freifunk/ansible-ffibk
9
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Role network-iptables-gateway: fix freifunk bridge rules

Browse source
This commit is contained in:
Tobias Hachmer 2017-11-14 23:09:55 +01:00
parent 071bdb40d4
commit 80bd91a469
2 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
roles/network-iptables-gateway/templates/rules.v4.j2
View file

@ -8,8 +8,12 @@
-A INPUT -d {{ ansible_default_ipv4.address | ipaddr('public') }}/32 -p gre -j ACCEPT -A INPUT -d {{ ansible_default_ipv4.address | ipaddr('public') }}/32 -p gre -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
{% for mesh in meshes %} {% for mesh_forward in meshes %}
-A FORWARD -i {{ mesh.id }}br -o {{ mesh.id }}br -j ACCEPT {% for mesh_recursive in meshes recursive %}
{% if not mesh_forward.id == mesh_recursive.id %}
-A FORWARD -i {{ mesh_forward.id }}br -o {{ mesh_recursive.id }}br -j ACCEPT
{% endif %}
{% endfor %}
{% endfor %} {% endfor %}
-A FORWARD -m conntrack --ctstate INVALID -j DROP -A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

8
roles/network-iptables-gateway/templates/rules.v6.j2
View file

@ -7,8 +7,12 @@
:OUTPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0]
-A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
{% for mesh in meshes %} {% for mesh_forward in meshes %}
-A FORWARD -i {{ mesh.id }}br -o {{ mesh.id }}br -j ACCEPT {% for mesh_recursive in meshes recursive %}
{% if not mesh_forward.id == mesh_recursive.id %}
-A FORWARD -i {{ mesh_forward.id }}br -o {{ mesh_recursive.id }}br -j ACCEPT
{% endif %}
{% endfor %}
{% endfor %} {% endfor %}
-A FORWARD -m conntrack --ctstate INVALID -j DROP -A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT