2 ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
3 ## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
10 <% if @lsbmajdistrelease >= '8' -%>
13 chain log_and_reject {
14 NFLOG nflog-prefix "REJECT: ";
15 proto tcp REJECT reject-with tcp-reset;
20 mod hashlimit hashlimit-name nflogreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
21 mod hashlimit hashlimit-name nfloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second NFLOG nflog-prefix "DROP: ";
30 chain log_and_reject {
31 ULOG ulog-prefix "REJECT: ";
32 proto tcp REJECT reject-with tcp-reset;
37 mod hashlimit hashlimit-name ulogreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
38 mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second ULOG ulog-prefix "DROP: ";
46 chain log_and_reject {
47 LOG log-prefix "REJECT: ";
48 proto tcp REJECT reject-with tcp-reset;
53 mod hashlimit hashlimit-name logreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
54 mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second LOG log-prefix "DROP: ";
64 mod state state (ESTABLISHED RELATED) ACCEPT;
67 # some of our hosts (e.g. villa and lobos) do ipv6 via tunnels (proto 41)
68 # this requires we allow proto ipv6 to work in all cases.
69 # without this, ipv6 connectivity only works once the host itself
70 # created some ipv6 connectivity to some place.
72 mod state state (INVALID) DROP;
81 proto (tcp udp) mod multiport destination-ports (135 137 138 139 445 1026 1027 1433) DROP;
86 @hook pre "umask 0177; rm -f /var/run/iptables-ferm.checksum /var/run/ip6tables-ferm.checksum";
87 @hook post "umask 0177; iptables-save | sed -e 's/\[.*//' -e 's/^#.*//' | sha256sum > /var/run/iptables-ferm.checksum";
88 @hook post "umask 0177; ip6tables-save | sed -e 's/\[.*//' -e 's/^#.*//' | sha256sum > /var/run/ip6tables-ferm.checksum";