rc/network
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

firewall: disable forwarding for mgmt interfaces in if-pre-up

Browse source 
Should be more robust and more importantly works when interfaces are
not renamed by mdev as is the situation now.
This commit is contained in:
Timotej Lazar 2024-01-30 12:58:58 +01:00
parent 25289dd82f
commit f54b23f49a
2 changed files with 2 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
roles/firewall/templates/sysctl.conf.j2
View file

@ -2,12 +2,6 @@
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
# But not for management interfaces.
{% for iface in interfaces | selectattr('name', 'match', '^mgmt') %}
net.ipv4.conf.{{ iface.name }}.forwarding = 0
net.ipv6.conf.{{ iface.name }}.forwarding = 0
{% endfor %}
# Zebra docs recommend these.
net.ipv6.conf.all.keep_addr_on_down = 1
net.ipv6.route.skip_notify_on_dev_down = 1