X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fferm%2Ffiles%2Fferm.conf;h=a88d797c0bd4bdef6d95aa1a3d965168a6d9f44b;hb=d7475f90c56697e9589e1386ced135498df68c81;hp=f761b01e82ed39cc3cbd2e4d7da1d57b0ef6404b;hpb=da5b05d87ed12648ab7f245e26f2e2d7292f1588;p=mirror%2Fdsa-puppet.git diff --git a/modules/ferm/files/ferm.conf b/modules/ferm/files/ferm.conf index f761b01e8..a88d797c0 100644 --- a/modules/ferm/files/ferm.conf +++ b/modules/ferm/files/ferm.conf @@ -41,10 +41,15 @@ domain ip6 { domain (ip ip6) { table filter { chain INPUT { - policy DROP; + policy ACCEPT; mod state state (ESTABLISHED RELATED) ACCEPT; interface lo ACCEPT; proto icmp ACCEPT; + # some of our hosts (e.g. villa and lobos) do ipv6 via tunnels (proto 41) + # this requires we allow proto ipv6 to work in all cases. + # without this, ipv6 connectivity only works once the host itself + # created some ipv6 connectivity to some place. + proto ipv6 ACCEPT; mod state state (INVALID) DROP; } } @@ -54,6 +59,8 @@ domain (ip ip6) { domain (ip ip6) { chain INPUT { + proto (tcp udp) mod multiport destination-ports (135 137 138 139 445 1026 1027 1433) DROP; jump log_or_drop; } } +# vim:set et: