aboutsummaryrefslogtreecommitdiff
path: root/os/config/roles/network
diff options
context:
space:
mode:
authorQuentin Dufour <quentin@deuxfleurs.fr>2020-10-22 18:29:37 +0200
committerQuentin Dufour <quentin@deuxfleurs.fr>2020-10-22 18:29:37 +0200
commitb53b71f750008267351d84938b4701413f045628 (patch)
treecc2c8aea67333e2df7320c9a225cd585c78421ee /os/config/roles/network
parent6858f17766fcd6fd0f05c43393188b79d29be5e5 (diff)
downloadinfrastructure-b53b71f750008267351d84938b4701413f045628.tar.gz
infrastructure-b53b71f750008267351d84938b4701413f045628.zip
Fix some bugsfeature/bind_ipv6
Diffstat (limited to 'os/config/roles/network')
-rw-r--r--os/config/roles/network/templates/rules.v45
-rw-r--r--os/config/roles/network/templates/rules.v66
2 files changed, 8 insertions, 3 deletions
diff --git a/os/config/roles/network/templates/rules.v4 b/os/config/roles/network/templates/rules.v4
index 159f5f7..a5f138b 100644
--- a/os/config/roles/network/templates/rules.v4
+++ b/os/config/roles/network/templates/rules.v4
@@ -3,12 +3,15 @@
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-# Debug
+# Internet Control Message Protocol
-A INPUT -p icmp -j ACCEPT
# Administration
-A INPUT -p tcp --dport 22 -j ACCEPT
+# Diplonat needs everything open to communicate with IGD with the router
+-A INPUT -s 192.168.1.254 -j ACCEPT
+
# Cluster
{% for selected_host in groups['cluster_nodes'] %}
-A INPUT -s {{ hostvars[selected_host]['ipv4'] }} -j ACCEPT
diff --git a/os/config/roles/network/templates/rules.v6 b/os/config/roles/network/templates/rules.v6
index 7365b8a..50737a0 100644
--- a/os/config/roles/network/templates/rules.v6
+++ b/os/config/roles/network/templates/rules.v6
@@ -3,8 +3,10 @@
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-# Debug
+# Internet Control Message Protocol
+# (required)
-A INPUT -p icmp -j ACCEPT
+-A INPUT -p ipv6-icmp -j ACCEPT
# Administration
-A INPUT -p tcp --dport 22 -j ACCEPT
@@ -17,7 +19,7 @@
# Local
-A INPUT -i docker0 -j ACCEPT
-A INPUT -s ::1/128 -j ACCEPT
--A INPUT -m conntrack --cstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
COMMIT