cellinfo
/
ansible.nftables
2
0
Fork 0
Code Issues Pull Requests Releases Activity

Remove DHCP incoming packets. The connection is started by the host, don't need incoming rule.

This commit is contained in:
Jeremy Gardais 2017-08-09 16:08:52 +02:00
parent 5dd7ea7a5d
commit 4beb9019de
3 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -8,6 +8,7 @@
### Default Rules ### Default Rules
* Use more sets and vars definitions to avoid multiple rules. * Use more sets and vars definitions to avoid multiple rules.
* Allow outgoing icmp. * Allow outgoing icmp.
* Remove DHCP incoming packets. The connection is started by the host, don't need incoming rule.
## v1.0 ## v1.0

2
README.md
View File

@ -79,8 +79,6 @@ nft_input_default_rules:
- ip daddr @blackhole counter drop - ip daddr @blackhole counter drop
015 localhost: 015 localhost:
- iif lo accept - iif lo accept
040 dhcp:
- udp sport bootps udp dport bootpc limit rate 6/minute accept
220 ssh: 220 ssh:
- tcp dport ssh ct state new counter accept - tcp dport ssh ct state new counter accept
nft_input_group_rules: {} nft_input_group_rules: {}

2
defaults/main.yml
View File

@ -34,8 +34,6 @@ nft_input_default_rules:
- ip daddr @blackhole counter drop - ip daddr @blackhole counter drop
015 localhost: 015 localhost:
- iif lo accept - iif lo accept
040 dhcp:
- udp sport bootps udp dport bootpc limit rate 6/minute accept
220 ssh: 220 ssh:
- tcp dport ssh ct state new counter accept - tcp dport ssh ct state new counter accept
nft_input_group_rules: {} nft_input_group_rules: {}