ansible/oopen-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.

Browse Source 
- Update firewall scripts and shared conf files from firewall/ipt-server
  (HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
  mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
  fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
  fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
  fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
  fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
  rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
  bash variables, fall back to IPv6 for shared variables and warn if IPv4
  and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
  (<short-hostname>-ipt-server.yml) and new variables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-02 22:01:28 +01:00
co-authored by Claude Opus 5.5
parent 4a6fc84c01
commit 402a6c9e89
22 changed files with 666 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/ipt-server/files/etc/ipt-firewall/ban_ipv6.list.sample
+3 -1
View File
@@ -10,8 +10,10 @@
# -
# -
# - Note:
# - - If no mask is given mask will be set to '64'
# - - If no mask is given mask will be set to 'ban_ipv6_mask' (main_ipv6.conf),
# - default is '128'
# - - wrong addresses like '2g01::1' or '2a01::1/129' will be ignored
# - - entries covering an own (global) address of this host will be ignored
# -
# - Example:
# - 240e:ec:4ab1:feba:e8b4:4fb1:7984:4c
roles/ipt-server/files/etc/ipt-firewall/default_settings.conf
+41 -9
View File
@@ -4,7 +4,7 @@
# --- Default Parameter / Options
# -------------
default_per_IP_connection_limit=111
default_per_IP_connection_limit=250
# -------------
@@ -56,8 +56,9 @@ standard_prometheus_ports="9100,9256"
# - Mattermost (MM) Service
# -
stansard_mattermost_udp_ports_in="8443"
stansard_mattermost_udp_ports_out="3478"
standard_mattermost_udp_ports_in="8443"
standard_mattermost_tcp_ports_in="8443"
standard_mattermost_udp_ports_out="3478"
# - IPsec - Internet Security Association and
# - Key Management Protocol
@@ -70,6 +71,37 @@ standard_ipsec_nat_t=4500
standard_http_ports="80,443"
standard_mailuser_ports="587,465,110,995,143,993"
# ip6t-firewall-server:
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
#
throttle_tcp6_mss_for_https=false
min_tcp6_mss_for_https_val=1280
# ip6t-firewall-server,ipt-firewall-server:
# some restrictions on HTTP connections to counteract attacks.
#
# The default value used to be set to '30'
#
set_max_new_http_conn_per_ip_per_second=true
default_max_http_new_conn_per_ip_per_second=200
# The default value used to be set to '50'
#
set_max_concurrent_http_conn_per_ip=true
default_max_concurrent_http_conn_per_ip=100
# The default value used to be set to '200'
#
set_max_new_http_conn_per_second=true
default_max_new_http_conn_per_second=400
# ip6t-firewall-server:
# Prefix length for entries in 'ban_ipv6.list' given without mask.
#
default_ban_ipv6_mask=128
# - Dovecot Service
# -
dovecot_external_auth_port="44444"
@@ -85,20 +117,20 @@ default_jitsi_dovecout_auth_port="$dovecot_external_auth_port"
default_jibri_out_port=5222
# default_outbound_streaming_tcp_ports
#
# - outbound port 1935/TCP : outbound streaming over RTMP to most
# - outbound port 1935/TCP : outbound streaming over RTMP to most
# streaming providers such as YouTube Live, Vimeo or Twitch
#
# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn
# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn
# Live (port 1935 is also used for RTMP streaming to LinkedIn)
#
# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
# RTMPS to LinkedIn Live
#
# - outbound port 443/TCP (HTTPS) : used for authentication with the
# built-in providers such as YouTube Live, Facebook Live, Ustream,
# - outbound port 443/TCP (HTTPS) : used for authentication with the
# built-in providers such as YouTube Live, Facebook Live, Ustream,
# Livestream, and Twitch
#
# - outbound port 53/UDP (DNS) used for DNS lookups converting
# - outbound port 53/UDP (DNS) used for DNS lookups converting
# hostnames to IP addresses
#
default_outbound_streaming_tcp_ports="1935,1936,2935,2396"
roles/ipt-server/files/etc/ipt-firewall/include_functions.conf
+48
View File
@@ -73,6 +73,54 @@ containsElement () {
return 1
}
## - Expand a given IPv6 address (parameter 1) to 32 hex digits without colons.
## - Returns 1 if the address cannot be parsed.
## -
ipv6_expand() {
local _addr="${1,,}"
local _head _tail _group _n _out=""
local -a _h=() _t=()
if [[ "$_addr" == *::* ]] ; then
_head="${_addr%%::*}"
_tail="${_addr#*::}"
[[ "$_tail" == *::* ]] && return 1
[[ -n "$_head" ]] && IFS=':' read -ra _h <<< "$_head"
[[ -n "$_tail" ]] && IFS=':' read -ra _t <<< "$_tail"
_n=$(( 8 - ${#_h[@]} - ${#_t[@]} ))
[[ $_n -lt 1 ]] && return 1
for (( ; _n > 0; _n-- )) ; do
_h+=("0")
done
_h+=("${_t[@]}")
else
IFS=':' read -ra _h <<< "$_addr"
fi
[[ ${#_h[@]} -eq 8 ]] || return 1
for _group in "${_h[@]}" ; do
[[ "$_group" =~ ^[0-9a-f]{1,4}$ ]] || return 1
_out+="$(printf '%04x' "0x$_group")"
done
echo "$_out"
}
## - Check if a given IPv6 address (parameter 1) lies within the network
## - given by address (parameter 2) and prefix length (parameter 3).
## -
ipv6_in_net() {
local _a _n _full _rest
_a="$(ipv6_expand "$1")" || return 1
_n="$(ipv6_expand "$2")" || return 1
_full=$(( $3 / 4 ))
_rest=$(( $3 % 4 ))
[[ "${_a:0:_full}" == "${_n:0:_full}" ]] || return 1
[[ $_rest -eq 0 ]] && return 0
(( (0x${_a:_full:1} >> (4 - _rest)) == (0x${_n:_full:1} >> (4 - _rest)) ))
}
is_number() {
return $(test ! -z "${1##*[!0-9]*}" > /dev/null 2>&1);
roles/ipt-server/files/etc/ipt-firewall/post_declarations.conf
+1 -1
View File
@@ -60,7 +60,7 @@ done
# ---
declare -a ext_ip_arr
for _ip in $ext_ips ; do
host_ip_arr+=("$_ip")
ext_ip_arr+=("$_ip")
done
# ---