| Commit message (Collapse) | Author | Age | Files |
|---|
| |
|
|
|
| |
Our IPsec subnet is in that subnet but the setup won't deal well with subnet overlap
so it's best to explicitely not support NATed machines with an IP in 172.16.0.0/12.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
| |
(Excluding our NTP master.) It's simpler, arguably more secure, and
provides enough functionality when only simple client use-cases are
desired.
We allow outgoing connections to 123/udp also on NTP slaves so systemd-timesyncd
can connect to the fallbacks NTP servers.
|
| |
|
|
| |
This is in particular needed for traceroutes and routing loop detection.
|
| |
|
|
|
|
|
|
| |
This is required to receive incoming traffic to our IPsec IP in 172.16.0.0/24,
as well as linked-scoped ICMPv6 traffic from/to fe80::/10 (for neighbour
discovery).
Regression from a6b8c0b3a4758f8d84a7ad07bb9e068075d098d3.
|
| |
|
|
|
| |
This is more efficient: the earlier we filter the crap out the less
resources they consume.
|
| |
|
|
| |
This was forgotten after a092bfd947773281a23419ee0ab62358371b7166.
|
| |
|
|
| |
To be done when we upgrade to Bullseye for more fine-grained control.
|
| |
|
|
|
| |
Marking incoming ESP packets and matching decapsulated packets doesn't
work with NAT traverslate (UDP encapsulation aka MOBIKE).
|
| | |
|
| | |
|
|
|
Debian Buster uses the nftables framework by default.
|
