From 2240d5ee65c26df076979353d2a1e5cc38a59d1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Asbj=C3=B8rn=20Sloth=20T=C3=B8nnesen?= Date: Fri, 18 Jun 2021 21:55:27 +0000 Subject: space_server: nftables: colo: accept BGP connections Until now BGP connections have only been established when the space server has initiated the connection to the peer. It's best practice for both BGP speakers to be able to connect to one another, lowering recovery time. --- roles/space_server/files/nftables.conf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf index f29c274..2cd170b 100644 --- a/roles/space_server/files/nftables.conf +++ b/roles/space_server/files/nftables.conf @@ -69,6 +69,9 @@ table ip filter { # bird etc. on fiberby link iif $ext_if ip saddr $link_net4 ip daddr $link_net4 counter accept + # bgp + iif $colo_if tcp dport bgp accept + # dhcp udp sport bootpc udp dport bootps iif != $ext_if counter accept @@ -166,6 +169,9 @@ table ip6 filter { # bird etc. on fiberby link iif $ext_if ip6 saddr $link_net6 ip6 daddr $link_net6 counter accept + # bgp + iif $colo_if tcp dport bgp accept + # tftp iif $wire_if ip6 saddr $wire_net6 udp dport 69 accept -- cgit v1.2.1