From d3b290cdb2f72b9902a0488278e9af9e3f830a29 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Mon, 31 Dec 2018 10:02:27 +0100 Subject: [PATCH] do not rate limit on the loopback interface --- modules/roles/manifests/snapshot_web.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/roles/manifests/snapshot_web.pp b/modules/roles/manifests/snapshot_web.pp index dca0018bf..889fa9d67 100644 --- a/modules/roles/manifests/snapshot_web.pp +++ b/modules/roles/manifests/snapshot_web.pp @@ -61,8 +61,8 @@ class roles::snapshot_web { @ferm::rule { 'dsa-snapshot-connlimit': domain => '(ip ip6)', prio => "005", - rule => "proto tcp mod state state (NEW) daddr (${ipv4addr} ${ipv6addr}) mod multiport destination-ports (80 443) mod connlimit connlimit-above 3 DROP; - proto tcp mod state state (NEW) dport 6081 mod connlimit connlimit-above 3 DROP + rule => "proto tcp mod state state (NEW) interface ! lo daddr (${ipv4addr} ${ipv6addr}) mod multiport destination-ports (80 443) mod connlimit connlimit-above 3 DROP; + proto tcp mod state state (NEW) interface ! lo dport 6081 mod connlimit connlimit-above 3 DROP ", } -- 2.20.1