rc/servers
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects 1 Releases Wiki Activity

ceph: allow some ICMP

Browse source
This commit is contained in:
Timotej Lazar 2024-03-14 14:34:44 +01:00
parent ce7903e43a
commit 0c063a017b
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
roles/ceph/templates/nftables.conf.j2
View file

@ -32,6 +32,16 @@ table inet filter {
ct state vmap { invalid : drop, established : accept, related : accept } ct state vmap { invalid : drop, established : accept, related : accept }
iif lo accept iif lo accept
ip protocol icmp icmp type {
echo-request, echo-reply, destination-unreachable,
parameter-problem, time-exceeded,
} accept comment "accept some ICMPv4"
ip6 nexthdr icmpv6 icmpv6 type {
echo-request, echo-reply, destination-unreachable,
packet-too-big, parameter-problem, time-exceeded,
} accept comment "accept some ICMPv6"
# BGP / BFD sessions # BGP / BFD sessions
iif lan0 ip6 saddr fe80::/64 accept iif lan0 ip6 saddr fe80::/64 accept
iif lan1 ip6 saddr fe80::/64 accept iif lan1 ip6 saddr fe80::/64 accept