Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

iptables: Stop logging on dropped packets. 

We never examine these logs, and it fills dmesg.  We have flow logging at the AWS stack layer.
This commit is contained in:
Alex Vandiver 2023-08-30 11:15:20 -04:00 committed by Tim Abbott
parent 792a44b382
commit f8636e7d2b
4 changed files with 6 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
puppet/zulip_ops/files/iptables/header.v4
View File

@ -1,11 +1,6 @@
# This file was auto-generated by Puppet. Do not edit by hand. # This file was auto-generated by Puppet. Do not edit by hand.
*filter *filter
# Set up logging for dropped packets
-N LOGDROP
-A LOGDROP -m limit --limit 15/min -j LOG --log-prefix "iptables dropped: " --log-level 7
-A LOGDROP -j DROP
# Allow all outbound traffic # Allow all outbound traffic
-A OUTPUT -j ACCEPT -A OUTPUT -j ACCEPT
@ -13,7 +8,7 @@
-A INPUT -i lo -j ACCEPT -A INPUT -i lo -j ACCEPT
# Drop all traffic to loopback IPs on other interfaces # Drop all traffic to loopback IPs on other interfaces
-A INPUT ! -i lo -d 127.0.0.0/8 -j LOGDROP -A INPUT ! -i lo -d 127.0.0.0/8 -j DROP
# Accept incoming traffic related to established connections # Accept incoming traffic related to established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

7
puppet/zulip_ops/files/iptables/header.v6
View File

@ -1,11 +1,6 @@
# This file was auto-generated by Puppet. Do not edit by hand. # This file was auto-generated by Puppet. Do not edit by hand.
*filter *filter
# Set up logging for dropped packets
-N LOGDROP
-A LOGDROP -m limit --limit 15/min -j LOG --log-prefix "ip6tables dropped: " --log-level 7
-A LOGDROP -j DROP
# Allow all outbound traffic # Allow all outbound traffic
-A OUTPUT -j ACCEPT -A OUTPUT -j ACCEPT
@ -13,7 +8,7 @@
-A INPUT -i lo -j ACCEPT -A INPUT -i lo -j ACCEPT
# Drop all traffic to loopback IPs on other interfaces # Drop all traffic to loopback IPs on other interfaces
-A INPUT ! -i lo -d ::1/128 -j LOGDROP -A INPUT ! -i lo -d ::1/128 -j DROP
# Allow ICMP; it is more fundamental to IPv6 functioning. # Allow ICMP; it is more fundamental to IPv6 functioning.
-A INPUT -p icmpv6 -j ACCEPT -A INPUT -p icmpv6 -j ACCEPT

4
puppet/zulip_ops/files/iptables/trailer.v4
View File

@ -1,6 +1,6 @@
# Drop everything else # Drop everything else
-A INPUT -j LOGDROP -A INPUT -j DROP
-A FORWARD -j LOGDROP -A FORWARD -j DROP
COMMIT COMMIT

4
puppet/zulip_ops/files/iptables/trailer.v6
View File

@ -1,6 +1,6 @@
# Drop everything else # Drop everything else
-A INPUT -j LOGDROP -A INPUT -j DROP
-A FORWARD -j LOGDROP -A FORWARD -j DROP
COMMIT COMMIT