system-config

History

Jeremy Stanley 7308220484 Switch IPv4 rejects from host-prohibit to admin When generically rejecting connections, we'd prefer to signal to users clearly that it's the firewall rejecting them. For IPv4 we previously emitted generic ICMP "no route to host" responses, but this tends to make it look incorrectly like a routing failure. Switch to flagging our error responses as "administratively prohibited" which is more accurate and less confusing. We're also already using icmp6-adm-prohibited for the v6 rules, so this makes our v4 ruleset more consistent. Note that the iptables-extensions(8) manpage indicates "Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT" but all our kernels should have support for it these days so this isn't a concern. Change-Id: Id423f3ec03d0c3c4e40ddef34c38f97167b173f6		2021-09-21 18:19:06 +00:00
..
defaults	Run iptables in service playbooks instead of base	2020-06-04 07:44:22 -05:00
handlers	Run iptables in service playbooks instead of base	2020-06-04 07:44:22 -05:00
tasks	Run iptables in service playbooks instead of base	2020-06-04 07:44:22 -05:00
templates	Switch IPv4 rejects from host-prohibit to admin	2021-09-21 18:19:06 +00:00
vars	Run iptables in service playbooks instead of base	2020-06-04 07:44:22 -05:00
README.rst	Run iptables in service playbooks instead of base	2020-06-04 07:44:22 -05:00

Install and configure iptables

Role Variables