infrastructure/ansible
1
0
Fork 0
Code Pull requests 7 Activity Actions

base / iptables: fix protocol, use creates for commands

Browse source 
iptables -p is expecting all, not any.
And create a file to track when we have made the ipset.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2023-06-26 12:58:21 -07:00
parent fbe288a422
commit 765363e04d
2 changed files with 3 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
roles/base/tasks/main.yml
View file

@ -150,8 +150,7 @@
- name: setup builder ipset if this is a new install - name: setup builder ipset if this is a new install
command: /usr/sbin/ipset create osbuildapi hash:ip command: /usr/sbin/ipset create osbuildapi hash:ip
ignore_errors: true creates: /etc/sysconfig/ipset-osbuildapi
changed_when: false
when: "'osbuild' in group_names" when: "'osbuild' in group_names"
tags: tags:
- base - base
@ -171,8 +170,7 @@
- name: setup blocklist ipset if this is a new install - name: setup blocklist ipset if this is a new install
command: /usr/sbin/ipset create blocklist hash:ip command: /usr/sbin/ipset create blocklist hash:ip
ignore_errors: true creates: /etc/sysconfig/blocklist
changed_when: false
when: "'iad2' not in inventory_hostname or ( datacenter == 'iad2' and external == 'true')" when: "'iad2' not in inventory_hostname or ( datacenter == 'iad2' and external == 'true')"
tags: tags:
- base - base

2
roles/base/templates/iptables/iptables
View file

@ -16,7 +16,7 @@
# if the host is external, block some ips # if the host is external, block some ips
{% if datacenter != 'iad2' or ( datacenter == 'iad2' and hostvars[inventory_hostname].external == 'true' ) %} {% if datacenter != 'iad2' or ( datacenter == 'iad2' and hostvars[inventory_hostname].external == 'true' ) %}
-A INPUT -p any -m set --match-set blocklist src -j REJECT -A INPUT -p all -m set --match-set blocklist src -j REJECT
{% endif %} {% endif %}
# allow ssh - always # allow ssh - always