From 3e8161f350f14237c15f74044b1a0e0f66ba1ec4 Mon Sep 17 00:00:00 2001 From: Ryan Cavicchioni Date: Mon, 2 Sep 2019 17:54:06 +0000 Subject: [PATCH] Add default rules for OUTPUT and FORWARD chains --- roles/firewall/templates/ip6tables.j2 | 4 ++++ roles/firewall/templates/iptables.j2 | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/roles/firewall/templates/ip6tables.j2 b/roles/firewall/templates/ip6tables.j2 index 9b6221a..0e44fb9 100644 --- a/roles/firewall/templates/ip6tables.j2 +++ b/roles/firewall/templates/ip6tables.j2 @@ -111,6 +111,10 @@ -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT -A INPUT -m comment --comment "default drop inet6" -j LOG_DROP + +-A FORWARD -m comment --comment "default forward drop inet6" -j LOG_DROP + +-A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT COMMIT *raw diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2 index 0535f1c..fb66e51 100644 --- a/roles/firewall/templates/iptables.j2 +++ b/roles/firewall/templates/iptables.j2 @@ -95,6 +95,10 @@ -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT -A INPUT -m comment --comment "default drop" -j LOG_DROP + +-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP + +-A OUTPUT -m comment --comment "default output accept" -j ACCEPT COMMIT *raw