2 ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
3 ## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
9 NFLOG nflog-prefix "REJECT: ";
10 proto tcp REJECT reject-with tcp-reset;
15 mod hashlimit hashlimit-name nflogreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
16 mod hashlimit hashlimit-name nfloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second NFLOG nflog-prefix "DROP: ";
26 mod state state (ESTABLISHED RELATED) ACCEPT;
29 # some of our hosts (e.g. villa and lobos) do ipv6 via tunnels (proto 41)
30 # this requires we allow proto ipv6 to work in all cases.
31 # without this, ipv6 connectivity only works once the host itself
32 # created some ipv6 connectivity to some place.
34 mod state state (INVALID) DROP;