tmakinen/puppet
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix ip6tables states for kernels older than 2.6.20 (which have states broken).

Browse source
This commit is contained in:
Timo Mkinen 2010-05-17 11:58:21 +03:00
parent 9c070ae932
commit c2a82e83a8
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
firewall/manifests/init.pp
View file

@ -76,6 +76,8 @@ class firewall::common::iptables {
ensure => installed, ensure => installed,
} }
$ip6states = versioncmp($kernelversion, "2.6.20")
file { "/etc/sysconfig/iptables": file { "/etc/sysconfig/iptables":
ensure => present, ensure => present,
mode => 0600, mode => 0600,

5
firewall/templates/ip6tables.erb
View file

@ -6,7 +6,12 @@
-A INPUT -i lo -j ACCEPT -A INPUT -i lo -j ACCEPT
-A INPUT -m ipv6header --header ah -j ACCEPT -A INPUT -m ipv6header --header ah -j ACCEPT
-A INPUT -m ipv6header --header esp -j ACCEPT -A INPUT -m ipv6header --header esp -j ACCEPT
<% if ip6states >= 0 -%>
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
<% else -%>
-A INPUT -m tcp -p tcp ! --syn -j ACCEPT
-A INPUT -m udp -p udp --dport 32768:61000 -j ACCEPT
<% end -%>
-A INPUT -p ipv6-icmp -j ACCEPT -A INPUT -p ipv6-icmp -j ACCEPT
<% <%
firewall_rules.each do |rule| firewall_rules.each do |rule|