aboutsummaryrefslogtreecommitdiffstats
path: root/roles/space_server/files
diff options
context:
space:
mode:
authorAsbjørn Sloth Tønnesen <asbjorn@labitat.dk>2021-06-18 21:55:27 +0000
committerEmil Renner Berthing <esmil@labitat.dk>2021-06-19 11:08:51 +0200
commitb1904dcc2937c93408234311793302aedca859c4 (patch)
tree18a1a3cd939c6fe1e9b67fb8c449950dbc191d01 /roles/space_server/files
parent23a84a3cfeac299ef34e422cdcd9ea3499376a90 (diff)
downloadlabitat-ansible-b1904dcc2937c93408234311793302aedca859c4.tar.gz
labitat-ansible-b1904dcc2937c93408234311793302aedca859c4.tar.xz
labitat-ansible-b1904dcc2937c93408234311793302aedca859c4.zip
space_server: nftables: colo: accept BGP connections
Until now BGP connections have only been established when the space server has initiated the connection to the peer. It's best practice for both BGP speakers to be able to connect to one another, lowering recovery time.
Diffstat (limited to 'roles/space_server/files')
-rw-r--r--roles/space_server/files/nftables.conf6
1 files changed, 6 insertions, 0 deletions
diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf
index 4930f2e..3502959 100644
--- a/roles/space_server/files/nftables.conf
+++ b/roles/space_server/files/nftables.conf
@@ -77,6 +77,9 @@ table ip filter {
# bird etc. on fiberby link
iif $ext_if ip saddr $link_net4 ip daddr $link_net4 counter accept
+ # bgp
+ iif $colo_if tcp dport bgp accept
+
# dhcp
udp sport bootpc udp dport bootps iif != $ext_if counter accept
@@ -174,6 +177,9 @@ table ip6 filter {
# bird etc. on fiberby link
iif $ext_if ip6 saddr $link_net6 ip6 daddr $link_net6 counter accept
+ # bgp
+ iif $colo_if tcp dport bgp accept
+
# tftp
iif $wire_if ip6 saddr $wire_net6 udp dport 69 accept