Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: handshake meter carries the service limit, SYN meters become a flood cap at 2x rate and 2x burst

Browse Source
This commit is contained in:
Ruakij
2026-10-26 14:48:25 +00:00
parent ec64ace8f4
commit 46fd6a4c40
2 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/defaults/main.yml
+7 -6
View File
@@ -46,12 +46,13 @@ firewall:
forward_guard: {}
# Limits on new inbound TCP connections per service, applied to the public and geo ports the host serves (input) and to
# DNATed traffic (forward: port forwards and Docker-published ports), after the admin, cluster, VPN, guest and internal
# sources and the public_ips of every inventory host (IPv4 per address, IPv6 per /64) are exempted. Each service has a SYN
# meter with a tier per source (IPv4 /32, IPv6 /64) and a tier per range (IPv4 /24, IPv6 /48) at rate * range_factor. Its
# excess drops with the log prefix fw-rl-syn-addr: (source tier) or fw-rl-syn-range: (range tier); a spoofed source can trigger
# both, so they are evidence only. A handshake meter per source (same rate and burst, no range tier) counts the packet
# that completes a TCP handshake, which a spoofed source cannot send; its excess is logged with fw-rl-hs: and reset.
# Log limit: log.ratelimit_rate.
# sources and the public_ips of every inventory host (IPv4 per address, IPv6 per /64) are exempted. The rate and burst
# below are the service limit, enforced by the handshake meter per source: it counts the packet that completes a TCP
# handshake, which a spoofed source cannot send, and logs the excess with fw-rl-hs: and resets the connection. Each service
# also has a SYN meter at twice the rate and burst, as a flood cap above the service limit so that a real client reaches the
# handshake meter first: a tier per source (IPv4 /32, IPv6 /64) and a tier per range (IPv4 /24, IPv6 /48) at
# rate * range_factor. Its excess drops with the log prefix fw-rl-syn-addr: (source tier) or fw-rl-syn-range: (range tier);
# a spoofed source can trigger both, so they are evidence only. Log limit: log.ratelimit_rate.
# name -> {ports: port or list, rate: connections per `per`, per: second|minute (minute), burst: connections (2 * rate),
# range_factor_v4, range_factor_v6: override the factors below}; null drops a service, a service is idle unless a port is served.
# Values are 3x the highest legitimate rate seen, with a floor of 12 per minute (3x four connections per minute) where