WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): moved nftables reserved networks behind a feature flag and no longer block 0.0.0.0/8 and 169.254.0.0/16 by default to ease DHCP and APIPA configuration

Browse source
This commit is contained in:
NaeiKinDus 2024-12-27 00:00:00 +00:00
parent 667c7de87e
commit 21185a17c4
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
3 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/debian/nftables.conf.j2
View file

@ -25,9 +25,7 @@ define private_nets = {
192.0.0.0/24, 192.168.0.0/16, 198.18.0.0/15
}
define reserved_nets = {
0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24,
192.88.99.0/24, 198.51.100.0/24, 203.0.113.0/24,
224.0.0.0/4, 233.252.0.0/24, 240.0.0.0/4
{{ security_firewall_reserved_nets_ip4 | join(", ") | wordwrap(40, wrapstring="\n\t", break_long_words=False) }}
}
define ssh_localport = {{ security_ssh_port }}

2
collections/ansible_collections/nullified/infrastructure/roles/security/templates/system/nftables/02-mangle.table.j2
View file

@ -32,7 +32,9 @@ table inet mangle {
{% if security_firewall_mangle_drop_privatenets -%}
ip saddr $private_nets counter drop
{% endif -%}
{% if security_firewall_mangle_drop_reservednets -%}
ip saddr $reserved_nets counter drop
{% endif -%}
iifname != "lo" ip saddr 127.0.0.0/8 counter drop
}