Archives/algo
2
0
Fork 0
mirror of https://github.com/trailofbits/algo synced 2024-11-04 06:00:21 +00:00
Code Issues Projects Releases Wiki Activity

iptables filter table fix (#285)

Browse Source
This commit is contained in:
Dan Guido 2017-03-27 00:04:46 -04:00 committed by GitHub
parent a558b5b549
commit 655a917dd2
3 changed files with 2 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
roles/vpn/tasks/ubuntu.yml
View File

@ -24,21 +24,6 @@
- strongswan
- netfilter-persistent
- name: Ubuntu | Configure iptables so IPSec traffic can traverse the tunnel
iptables: table=nat chain=POSTROUTING source="{{ vpn_network }}" jump=MASQUERADE
when: (security_enabled is not defined) or
(security_enabled is defined and security_enabled != "y")
notify:
- save iptables
- name: Ubuntu | Configure ip6tables so IPSec traffic can traverse the tunnel
iptables: ip_version=ipv6 table=nat chain=POSTROUTING source="{{ vpn_network_ipv6 }}" jump=MASQUERADE
when: ((security_enabled is not defined) or
(security_enabled is defined and security_enabled != "y")) and
ipv6_support is defined and ipv6_support == "yes"
notify:
- save iptables
- name: Ubuntu | Ensure that the strongswan service directory exist
file: path=/etc/systemd/system/strongswan.service.d/ state=directory mode=0755 owner=root group=root

1
roles/vpn/templates/rules.v4.j2
View File

@ -41,3 +41,4 @@ COMMIT
-A FORWARD -p tcp -m multiport --ports 137,139 -j DROP
-A FORWARD -m conntrack --ctstate NEW -s {{ vpn_network }} -m policy --pol ipsec --dir in -j ACCEPT
COMMIT

1
roles/vpn/templates/rules.v6.j2
View File

@ -55,3 +55,4 @@ COMMIT
-A ICMPV6-CHECK-LOG -j LOG --log-prefix "ICMPV6-CHECK-LOG DROP "
-A ICMPV6-CHECK-LOG -j DROP
COMMIT