zulip/puppet/kandra/files/iptables/zmirror.v4

# Accept incoming traffic on UDP port 2104 (zhm)
-A INPUT -p udp --dport 2104 -j ACCEPT

# It's hard to know what ephemeral ports the zephyr clients are listening on.
# Apparently they do not send outgoing traffic sufficient for the
# ESTABLISHED,RELATED rule above.  So for now we allow all UDP traffic.
#
# FIXME: do something better here.
-A INPUT -p udp -j ACCEPT
puppet: Use concat fragments to place port allows next to services. This means that services will only open their ports if they are actually run, without having to clutter rules.v4 with a log of `if` statements. This does not go as far as using `puppetlabs/firewall`[1] because that would represent an additional DSL to learn; raw IPtables sections can easily be inserted into the generated iptables file via `concat::fragment` (either inline, or as a separate file), but config can be centralized next to the appropriate service. [1] https://forge.puppet.com/modules/puppetlabs/firewall 2021-05-25 04:12:28 +02:00			`# Accept incoming traffic on UDP port 2104 (zhm)`
			`-A INPUT -p udp --dport 2104 -j ACCEPT`

			`# It's hard to know what ephemeral ports the zephyr clients are listening on.`
			`# Apparently they do not send outgoing traffic sufficient for the`
			`# ESTABLISHED,RELATED rule above. So for now we allow all UDP traffic.`
			`#`
			`# FIXME: do something better here.`
			`-A INPUT -p udp -j ACCEPT`