- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf
with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate
(default 30, burst twice the rate); the rule now only drops SYNs above the
limit instead of accepting those below it; several IPv6 fixes.
- defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false,
fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995",
new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6).
- templates, extract-fw-host-vars.py, README: new variable and defaults.
- oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6
(it would have enabled the limit for IPv6 with the new default ports).
- piwik: fw_manage_config: true, per_IP_connection_limit 501, no
new-connection limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be
overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these
overrides when the IPv4 and IPv6 configs differ, instead of a warning.
Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de
and web0.warenform.de (fw_manage_config: true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chrisandClaude Opus 5.5