summaryrefslogtreecommitdiffstats
path: root/roles/common/files
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2013-11-03 06:07:18 +0100
committerGuilhem Moulin <guilhem@fripost.org>2015-06-07 02:50:37 +0200
commit8f6d93f2c1af4084366cc2d6e835535608fc1e4e (patch)
treeb3f1bf83b9c35e962e7966d7ab6cb03fe5a520e8 /roles/common/files
parentfa41e97fca909391c9f5cae4681378bfe75586e3 (diff)
Preserve canonical the order of IP tables.
I.e., as packets are treated along the way: mangle -> nat -> filter.
Diffstat (limited to 'roles/common/files')
-rwxr-xr-xroles/common/files/usr/local/sbin/update-firewall.sh6
1 files changed, 3 insertions, 3 deletions
diff --git a/roles/common/files/usr/local/sbin/update-firewall.sh b/roles/common/files/usr/local/sbin/update-firewall.sh
index f7ab925..c6d9de8 100755
--- a/roles/common/files/usr/local/sbin/update-firewall.sh
+++ b/roles/common/files/usr/local/sbin/update-firewall.sh
@@ -136,7 +136,7 @@ run() {
# Build and apply the firewall for IPv4/6.
local f="$1"
local ipt=/sbin/$(inet46 $f iptables ip6tables)
- tables+=( [$f]=filter )
+ tables[$f]=filter
# The default interface associated with this address.
local if=$( /bin/ip -$f route show to default scope global \
@@ -150,7 +150,7 @@ run() {
# The (host-scoped) IP reserved for IPSec.
local ipsec= secmark
if [ -n "$ifsec" -a $f = 4 ]; then
- tables+=( [$f]=' mangle nat' )
+ tables[$f]='mangle nat filter'
ipsec=$( /bin/ip -$f address show dev "$ifsec" scope host \
| sed -nr '/^\s+inet\s(\S+).*/ {s//\1/p;q}' )
secmark=0x1
@@ -162,7 +162,7 @@ run() {
for table in ${tables[$f]}; do
$ipt-save -ct $table
done > "$old"
- rss+=( [$f]="$old" )
+ rss[$f]="$old"
local fail2ban=0
# XXX: As of Wheezy, fail2ban is IPv4 only. See