@include 'conf.d/';
-<% if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) >= 0 -%>
-domain (ip ip6) {
- table filter {
- chain log_and_reject {
- NFLOG nflog-prefix "REJECT: ";
- proto tcp REJECT reject-with tcp-reset;
- REJECT;
- }
-
- chain log_or_drop {
- mod hashlimit hashlimit-name nflogreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
- mod hashlimit hashlimit-name nfloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second NFLOG nflog-prefix "DROP: ";
- DROP;
- }
-
- }
-}
-<% else -%>
-domain ip {
- table filter {
- chain log_and_reject {
- ULOG ulog-prefix "REJECT: ";
- proto tcp REJECT reject-with tcp-reset;
- REJECT;
- }
-
- chain log_or_drop {
- mod hashlimit hashlimit-name ulogreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
- mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second ULOG ulog-prefix "DROP: ";
- DROP;
- }
-
- }
-}
-domain ip6 {
- table filter {
- chain log_and_reject {
- LOG log-prefix "REJECT: ";
- proto tcp REJECT reject-with tcp-reset;
- REJECT;
- }
-
- chain log_or_drop {
- mod hashlimit hashlimit-name logreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
- mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second LOG log-prefix "DROP: ";
- DROP;
- }
- }
-}
-<% end -%>
-domain (ip ip6) {
- table filter {
- chain INPUT {
- policy ACCEPT;
- mod state state (ESTABLISHED RELATED) ACCEPT;
- interface lo ACCEPT;
- proto icmp ACCEPT;
- # some of our hosts (e.g. villa and lobos) do ipv6 via tunnels (proto 41)
- # this requires we allow proto ipv6 to work in all cases.
- # without this, ipv6 connectivity only works once the host itself
- # created some ipv6 connectivity to some place.
- proto ipv6 ACCEPT;
- mod state state (INVALID) DROP;
- }
- }
-}
-
@include 'dsa.d/';
domain (ip ip6) {