diff options
| author | Patrick Spek <p.spek@tyil.nl> | 2024-02-28 09:58:37 +0100 |
|---|---|---|
| committer | Patrick Spek <p.spek@tyil.nl> | 2024-02-28 09:58:37 +0100 |
| commit | d12b470c4fa50fe72efd1957c0289040eb372c6c (patch) | |
| tree | b54c9c0a7f38fee0ca097c653a69a74e8dc87a26 | |
| parent | 9f8a44dba245d45b5046c555df4d6c9bfd87c941 (diff) | |
Update nftable's icmp rules
| -rw-r--r-- | playbooks.d/fw-nftables/playbook.bash | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/playbooks.d/fw-nftables/playbook.bash b/playbooks.d/fw-nftables/playbook.bash index 1e52680..c0b366c 100644 --- a/playbooks.d/fw-nftables/playbook.bash +++ b/playbooks.d/fw-nftables/playbook.bash @@ -38,12 +38,18 @@ playbook_sync() { # Add ICMP rules info "$BASHTARD_PLAYBOOK/sync" "Adding input filter for ICMP" printf "\n" - printf "\t\tip protocol icmp icmp type echo-request" \ # IPv4 - printf " limit rate %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv4.rate" "2/second")" + printf "\t\tmeta l4proto icmp" \ # IPv4 + if [[ "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv4.rate" "")" != "" ]] + then + printf " limit rate %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv4.rate" "2/second")" + fi printf " %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv4.policy" "accept")" printf ";\n" - printf "\t\tip6 nexthdr icmpv6 icmpv6 type echo-request" \ # IPv6 - printf " limit rate %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv6.rate" "2/second")" + printf "\t\tmeta l4proto ipv6-icmp" \ # IPv6 + if [[ "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv6.rate" "")" != "" ]] + then + printf " limit rate %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv6.rate")" + fi printf " %s" "$(config "$BASHTARD_PLAYBOOK.input.icmp.ipv6.policy" "accept")" printf ";\n" |