ryanc/ansible
1
0
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Exclude loopback from conntrack

Browse Source
This commit is contained in:
Ryan Cavicchioni
2019-08-30 00:33:49 +00:00
parent dfeed33f2b
commit 41c2343f75
3 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/firewall/defaults/main.yaml
View File

@@ -29,6 +29,8 @@ firewall_drop_icmp_flood: true
firewall_limit_icmp_flood_seconds: 1 firewall_limit_icmp_flood_seconds: 1
firewall_limit_icmp_flood_hitcount: 6 firewall_limit_icmp_flood_hitcount: 6
firewall_loopback_notrack: true
firewall_limited_tcp_ports: {} firewall_limited_tcp_ports: {}
firewall_allowed_tcp_ports: {} firewall_allowed_tcp_ports: {}

8
roles/firewall/templates/ip6tables.j2
View File

@@ -92,7 +92,15 @@
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT
-A INPUT -m comment --comment "default drop inet6" -j LOG_DROP -A INPUT -m comment --comment "default drop inet6" -j LOG_DROP
COMMIT
*raw
:PREROUTING ACCEPT -
:OUTPUT ACCEPT -
{% if firewall_loopback_notrack %}
-A PREROUTING -i lo -j NOTRACK
-A OUTPUT -o lo -j NOTRACK
{% endif %}
COMMIT COMMIT
# vim: tw=0 # vim: tw=0

8
roles/firewall/templates/iptables.j2
View File

@@ -76,7 +76,15 @@
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
-A INPUT -m comment --comment "default drop" -j LOG_DROP -A INPUT -m comment --comment "default drop" -j LOG_DROP
COMMIT
*raw
:PREROUTING ACCEPT -
:OUTPUT ACCEPT -
{% if firewall_loopback_notrack %}
-A PREROUTING -i lo -j NOTRACK
-A OUTPUT -o lo -j NOTRACK
{% endif %}
COMMIT COMMIT
# vim: tw=0 # vim: tw=0