From b1904dcc2937c93408234311793302aedca859c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Asbj=C3=B8rn=20Sloth=20T=C3=B8nnesen?= Date: Fri, 18 Jun 2021 21:55:27 +0000 Subject: space_server: nftables: colo: accept BGP connections Until now BGP connections have only been established when the space server has initiated the connection to the peer. It's best practice for both BGP speakers to be able to connect to one another, lowering recovery time. --- roles/space_server/files/nftables.conf | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'roles') diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf index 4930f2e..3502959 100644 --- a/roles/space_server/files/nftables.conf +++ b/roles/space_server/files/nftables.conf @@ -77,6 +77,9 @@ table ip filter { # bird etc. on fiberby link iif $ext_if ip saddr $link_net4 ip daddr $link_net4 counter accept + # bgp + iif $colo_if tcp dport bgp accept + # dhcp udp sport bootpc udp dport bootps iif != $ext_if counter accept @@ -174,6 +177,9 @@ table ip6 filter { # bird etc. on fiberby link iif $ext_if ip6 saddr $link_net6 ip6 daddr $link_net6 counter accept + # bgp + iif $colo_if tcp dport bgp accept + # tftp iif $wire_if ip6 saddr $wire_net6 udp dport 69 accept -- cgit v1.2.1