ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Role ipt-server: configurable rate for the new-TCP-connection limit; new defaults.

Browse Source 
- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf
  with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate
  (default 30, burst twice the rate); the rule now only drops SYNs above the
  limit instead of accepting those below it; several IPv6 fixes.
- defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false,
  fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995",
  new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6).
- templates, extract-fw-host-vars.py, README: new variable and defaults.
- oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6
  (it would have enabled the limit for IPv6 with the new default ports).
- piwik: fw_manage_config: true, per_IP_connection_limit 501, no
  new-connection limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-11 18:51:16 +01:00
co-authored by Claude Opus 5.5
parent 534ad28be9
commit 02990faf70
10 changed files with 116 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/ipt-server/README.md
+5
View File
@@ -221,6 +221,11 @@ Neustart der Firewall aus.
| `fw_max_concurrent_http_conn_per_ip` | `"$default_max_concurrent_http_conn_per_ip"` | Limit dazu |
| `fw_set_max_new_http_conn_per_second` | `true` | SYN-Rate auf 80/443 insgesamt begrenzen |
| `fw_max_new_http_conn_per_second` | `"$default_max_new_http_conn_per_second"` | Limit dazu |
| `fw_limit_connections_per_source_IP` | `true` | Gleichzeitige TCP-Verbindungen pro Quell-IP begrenzen |
| `fw_per_IP_connection_limit` | `"$default_per_IP_connection_limit"` | Limit dazu (Default 250) |
| `fw_limit_new_tcp_connections_per_seconds_per_source_IP` | `false` | Neue TCP-Verbindungen/s pro Quell-IP begrenzen |
| `fw_limit_new_tcp_connections_per_seconds_ports` | `"80,110,143,443,465,995"` | Ports dazu (kommagetrennt) |
| `fw_limit_new_tcp_connections_per_seconds_rate` | `"$default_limit_new_tcp_connections_per_seconds_rate"` | Neue Verbindungen/s pro Quell-IP (Default 30, Burst = doppelter Wert); darüber wird verworfen |
| `fw_throttle_tcp6_mss_for_https` | `false` | Nur IPv6: MSS eingehender HTTPS-SYNs clampen |
| `fw_tcp6_mss_for_https_val` | `"$min_tcp6_mss_for_https_val"` | Nur IPv6: MSS-Wert (z.B. `1360`) |
| `fw_mm_tcp_ports_in` | `"$standard_mattermost_tcp_ports_in"` | Mattermost TCP-Fallback (STUN) |