Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/puppet/zulip_ops/files/iptables/header.v4

17 lines
423 B
Plaintext
Raw Normal View History

puppet: Use concat fragments to place port allows next to services. This means that services will only open their ports if they are actually run, without having to clutter rules.v4 with a log of `if` statements. This does not go as far as using `puppetlabs/firewall`[1] because that would represent an additional DSL to learn; raw IPtables sections can easily be inserted into the generated iptables file via `concat::fragment` (either inline, or as a separate file), but config can be centralized next to the appropriate service. [1] https://forge.puppet.com/modules/puppetlabs/firewall
2021-05-25 04:12:28 +02:00
# This file was auto-generated by Puppet. Do not edit by hand.
*filter
# Allow all outbound traffic
-A OUTPUT -j ACCEPT
# Accept all loopback traffic
-A INPUT -i lo -j ACCEPT
# Drop all traffic to loopback IPs on other interfaces
iptables: Stop logging on dropped packets. We never examine these logs, and it fills dmesg. We have flow logging at the AWS stack layer.
2023-08-30 17:15:20 +02:00
-A INPUT ! -i lo -d 127.0.0.0/8 -j DROP
puppet: Use concat fragments to place port allows next to services. This means that services will only open their ports if they are actually run, without having to clutter rules.v4 with a log of `if` statements. This does not go as far as using `puppetlabs/firewall`[1] because that would represent an additional DSL to learn; raw IPtables sections can easily be inserted into the generated iptables file via `concat::fragment` (either inline, or as a separate file), but config can be centralized next to the appropriate service. [1] https://forge.puppet.com/modules/puppetlabs/firewall
2021-05-25 04:12:28 +02:00
# Accept incoming traffic related to established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Host-specific rules follow: