keith/puppet
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add some configurable support for ipv6

Browse source
This commit is contained in:
Keith Whyte 2023-03-31 01:41:10 +02:00
parent 60432f69b1
commit bc340b8a99
3 changed files with 54 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

29
modules/rhizo_base/templates/ip6tables.erb Normal file
View file

@ -0,0 +1,29 @@
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:ip6_pass - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -j ip6_pass
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s fc00::/6 -d fc00::/6 -p udp -m udp --dport 546 -j ACCEPT
-A INPUT -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 130/0 -j ACCEPT
-A INPUT -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 131/0 -j ACCEPT
-A INPUT -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 132/0 -j ACCEPT
-A INPUT -s fe80::/10 -p ipv6-icmp -m icmp6 --icmpv6-type 143/0 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 128 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 129 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 1 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 2 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 3 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 4/0 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 4/1 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 133 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m limit --limit 1000/sec -j ACCEPT
-A INPUT -p tcp -m tcp --dport 655 -j ACCEPT
-A INPUT -p udp -m udp --dport 655 -j ACCEPT
#-A INPUT -p tcp -m tcp -s <%= @ip6_trusted %> --dport 22 -j ACCEPT
-A ip6_pass -s <%= @ip6_trusted %> -j ACCEPT
COMMIT