tmakinen/puppet
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

firewall: Modified iptables templates to allow blocking of incoming ICMP.

Browse source
This commit is contained in:
Timo Mkinen 2013-09-11 16:26:29 +03:00
parent ce623ac4fc
commit 1fbe904a13
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
firewall/templates/ip6tables.erb
View file

@ -12,7 +12,6 @@
-A INPUT -m tcp -p tcp ! --syn -j ACCEPT -A INPUT -m tcp -p tcp ! --syn -j ACCEPT
-A INPUT -m udp -p udp --dport 32768:61000 -j ACCEPT -A INPUT -m udp -p udp --dport 32768:61000 -j ACCEPT
<% end -%> <% end -%>
-A INPUT -p ipv6-icmp -j ACCEPT
<% <%
@firewall_rules.each do |rule| @firewall_rules.each do |rule|
rule = /(tcp|udp)\/([\d:]+)( .+)?/.match(rule) rule = /(tcp|udp)\/([\d:]+)( .+)?/.match(rule)
@ -26,6 +25,7 @@
-%> -%>
<%= rule %> <%= rule %>
<% end -%> <% end -%>
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited -A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
COMMIT COMMIT

2
firewall/templates/iptables.erb
View file

@ -6,7 +6,6 @@
-A INPUT -p ah -j ACCEPT -A INPUT -p ah -j ACCEPT
-A INPUT -p esp -j ACCEPT -A INPUT -p esp -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp --icmp-type any -j ACCEPT
<% <%
@firewall_rules.each do |rule| @firewall_rules.each do |rule|
rule = /(tcp|udp)\/([\d:]+)( .+)?/.match(rule) rule = /(tcp|udp)\/([\d:]+)( .+)?/.match(rule)
@ -20,6 +19,7 @@
-%> -%>
<%= rule %> <%= rule %>
<% end -%> <% end -%>
-A INPUT -p icmp --icmp-type any -j ACCEPT
-A INPUT -p tcp -j REJECT --reject-with tcp-reset -A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-port-unreachable -A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited