chrisandClaude Opus 5.5
402a6c9e89
- Update firewall scripts and shared conf files from firewall/ipt-server
(HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
bash variables, fall back to IPv6 for shared variables and warn if IPv4
and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
(<short-hostname>-ipt-server.yml) and new variables.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
843 B
Plaintext
23 lines
843 B
Plaintext
# - IPv6 addresses listet here will be completly banned by the firewall
|
|
# -
|
|
# - - Line beginning with '#' will be ignored.
|
|
# - - Blank lines will be ignored
|
|
# - - Only the first entry (until space sign or end of line) of each line will be considered.
|
|
# -
|
|
# - Valid values are:
|
|
# - complete IPv6 adresses like 240e:1ec0:4ab1:feba:e8b4:4fb1:7984:4c
|
|
# - network/nn CIDR notation like 240e:1ec0:4ab1:feba:e8b4:4fb1:7984:4c/56
|
|
# -
|
|
# -
|
|
# - Note:
|
|
# - - If no mask is given mask will be set to 'ban_ipv6_mask' (main_ipv6.conf),
|
|
# - default is '128'
|
|
# - - wrong addresses like '2g01::1' or '2a01::1/129' will be ignored
|
|
# - - entries covering an own (global) address of this host will be ignored
|
|
# -
|
|
# - Example:
|
|
# - 240e:ec:4ab1:feba:e8b4:4fb1:7984:4c
|
|
# - 2a01:30:0:13:5054:ff::1
|
|
# - 2a01:30:0:13:5054:ff::1/56
|
|
|