chrisandClaude Opus 5.5
02990faf70
- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate (default 30, burst twice the rate); the rule now only drops SYNs above the limit instead of accepting those below it; several IPv6 fixes. - defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false, fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995", new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6). - templates, extract-fw-host-vars.py, README: new variable and defaults. - oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6 (it would have enabled the limit for IPv6 with the new default ports). - piwik: fw_manage_config: true, per_IP_connection_limit 501, no new-connection limit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
197 lines
4.6 KiB
Bash
197 lines
4.6 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# -------------
|
|
# --- Default Parameter / Options
|
|
# -------------
|
|
|
|
default_per_IP_connection_limit=250
|
|
|
|
# ip6t-firewall-server,ipt-firewall-server:
|
|
# New (syn) TCP connections per second per source IP on the ports in
|
|
# 'limit_new_tcp_connections_per_seconds_ports'. The burst is twice
|
|
# this value.
|
|
#
|
|
default_limit_new_tcp_connections_per_seconds_rate=30
|
|
|
|
|
|
# -------------
|
|
# --- Default Ports for Services out
|
|
# -------------
|
|
|
|
standard_checkmk_port=6556
|
|
standard_cpan_wait_port=1404
|
|
standard_dns_port=53
|
|
standard_ftp_port=21
|
|
standard_ftp_data_port=20
|
|
standard_git_port=9418
|
|
standard_hbci_port=3000
|
|
standard_http_port=80
|
|
standard_https_port=443
|
|
standard_ident_port=113
|
|
standard_ipp_port=631
|
|
standard_cups_port=$standard_ipp_port
|
|
standard_irc_port=6667
|
|
standard_jabber_port=5222
|
|
standard_ldap_port=389
|
|
standard_ldaps_port=636
|
|
standard_mdns_port=5353
|
|
standard_mndp_port=5678
|
|
standard_mumble_port=64738
|
|
standard_munin_port=4949
|
|
standard_mysql_port=3306
|
|
standard_ntp_port=123
|
|
standard_pgp_keyserver_port=11371
|
|
standard_print_port=9100
|
|
standard_print_raw_port=515
|
|
standard_remote_console_port=5900
|
|
standard_silc_port=706
|
|
standard_smtp_port=25
|
|
standard_snmp_port=161
|
|
standard_snmp_trap_port=162
|
|
standard_ssh_port=22
|
|
standard_telnet_port=23
|
|
standard_tftp_udp_port=69
|
|
standard_timeserver_port=37
|
|
standard_vpn_port=1194
|
|
standard_wireguard_port=51820
|
|
standard_whois_port=43
|
|
standard_xymon_port=1984
|
|
|
|
# - Prometheus services
|
|
# -
|
|
standard_prometheus_ports="9100,9256"
|
|
|
|
# - Mattermost (MM) Service
|
|
# -
|
|
standard_mattermost_udp_ports_in="8443"
|
|
standard_mattermost_tcp_ports_in="8443"
|
|
standard_mattermost_udp_ports_out="3478"
|
|
|
|
# - IPsec - Internet Security Association and
|
|
# - Key Management Protocol
|
|
standard_isakmp_port=500
|
|
standard_ipsec_nat_t=4500
|
|
|
|
|
|
# - Comma separated lists
|
|
# -
|
|
standard_http_ports="80,443"
|
|
standard_mailuser_ports="587,465,110,995,143,993"
|
|
|
|
|
|
# ip6t-firewall-server:
|
|
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
|
|
#
|
|
throttle_tcp6_mss_for_https=false
|
|
min_tcp6_mss_for_https_val=1280
|
|
|
|
# ip6t-firewall-server,ipt-firewall-server:
|
|
# some restrictions on HTTP connections to counteract attacks.
|
|
#
|
|
# The default value used to be set to '30'
|
|
#
|
|
set_max_new_http_conn_per_ip_per_second=true
|
|
default_max_http_new_conn_per_ip_per_second=200
|
|
|
|
# The default value used to be set to '50'
|
|
#
|
|
set_max_concurrent_http_conn_per_ip=true
|
|
default_max_concurrent_http_conn_per_ip=100
|
|
|
|
# The default value used to be set to '200'
|
|
#
|
|
set_max_new_http_conn_per_second=true
|
|
default_max_new_http_conn_per_second=400
|
|
|
|
# ip6t-firewall-server:
|
|
# Prefix length for entries in 'ban_ipv6.list' given without mask.
|
|
#
|
|
default_ban_ipv6_mask=128
|
|
|
|
|
|
# - Dovecot Service
|
|
# -
|
|
dovecot_external_auth_port="44444"
|
|
|
|
# - Jitsi Video Conference Service
|
|
# -
|
|
standard_jitsi_tcp_ports="$standard_http_ports"
|
|
standard_jitsi_udp_port_range="10000:20000"
|
|
default_jitsi_dovecout_auth_port="$dovecot_external_auth_port"
|
|
|
|
# - Jibri Service
|
|
# -
|
|
default_jibri_out_port=5222
|
|
# default_outbound_streaming_tcp_ports
|
|
#
|
|
# - outbound port 1935/TCP : outbound streaming over RTMP to most
|
|
# streaming providers such as YouTube Live, Vimeo or Twitch
|
|
#
|
|
# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn
|
|
# Live (port 1935 is also used for RTMP streaming to LinkedIn)
|
|
#
|
|
# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
|
|
# RTMPS to LinkedIn Live
|
|
#
|
|
# - outbound port 443/TCP (HTTPS) : used for authentication with the
|
|
# built-in providers such as YouTube Live, Facebook Live, Ustream,
|
|
# Livestream, and Twitch
|
|
#
|
|
# - outbound port 53/UDP (DNS) used for DNS lookups converting
|
|
# hostnames to IP addresses
|
|
#
|
|
default_outbound_streaming_tcp_ports="1935,1936,2935,2396"
|
|
|
|
|
|
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
|
|
# -
|
|
standard_turn_service_ports="3478:3479,5349:5350"
|
|
standard_turn_service_udp_ports="49152:65535"
|
|
|
|
|
|
# -------------
|
|
# --- Predefined Ports
|
|
# -------------
|
|
|
|
# - unpriviligierte Ports
|
|
# -
|
|
unprivports="1024:65535"
|
|
|
|
|
|
# -------------
|
|
# --- Some IPv4-Address Configuration
|
|
# -------------
|
|
|
|
# - Loopback
|
|
loopback_ipv4="127.0.0.0/8"
|
|
|
|
# - Private Networks
|
|
priv_class_a="10.0.0.0/8"
|
|
priv_class_b="172.16.0.0/12"
|
|
priv_class_c="192.168.0.0/16"
|
|
|
|
link_local_rfc_5735="169.254.0.0/16"
|
|
|
|
test_net_1_rfc_5735="192.0.2.0/24"
|
|
this_net_rfc_5735="0.0.0.0/8"
|
|
|
|
# - Multicast Addresse
|
|
class_d_multicast="224.0.0.0/3"
|
|
|
|
# Reserved Addresse
|
|
class_e_reserved="240.0.0.0/5"
|
|
|
|
|
|
# -------------
|
|
# --- Some IPv6-Address Configuration
|
|
# -------------
|
|
|
|
# unique local address (ULA) - private address block
|
|
ula_block="fc00::/7"
|
|
link_local_unicast_block="fe80::/10"
|
|
multicast_ipv6="ff00::/8"
|
|
|
|
# - Loopback
|
|
loopback_ipv6="::1/128"
|
|
|