ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Role ipt-server: configurable rate for the new-TCP-connection limit; new defaults.

Browse Source 
- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf
  with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate
  (default 30, burst twice the rate); the rule now only drops SYNs above the
  limit instead of accepting those below it; several IPv6 fixes.
- defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false,
  fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995",
  new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6).
- templates, extract-fw-host-vars.py, README: new variable and defaults.
- oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6
  (it would have enabled the limit for IPv6 with the new default ports).
- piwik: fw_manage_config: true, per_IP_connection_limit 501, no
  new-connection limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-11 18:51:16 +01:00
co-authored by Claude Opus 5.5
parent 534ad28be9
commit 02990faf70
10 changed files with 116 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/ipt-server/defaults/main.yml
+6 -2
View File
@@ -364,8 +364,12 @@ fw_protection_against_ssh_brute_force_attacks: true
fw_limit_connections_per_source_IP: true
fw_per_IP_connection_limit: "$default_per_IP_connection_limit"
fw_limit_new_tcp_connections_per_seconds_per_source_IP: true
fw_limit_new_tcp_connections_per_seconds_ports: ""
# Rate limit for new TCP connections per source IP; only active if true
# and the port list (comma separated) is not empty.
fw_limit_new_tcp_connections_per_seconds_per_source_IP: false
fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995"
# New connections per second per source IP; burst is twice this value.
fw_limit_new_tcp_connections_per_seconds_rate: "$default_limit_new_tcp_connections_per_seconds_rate"
# ---