for suspicious activity logging
-    "sudo iptables -N CROWDSEC_SUSPICIOUS 2>/dev/null || true",
-    "sudo iptables -F CROWDSEC_SUSPICIOUS 2>/dev/null || true",
-
-    # IMPORTANT: Exclude local network (192.168.1.0/24) from ALL port scan detection
-    "sudo iptables -I INPUT 1 -s 192.168.1.0/24 -j ACCEPT || true",
-
-    # Track connection attempts for port scan detection (only for external traffic)
-    "sudo iptables -A INPUT -p tcp -m state --state NEW -m recent --set --name portscan || true",
-
-    # If more than 10 connection attempts in 60 seconds from external IPs, log it as suspicious
-    "sudo iptables -A INPUT -p tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name portscan -j CROWDSEC_SUSPICIOUS || true",
-
-    # Log suspicious activity
-    "sudo iptables -A CROWDSEC_SUSPICIOUS -j LOG --log-prefix 'iptables_SCAN: ' --log-level 4 --log-tcp-options --log-ip-options || true",
-
-    # Drop the suspicious packets
-    "sudo iptables -A CROWDSEC_SUSPICIOUS -j DROP || true",
-
-    # Log invalid packets from external sources only (often used in attacks)
-    "sudo iptables -A INPUT -m state --state INVALID -j LOG --log-prefix 'iptables_INVALID: ' --log-level 4 || true",
-    "sudo iptables -A INPUT -m state --state INVALID -j DROP || true",
-
-    # Install iptables-persistent to save rules
-    "sudo DEBIAN_FRONTEND=noninteractive apt-get install -y iptables-persistent 2>/dev/null || true",
-
-    # Save the rules
-    "sudo mkdir -p /etc/iptables",
-    "sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null",
-
-    "echo '✅ iptables logging configured!'",
-    "echo 'Port scans and suspicious activity will now be logged and detected by CrowdSec'"
-  ]
-}
+# resource "ssh_resource" "iptables_logging" {
+#   depends_on = [helm_release.crowdsec]
+#
+#   host        = local.ssh_host
+#   user        = local.ssh_user
+#   port        = local.ssh_port
+#   private_key = local.ssh_private_key
+#   timeout     = "5m"
+#
+#   when = "create"
+#
+#   commands = [
+#     "echo 'Setting up iptables logging for CrowdSec...'",
+#
+#     # Create chain for suspicious activity logging
+#     "sudo iptables -N CROWDSEC_SUSPICIOUS 2>/dev/null || true",
+#     "sudo iptables -F CROWDSEC_SUSPICIOUS 2>/dev/null || true",
+#
+#     # IMPORTANT: Exclude local network (192.168.1.0/24) from ALL port scan detection
+#     "sudo iptables -I INPUT 1 -s 192.168.1.0/24 -j ACCEPT || true",
+#
+#     # Track connection attempts for port scan detection (only for external traffic)
+#     "sudo iptables -A INPUT -p tcp -m state --state NEW -m recent --set --name portscan || true",
+#
+#     # If more than 10 connection attempts in 60 seconds from external IPs, log it as suspicious
+#     "sudo iptables -A INPUT -p tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name portscan -j CROWDSEC_SUSPICIOUS || true",
+#
+#     # Log suspicious activity
+#     "sudo iptables -A CROWDSEC_SUSPICIOUS -j LOG --log-prefix 'iptables_SCAN: ' --log-level 4 --log-tcp-options --log-ip-options || true",
+#
+#     # Drop the suspicious packets
+#     "sudo iptables -A CROWDSEC_SUSPICIOUS -j DROP || true",
+#
+#     # Log invalid packets from external sources only (often used in attacks)
+#     "sudo iptables -A INPUT -m state --state INVALID -j LOG --log-prefix 'iptables_INVALID: ' --log-level 4 || true",
+#     "sudo iptables -A INPUT -m state --state INVALID -j DROP || true",
+#
+#     # Install iptables-persistent to save rules
+#     "sudo DEBIAN_FRONTEND=noninteractive apt-get install -y iptables-persistent 2>/dev/null || true",
+#
+#     # Save the rules
+#     "sudo mkdir -p /etc/iptables",
+#     "sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null",
+#
+#     "echo '✅ iptables logging configured!'",
+#     "echo 'Port scans and suspicious activity will now be logged and detected by CrowdSec'"
+#   ]
+# }
 
 output "crowdsec_info" {
   value = <<-EOT