Closed WillB97 closed 3 years ago
Nice!
I'm just comparing to what we have for the competitor services box and the spelling there seems to be different: https://github.com/PeterJCLaw/sr-server-puppet/blob/7d30219374d83e9f5e6d2f44ce2fedac849fbe9c/modules/sr_site/manifests/fw_pre.pp#L38-L42
Wondering therefore whether this is a case of synonyms or perhaps platform differences or something else?
Have you tested that this works?
They are in fact synonms, ipv6-icmp
is what gets displayed in the rules when either is used but icmpv6
is what gets printed when logging.
Haven't tested running this from puppet but this is the change we made directly on /etc/iptables/rules.v6
.
I ran puppet update without this change on the friendlies box and confirmed it broke IPv6. I then made this change locally, ran puppet update and after completion IPv6 worked.
Hrm, so on running this in prod I'm getting:
Error: Parameter proto failed on Firewall[000 accept all icmp (v6)]: Invalid value "icmpv6". Valid values are ip, ! ip, tcp, ! tcp, udp, ! udp, icmp, ! icmp, ipv6-icmp, ! ipv6-icmp, esp, ! esp, ah, ! ah, vrrp, ! vrrp, igmp, ! igmp, ipencap, ! ipencap, ipv4, ! ipv4, ipv6, ! ipv6, ospf, ! ospf, gre, ! gre, cbt, ! cbt, sctp, ! sctp, pim, ! pim, all, ! all. (file: /etc/puppet/modules/compbox/manifests/fw_pre.pp, line: 29)
@sedders123 did you get anything like that?
I'll switch to the other synonym so that this isn't broken on master
though (7c86bee683f80bdf8c8cf53cf1b611179f46a706).
Apologies I did get that then switched to use ipv6-icmp
. Apologies totally forgot about that, my bad. Need to do this stuff not in the middle of the night!
fixes #14