mirror of
https://github.com/zulip/zulip.git
synced 2025-10-23 04:52:12 +00:00
c9141785fd
This means that services will only open their ports if they are actually run, without having to clutter rules.v4 with a log of `if` statements. This does not go as far as using `puppetlabs/firewall`[1] because that would represent an additional DSL to learn; raw IPtables sections can easily be inserted into the generated iptables file via `concat::fragment` (either inline, or as a separate file), but config can be centralized next to the appropriate service. [1] https://forge.puppet.com/modules/puppetlabs/firewall
22 lines
584 B
Plaintext
22 lines
584 B
Plaintext
# This file was auto-generated by Puppet. Do not edit by hand.
|
|
*filter
|
|
|
|
# Set up logging for dropped packets
|
|
-N LOGDROP
|
|
-A LOGDROP -m limit --limit 15/min -j LOG --log-prefix "iptables dropped: " --log-level 7
|
|
-A LOGDROP -j DROP
|
|
|
|
# Allow all outbound traffic
|
|
-A OUTPUT -j ACCEPT
|
|
|
|
# Accept all loopback traffic
|
|
-A INPUT -i lo -j ACCEPT
|
|
|
|
# Drop all traffic to loopback IPs on other interfaces
|
|
-A INPUT ! -i lo -d 127.0.0.0/8 -j LOGDROP
|
|
|
|
# Accept incoming traffic related to established connections
|
|
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Host-specific rules follow:
|