aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/firewall/templates/rules.v4.j22
-rw-r--r--roles/firewall/templates/rules.v6.j28
2 files changed, 5 insertions, 5 deletions
diff --git a/roles/firewall/templates/rules.v4.j2 b/roles/firewall/templates/rules.v4.j2
index 1bfeb94..ff77f59 100644
--- a/roles/firewall/templates/rules.v4.j2
+++ b/roles/firewall/templates/rules.v4.j2
@@ -12,7 +12,7 @@
-A INPUT -i lo -j ACCEPT
# Accept any packet for an open connection:
--A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# The SSH port is always open:
diff --git a/roles/firewall/templates/rules.v6.j2 b/roles/firewall/templates/rules.v6.j2
index 2e94e25..5e46ce1 100644
--- a/roles/firewall/templates/rules.v6.j2
+++ b/roles/firewall/templates/rules.v6.j2
@@ -12,7 +12,7 @@
-A INPUT -i lo -j ACCEPT
# Accept any packet for an open connection:
--A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# The SSH port is always open:
@@ -49,10 +49,10 @@
#
# https://github.com/trailofbits/algo/blob/master/roles/common/templates/rules.v6.j2
#
--A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
--A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
+-A INPUT -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
+-A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
-A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
--A INPUT -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPT
+-A INPUT -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPT
# Log denies (this must be at the bottom of the file):
-A INPUT -m limit --limit 3/min -j LOG --log-prefix "iptables denied: " --log-level 4