126 lines
3.0 KiB
YAML
126 lines
3.0 KiB
YAML
---
|
|
firewall_iptables_rules_v4: /etc/iptables/rules.v4-tmp
|
|
firewall_iptables_rules_v6: /etc/iptables/rules.v6-tmp
|
|
|
|
firewall_ipset_v4: /etc/iptables/ipset.v4-tmp
|
|
firewall_ipset_v6: /etc/iptables/ipset.v6-tmp
|
|
|
|
firewall_iptables_package_state: present
|
|
firewall_iptables_package_name: iptables
|
|
#firewall_iptables_service_state: started
|
|
#firewall_iptables_service_enabled: true
|
|
|
|
firewall_iptables_persistent_package_name: iptables-persistent
|
|
firewall_iptables_persistent_package_state: present
|
|
|
|
firewall_iptables_persistent_service_state: started
|
|
firewall_iptables_persistent_service_enabled: true
|
|
|
|
firewall_ulogd_package_state: present
|
|
firewall_ulogd_service_state: started
|
|
firewall_ulogd_service_enabled: true
|
|
|
|
firewall_iptables_persistent_plugin_path: /usr/share/netfilter-persistent/plugins.d
|
|
firewall_ipset_save_path: /etc/iptables/ipset
|
|
|
|
firewall_ipset_package_name: ipset
|
|
firewall_ipset_package_state: present
|
|
|
|
firewall_iptables_input_policy: ACCEPT
|
|
firewall_iptables_output_policy: ACCEPT
|
|
firewall_iptables_forward_policy: ACCEPT
|
|
|
|
firewall_iptables_input_policy_v6: ACCEPT
|
|
firewall_iptables_output_policy_v6: ACCEPT
|
|
firewall_iptables_forward_policy_v6: ACCEPT
|
|
|
|
firewall_use_ulogd: true
|
|
firewall_ulogd_package_name: ulogd2
|
|
firewall_ulogd_service_name: ulogd2.service
|
|
firewall_ulogd_config_path: /etc/ulogd.conf
|
|
firewall_ulogd_nflog_group: 1
|
|
|
|
# debug(1), info(3), notice(5), error(7) or fatal(8) (default 5)
|
|
firewall_ulogd_log_level: 3
|
|
|
|
firewall_ulogd_packet_mode_enabled: yes
|
|
firewall_ulogd_packet_mode_syslog_facility: LOG_LOCAL0
|
|
firewall_ulogd_packet_mode_syslog_level: LOG_INFO
|
|
|
|
firewall_ulogd_flow_mode_enabled: yes
|
|
firewall_ulogd_flow_mode_syslog_facility: LOG_LOCAL1
|
|
firewall_ulogd_flow_mode_syslog_level: LOG_INFO
|
|
|
|
firewall_iptables_nflog_group: 1
|
|
|
|
firewall_drop_icmp_flood: true
|
|
firewall_limit_icmp_flood_seconds: 1
|
|
firewall_limit_icmp_flood_hitcount: 6
|
|
|
|
firewall_loopback_notrack: true
|
|
|
|
firewall_limited_tcp_ports: []
|
|
|
|
firewall_allowed_tcp_ports: []
|
|
firewall_allowed_udp_ports: []
|
|
|
|
firewall_log_limit: 3/min
|
|
firewall_log_limit_burst: 10
|
|
|
|
firewall_limit_ssh: true
|
|
firewall_limit_ssh_seconds: 60
|
|
firewall_limit_ssh_hitcount: 10
|
|
|
|
firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"
|
|
|
|
firewall_ssh_whitelist: []
|
|
|
|
# ipset's
|
|
firewall_ipset_cooloff_timeout: 600
|
|
|
|
firewall_ipset_blacklist: []
|
|
|
|
firewall_ipset_mgmt: []
|
|
|
|
firewall_ipset_bogons:
|
|
- 0.0.0.0/8
|
|
- 10.0.0.0/8
|
|
- 100.64.0.0/10
|
|
- 127.0.0.0/8
|
|
- 169.254.0.0/16
|
|
- 172.16.0.0/12
|
|
- 192.0.0.0/24
|
|
- 192.0.2.0/24
|
|
- 192.168.0.0/16
|
|
- 198.18.0.0/15
|
|
- 198.51.100.0/24
|
|
- 203.0.113.0/24
|
|
- 224.0.0.0/4
|
|
- 240.0.0.0/4
|
|
- ::/96
|
|
- ::/128
|
|
- ::1/128
|
|
- ::ffff:0.0.0.0/96
|
|
- ::224.0.0.0/100
|
|
- ::127.0.0.0/104
|
|
- ::0.0.0.0/104
|
|
- ::255.0.0.0/104
|
|
- 0000::/8
|
|
- 0200::/7
|
|
- 3ffe::/16
|
|
- 2001:db8::/32
|
|
- 2002:e000::/20
|
|
- 2002:7f00::/24
|
|
- 2002:0000::/24
|
|
- 2002:ff00::/24
|
|
- 2002:0a00::/24
|
|
- 2002:ac10::/28
|
|
- 2002:c0a8::/32
|
|
- fc00::/7
|
|
- fe80::/10
|
|
- fec0::/10
|
|
- ff00::/8
|
|
|
|
firewall_allowed_icmp_types: []
|
|
firewall_allowed_icmpv6_types: []
|