X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/7792eec3d75f40db1ed44bad7e89efc3fedbcfde..9fd056986b8782f8af1715113e0a04e6655ae35c:/cookbooks/networking/templates/default/shorewall.conf.erb?ds=sidebyside diff --git a/cookbooks/networking/templates/default/shorewall.conf.erb b/cookbooks/networking/templates/default/shorewall.conf.erb index da5c8c202..290c73fb6 100644 --- a/cookbooks/networking/templates/default/shorewall.conf.erb +++ b/cookbooks/networking/templates/default/shorewall.conf.erb @@ -12,162 +12,263 @@ STARTUP_ENABLED=Yes VERBOSITY=1 +############################################################################### +# P A G E R +############################################################################### + +PAGER= + +############################################################################### +# F I R E W A L L +############################################################################### + +FIREWALL= + ############################################################################### # L O G G I N G ############################################################################### -LOGFILE=/var/log/messages +<% if node[:networking][:firewall][:log] -%> +LOG_LEVEL="info" +<% else -%> +LOG_LEVEL="none" +<% end -%> -STARTUP_LOG=/var/log/shorewall-init.log +BLACKLIST_LOG_LEVEL= + +INVALID_LOG_LEVEL= + +LOG_BACKEND= + +LOG_MARTIANS=Yes LOG_VERBOSITY=2 -LOGFORMAT="Shorewall:%s:%s:" +LOGALLNEW= + +LOGFILE=/var/log/messages + +LOGFORMAT="%s %s " LOGTAGONLY=No -LOGALLNEW= +LOGLIMIT="s:1/sec:10" -BLACKLIST_LOGLEVEL= +MACLIST_LOG_LEVEL="$LOG_LEVEL" -MACLIST_LOG_LEVEL=info +RELATED_LOG_LEVEL= -TCP_FLAGS_LOG_LEVEL=info +RPFILTER_LOG_LEVEL="$LOG_LEVEL" -SMURF_LOG_LEVEL=info +SFILTER_LOG_LEVEL="$LOG_LEVEL" -LOG_MARTIANS=Yes +SMURF_LOG_LEVEL="$LOG_LEVEL" + +STARTUP_LOG=/var/log/shorewall-init.log + +TCP_FLAGS_LOG_LEVEL="$LOG_LEVEL" + +UNTRACKED_LOG_LEVEL= ############################################################################### # L O C A T I O N O F F I L E S A N D D I R E C T O R I E S ############################################################################### +ARPTABLES= + +CONFIG_PATH=":${CONFDIR}/shorewall:${SHAREDIR}/shorewall" + +GEOIPDIR=/usr/share/xt_geoip/LE + IPTABLES= IP= -TC= - IPSET= -PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin +LOCKFILE= -SHOREWALL_SHELL=/bin/sh +MODULESDIR= -SUBSYSLOCK="" +NFACCT= -MODULESDIR= +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin -CONFIG_PATH=/etc/shorewall:/usr/share/shorewall +PERL=/usr/bin/perl -RESTOREFILE= +RESTOREFILE=restore -IPSECFILE=zones +SHOREWALL_SHELL=/bin/sh -LOCKFILE= +SUBSYSLOCK="" + +TC= ############################################################################### # D E F A U L T A C T I O N S / M A C R O S ############################################################################### -DROP_DEFAULT="Drop" -REJECT_DEFAULT="Reject" ACCEPT_DEFAULT="none" -QUEUE_DEFAULT="none" +BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL" +DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)" NFQUEUE_DEFAULT="none" +QUEUE_DEFAULT="none" +REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)" ############################################################################### # R S H / R C P C O M M A N D S ############################################################################### -RSH_COMMAND='ssh ${root}@${system} ${command}' RCP_COMMAND='scp ${files} ${root}@${system}:${destination}' +RSH_COMMAND='ssh ${root}@${system} ${command}' ############################################################################### # F I R E W A L L O P T I O N S ############################################################################### -IP_FORWARDING=Keep +ACCOUNTING=Yes + +ACCOUNTING_TABLE=filter -ADD_IP_ALIASES=Yes +ADD_IP_ALIASES=No ADD_SNAT_ALIASES=No -RETAIN_ALIASES=No +ADMINISABSENTMINDED=Yes -TC_ENABLED=Internal +AUTOCOMMENT=Yes -TC_EXPERT=No +AUTOHELPERS=Yes -CLEAR_TC=Yes +AUTOMAKE=Yes -MARK_IN_FORWARD_CHAIN=No +BALANCE_PROVIDERS=No + +BASIC_FILTERS=No + +<% if node[:networking][:firewall][:raw] -%> +BLACKLIST="NEW,INVALID,UNTRACKED" +<% else -%> +BLACKLIST="NEW,INVALID" +<% end -%> CLAMPMSS=No -ROUTE_FILTER=Yes +CLEAR_TC=Yes + +COMPLETE=No + +DEFER_DNS_RESOLUTION=Yes + +DELETE_THEN_ADD=Yes DETECT_DNAT_IPADDRS=No -MUTEX_TIMEOUT=60 +DISABLE_IPV6=No -ADMINISABSENTMINDED=Yes +DOCKER=No -DELAYBLACKLISTLOAD=No +DONT_LOAD= -MODULE_SUFFIX=ko +DYNAMIC_BLACKLIST=Yes -DISABLE_IPV6=No +EXPAND_POLICIES=Yes + +EXPORTMODULES=Yes -BRIDGING=No +FASTACCEPT=No -DYNAMIC_ZONES=No +FORWARD_CLEAR_MARK= -PKTTYPE=Yes +HELPERS= -NULL_ROUTE_RFC1918=No +IGNOREUNKNOWNVARIABLES=No + +IMPLICIT_CONTINUE=No + +INLINE_MATCHES=No + +IPSET_WARNINGS=Yes + +IP_FORWARDING=Keep + +KEEP_RT_TABLES=No + +LOAD_HELPERS_ONLY=Yes MACLIST_TABLE=filter MACLIST_TTL= -SAVE_IPSETS=No +MANGLE_ENABLED=Yes MAPOLDACTIONS=No -FASTACCEPT=No +MARK_IN_FORWARD_CHAIN=No -IMPLICIT_CONTINUE=Yes +MINIUPNPD=No -USE_ACTIONS=Yes +MULTICAST=No -OPTIMIZE=1 +MUTEX_TIMEOUT=60 -EXPORTPARAMS=Yes +NULL_ROUTE_RFC1918=No -EXPAND_POLICIES=Yes +OPTIMIZE=All -KEEP_RT_TABLES=No +OPTIMIZE_ACCOUNTING=No -DELETE_THEN_ADD=Yes +PERL_HASH_SEED=0 -MULTICAST=No +REJECT_ACTION= -DONT_LOAD= +REQUIRE_INTERFACE=No -AUTO_COMMENT=Yes +RESTART=restart -MANGLE_ENABLED=Yes +RESTORE_DEFAULT_ROUTE=Yes + +RESTORE_ROUTEMARKS=Yes + +RETAIN_ALIASES=No + +ROUTE_FILTER=Yes + +SAVE_ARPTABLES=No + +SAVE_IPSETS=No + +<% if node[:networking][:firewall][:mangle] -%> +TC_ENABLED=Internal +<% else -%> +TC_ENABLED=No +<% end -%> + +TC_EXPERT=No + +TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2" + +TRACK_PROVIDERS=Yes + +TRACK_RULES=No USE_DEFAULT_RT=No -RESTORE_DEFAULT_ROUTE=Yes +USE_NFLOG_SIZE=No -AUTOMAKE=No +USE_PHYSICAL_NAMES=No -TRACK_PROVIDERS=No +USE_RT_NAMES=No -ZONE2ZONE=2 +VERBOSE_MESSAGES=Yes + +WARNOLDCAPVERSION=Yes + +WORKAROUNDS=No + +ZERO_MARKS=No + +ZONE2ZONE=- ############################################################################### # P A C K E T D I S P O S I T I O N @@ -175,8 +276,32 @@ ZONE2ZONE=2 BLACKLIST_DISPOSITION=DROP +INVALID_DISPOSITION=CONTINUE + MACLIST_DISPOSITION=REJECT +RELATED_DISPOSITION=ACCEPT + +RPFILTER_DISPOSITION=DROP + +SMURF_DISPOSITION=DROP + +SFILTER_DISPOSITION=DROP + TCP_FLAGS_DISPOSITION=DROP -#LAST LINE -- DO NOT REMOVE +UNTRACKED_DISPOSITION=CONTINUE + +################################################################################ +# P A C K E T M A R K L A Y O U T +################################################################################ + +TC_BITS= + +PROVIDER_BITS= + +PROVIDER_OFFSET= + +MASK_BITS= + +ZONE_BITS=0