ryanc/ansible
1
0
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Add nflog group for packet captures

Browse Source
This commit is contained in:
Ryan Cavicchioni
2019-09-02 17:51:48 +00:00
parent a511491bdf
commit e711ee3a22
3 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/firewall/defaults/main.yaml
View File

@@ -34,6 +34,8 @@ firewall_ulogd_nflog_group: 1
firewall_ulogd_syslog_facility: LOG_LOCAL0
firewall_ulogd_syslog_level: LOG_INFO
firewall_iptables_nflog_group: 2
firewall_drop_icmp_flood: true
firewall_limit_icmp_flood_seconds: 1
firewall_limit_icmp_flood_hitcount: 6

2
roles/firewall/templates/ip6tables.j2
View File

@@ -4,6 +4,7 @@
:OUTPUT {{ firewall_iptables_output_policy_v6 }}
-N LOG_ACCEPT
-A LOG_ACCEPT -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
{% if firewall_use_ulogd %}
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables ACCEPT] "
{% else %}
@@ -12,6 +13,7 @@
-A LOG_ACCEPT -j ACCEPT
-N LOG_DROP
-A LOG_DROP -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
{% if firewall_use_ulogd %}
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables DROP] "
{% else %}

2
roles/firewall/templates/iptables.j2
View File

@@ -4,6 +4,7 @@
:OUTPUT {{ firewall_iptables_output_policy }}
-N LOG_ACCEPT
-A LOG_ACCEPT -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
{% if firewall_use_ulogd %}
-A LOG_ACCEPT -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables ACCEPT] "
{% else %}
@@ -12,6 +13,7 @@
-A LOG_ACCEPT -j ACCEPT
-N LOG_DROP
-A LOG_DROP -j NFLOG --nflog-group {{ firewall_iptables_nflog_group }}
{% if firewall_use_ulogd %}
-A LOG_DROP -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-group {{ firewall_ulogd_nflog_group }} --nflog-prefix "[iptables DROP] "
{% else %}