ansible/custom-firewall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: block icmp

Browse Source
This commit is contained in:
OldTyT
2026-02-21 19:23:33 +03:00
parent 6cab32c19e
commit 9ab5401782
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
templates/custom.firewall-restore.j2
View File

@@ -21,6 +21,8 @@ iptables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP iptables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
iptables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP iptables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
iptables -I enemy_input -p icmp --icmp-type echo-request -j DROP
# IPv6 # IPv6
ip6tables -N f2b-sshd ip6tables -N f2b-sshd
@@ -37,3 +39,5 @@ ip6tables -I enemy_input 3 -m set --match-set {{ whitelist_ip6_name }} src -j AC
ip6tables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT ip6tables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP ip6tables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
ip6tables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP ip6tables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
ip6tables -I enemy_input -p icmpv6 --icmpv6-type echo-request -j DROP