wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-06-07 07:33:52 +02:00
Code Issues Projects Releases Wiki Activity

iptables filter table fix (#285)

Browse source
This commit is contained in:
Dan Guido 2017-03-27 00:04:46 -04:00 • committed by GitHub
parent a558b5b549
commit 655a917dd2
3 changed files with 2 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
roles/vpn/tasks/ubuntu.yml
View file

@ -24,21 +24,6 @@
- strongswan - strongswan
- netfilter-persistent - netfilter-persistent
- name: Ubuntu | Configure iptables so IPSec traffic can traverse the tunnel
iptables: table=nat chain=POSTROUTING source="{{ vpn_network }}" jump=MASQUERADE
when: (security_enabled is not defined) or
(security_enabled is defined and security_enabled != "y")
notify:
- save iptables
- name: Ubuntu | Configure ip6tables so IPSec traffic can traverse the tunnel
iptables: ip_version=ipv6 table=nat chain=POSTROUTING source="{{ vpn_network_ipv6 }}" jump=MASQUERADE
when: ((security_enabled is not defined) or
(security_enabled is defined and security_enabled != "y")) and
ipv6_support is defined and ipv6_support == "yes"
notify:
- save iptables
- name: Ubuntu | Ensure that the strongswan service directory exist - name: Ubuntu | Ensure that the strongswan service directory exist
file: path=/etc/systemd/system/strongswan.service.d/ state=directory mode=0755 owner=root group=root file: path=/etc/systemd/system/strongswan.service.d/ state=directory mode=0755 owner=root group=root

1
roles/vpn/templates/rules.v4.j2
View file

@ -41,3 +41,4 @@ COMMIT
-A FORWARD -p tcp -m multiport --ports 137,139 -j DROP -A FORWARD -p tcp -m multiport --ports 137,139 -j DROP
-A FORWARD -m conntrack --ctstate NEW -s {{ vpn_network }} -m policy --pol ipsec --dir in -j ACCEPT -A FORWARD -m conntrack --ctstate NEW -s {{ vpn_network }} -m policy --pol ipsec --dir in -j ACCEPT
COMMIT COMMIT

1
roles/vpn/templates/rules.v6.j2
View file

@ -55,3 +55,4 @@ COMMIT
-A ICMPV6-CHECK-LOG -j LOG --log-prefix "ICMPV6-CHECK-LOG DROP " -A ICMPV6-CHECK-LOG -j LOG --log-prefix "ICMPV6-CHECK-LOG DROP "
-A ICMPV6-CHECK-LOG -j DROP -A ICMPV6-CHECK-LOG -j DROP
COMMIT COMMIT