29 lines
1.3 KiB
Django/Jinja
29 lines
1.3 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
|
|
{% if firewall_input_default_drop %}
|
|
# Allow Safe ICMP
|
|
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
|
|
#iptables -A INPUT -p icmp --icmp-type redirect -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
|
|
|
|
# Drop everything else
|
|
iptables -A INPUT -m pkttype --pkt-type broadcast -j DROP
|
|
iptables -A INPUT -m limit --limit 10/min --limit-burst 2 -j LOG --log-prefix "{{ firewall_log_prefix }} INPUT DROP: " --log-level 5
|
|
iptables -A INPUT -j DROP
|
|
{% endif %}
|
|
|
|
{% if firewall_output_default_drop %}
|
|
# Allow Safe ICMP
|
|
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
|
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
|
|
#iptables -A OUTPUT -p icmp --icmp-type redirect -j ACCEPT
|
|
iptables -A OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT
|
|
|
|
# Drop everything else
|
|
iptables -A OUTPUT -p tcp --syn -m limit --limit 10/min --limit-burst 2 -j LOG --log-prefix "{{ firewall_log_prefix }} OUTPUT DROP: " --log-level 5 --log-uid
|
|
iptables -A OUTPUT ! -p tcp -m limit --limit 10/min --limit-burst 2 -j LOG --log-prefix "{{ firewall_log_prefix }} OUTPUT DROP: " --log-level 5 --log-uid
|
|
iptables -A OUTPUT -j REJECT
|
|
{% endif %}
|