##
## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
##

# -*- shell-script -*-

@include 'conf.d/';

<% if @lsbmajdistrelease >= '8' -%>
domain (ip ip6) {
        table filter {
              chain log_and_reject {
                      NFLOG nflog-prefix "REJECT: ";
                      proto tcp REJECT reject-with tcp-reset;
                      REJECT;
              }

              chain log_or_drop {
                      mod hashlimit hashlimit-name nflogreject  hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
                      mod hashlimit hashlimit-name nfloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second NFLOG nflog-prefix "DROP: ";
                      DROP;
              }

        }
}
<% else -%>
domain ip {
        table filter {
              chain log_and_reject {
                      ULOG ulog-prefix "REJECT: ";
                      proto tcp REJECT reject-with tcp-reset;
                      REJECT;
              }

              chain log_or_drop {
                      mod hashlimit hashlimit-name ulogreject  hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
                      mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second ULOG ulog-prefix "DROP: ";
                      DROP;
              }

        }
}
domain ip6 {
        table filter {
              chain log_and_reject {
                      LOG log-prefix "REJECT: ";
                      proto tcp REJECT reject-with tcp-reset;
                      REJECT;
              }

              chain log_or_drop {
                      mod hashlimit hashlimit-name logreject  hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
                      mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second LOG log-prefix "DROP: ";
                      DROP;
              }
        }
}
<% end -%>
domain (ip ip6) {
        table filter {
              chain INPUT {
                      policy ACCEPT;
                      mod state state (ESTABLISHED RELATED) ACCEPT;
                      interface lo ACCEPT;
                      proto icmp ACCEPT;
                      # some of our hosts (e.g. villa and lobos) do ipv6 via tunnels (proto 41)
                      # this requires we allow proto ipv6 to work in all cases.
                      # without this, ipv6 connectivity only works once the host itself
                      # created some ipv6 connectivity to some place.
                      proto ipv6 ACCEPT;
                      mod state state (INVALID) DROP;
              }
        }
}

@include 'dsa.d/';

domain (ip ip6) {
        chain INPUT {
                proto (tcp udp) mod multiport destination-ports (135 137 138 139 445 1026 1027 1433) DROP;
                jump log_or_drop;
        }
}

@hook pre "umask 0177; rm -f /var/run/iptables-ferm.checksum /var/run/ip6tables-ferm.checksum";
@hook post "umask 0177; iptables-save | sed -e 's/\[.*//' -e 's/^#.*//' | sha256sum > /var/run/iptables-ferm.checksum";
@hook post "umask 0177; ip6tables-save | sed -e 's/\[.*//' -e 's/^#.*//' | sha256sum > /var/run/ip6tables-ferm.checksum";
# vim:set et: