ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Role ipt-server: configurable rate for the new-TCP-connection limit; new defaults.

Browse Source 
- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf
  with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate
  (default 30, burst twice the rate); the rule now only drops SYNs above the
  limit instead of accepting those below it; several IPv6 fixes.
- defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false,
  fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995",
  new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6).
- templates, extract-fw-host-vars.py, README: new variable and defaults.
- oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6
  (it would have enabled the limit for IPv6 with the new default ports).
- piwik: fw_manage_config: true, per_IP_connection_limit 501, no
  new-connection limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-11 18:51:16 +01:00
co-authored by Claude Opus 5.5
parent 534ad28be9
commit 02990faf70
10 changed files with 116 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2
+1
View File
@@ -349,6 +349,7 @@ per_IP_connection_limit={{ (fw_per_IP_connection_limit_v6 | default(fw_per_IP_co
limit_new_tcp_connections_per_seconds_per_source_IP={{ (fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6 | default(fw_limit_new_tcp_connections_per_seconds_per_source_IP)) | lower }}
limit_new_tcp_connections_per_seconds_ports="{{ (fw_limit_new_tcp_connections_per_seconds_ports_v6 | default(fw_limit_new_tcp_connections_per_seconds_ports)) }}"
limit_new_tcp_connections_per_seconds_rate="{{ (fw_limit_new_tcp_connections_per_seconds_rate_v6 | default(fw_limit_new_tcp_connections_per_seconds_rate)) }}"
# -------------