rc/servers
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Consolidate nftables setup for alpine, debian and ceph roles

Browse source
This commit is contained in:
Timotej Lazar 2025-02-12 17:24:24 +01:00
parent bfda7b3236
commit 0d60aa107f
8 changed files with 76 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

31
roles/ceph/templates/nftables.conf.j2 → roles/ceph/templates/ceph.nft.j2
View file

@ -1,7 +1,3 @@
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
set cluster {
type ipv4_addr; flags interval; auto-merge
@ -27,25 +23,6 @@ table inet filter {
}
chain input {
type filter hook input priority filter; policy drop
ct state vmap { invalid : drop, established : accept, related : accept }
iif lo accept
ip protocol icmp icmp type {
echo-request, echo-reply, destination-unreachable,
parameter-problem, time-exceeded,
} accept comment "accept some ICMPv4"
ip6 nexthdr icmpv6 icmpv6 type {
echo-request, echo-reply, destination-unreachable,
packet-too-big, parameter-problem, time-exceeded,
} accept comment "accept some ICMPv6"
iif mgmt0 ip6 hoplimit 255 ip6 nexthdr icmpv6 icmpv6 type {
nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert
} accept comment "accept IPv6 neighbor discovery"
# BGP / BFD sessions
iif lan0 ip6 saddr fe80::/64 accept
iif lan1 ip6 saddr fe80::/64 accept
@ -73,12 +50,4 @@ table inet filter {
{% endfor %}
}
chain forward {
type filter hook forward priority filter; policy accept
}
chain output {
type filter hook output priority filter; policy accept
}
}