zulip

Commit Graph

Author	SHA1	Message	Date
Alex Vandiver	5857dcd9b4	puppet: Configure ip6tables in parallel to ipv4. Previously, IPv6 firewalls were left at the default all-open. Configure IPv6 equivalently to IPv4.	2021-08-24 16:05:46 -07:00
Alex Vandiver	845509a9ec	puppet: Be explicit that existing iptables are only ipv4.	2021-08-24 16:05:46 -07:00
Alex Vandiver	c9141785fd	puppet: Use concat fragments to place port allows next to services. This means that services will only open their ports if they are actually run, without having to clutter rules.v4 with a log of `if` statements. This does not go as far as using `puppetlabs/firewall`[1] because that would represent an additional DSL to learn; raw IPtables sections can easily be inserted into the generated iptables file via `concat::fragment` (either inline, or as a separate file), but config can be centralized next to the appropriate service. [1] https://forge.puppet.com/modules/puppetlabs/firewall	2021-05-27 21:14:48 -07:00

Author

SHA1

Message

Date

Alex Vandiver

5857dcd9b4

puppet: Configure ip6tables in parallel to ipv4.

Previously, IPv6 firewalls were left at the default all-open.

Configure IPv6 equivalently to IPv4.

2021-08-24 16:05:46 -07:00

Alex Vandiver

845509a9ec

puppet: Be explicit that existing iptables are only ipv4.

2021-08-24 16:05:46 -07:00

Alex Vandiver

c9141785fd

puppet: Use concat fragments to place port allows next to services.

This means that services will only open their ports if they are
actually run, without having to clutter rules.v4 with a log of `if`
statements.

This does not go as far as using `puppetlabs/firewall`[1] because that
would represent an additional DSL to learn; raw IPtables sections can
easily be inserted into the generated iptables file via
`concat::fragment` (either inline, or as a separate file), but config
can be centralized next to the appropriate service.

[1] https://forge.puppet.com/modules/puppetlabs/firewall

2021-05-27 21:14:48 -07:00

3 Commits