Projet

Général

Profil

Révision 15aaf3c5

ID15aaf3c5703974be718a45d48e87475499012116
Parent d4de1bfe
Enfant a6064b9f

Ajouté par tr il y a plus de 4 ans

Allow only specific icmp types

  • Rate limit the echo-requests
  • Allow icmp types (w/o rate limit) which are protocol relevant

Voir les différences:

files/config/puppet-filter.nft
6 6 
    ct state established,related accept
7 7 
    ct state invalid drop
8 8 

  		




  9
  
  
    
    ip protocol icmp limit rate 4/second accept


  		




  10
  
  
    
    ip6 nexthdr ipv6-icmp limit rate 4/second accept


  		




  11
  
  
    
    ip protocol igmp limit rate 4/second accept


  		




  
  9
  
    
    ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept


  		




  
  10
  
    
    ip6 nexthdr ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-reduction, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } accept


  		




  
  11
  
    
    ip protocol icmp icmp type echo-request limit rate 4/second accept


  		




  
  12
  
    
    ip6 nexthdr ipv6-icmp icmpv6 type echo-request limit rate 4/second accept


  		




  12
  13
  
    
  }


  		




  13
  14
  
    

  		




  14
  15
  
    
  chain INPUT {


  		












Formats disponibles :  Unified diff