fripost-ansible - Fripost ansible scripts

	Commit message (Collapse)	Author	Age	Files
*	Firewall: Move IPsec/ICMP/ICMPv6 rules to ingress chain.	Guilhem Moulin	2020-11-03	1
\| \| \| \| \| \| \| \|	This is required to receive incoming traffic to our IPsec IP in 172.16.0.0/24, as well as linked-scoped ICMPv6 traffic from/to fe80::/10 (for neighbour discovery). Regression from a6b8c0b3a4758f8d84a7ad07bb9e068075d098d3.
*	Firewall: Move martian and bogus TCP filters early in the packet flow.	Guilhem Moulin	2020-11-02	1
\| \| \| \| \|	This is more efficient: the earlier we filter the crap out the less resources they consume.
*	s/LDAP-provider/LDAP_provider/	Guilhem Moulin	2020-05-19	1
\| \| \| \|	This was forgotten after a092bfd947773281a23419ee0ab62358371b7166.
*	Firewall: note on reqid matching.	Guilhem Moulin	2020-05-18	1
\| \| \| \|	To be done when we upgrade to Bullseye for more fine-grained control.
*	Firewall: Use `meta secpath exists` to match xfrm associations.	Guilhem Moulin	2020-05-18	1
\| \| \| \| \|	Marking incoming ESP packets and matching decapsulated packets doesn't work with NAT traverslate (UDP encapsulation aka MOBIKE).
*	typofix	Guilhem Moulin	2020-05-16	1
\|
*	Upgrade baseline to Debian 10.	Guilhem Moulin	2020-05-16	1
\|
*	Convert firewall to nftables.	Guilhem Moulin	2020-01-23	1
	Debian Buster uses the nftables framework by default.