diff --git a/iptables/flush.sls b/iptables/flush.sls index 3b88ac5..3a1d671 100644 --- a/iptables/flush.sls +++ b/iptables/flush.sls @@ -8,25 +8,45 @@ {% set testing_mode_timer = firewall.get('testing_mode:flush_after', 60)|int %} {%- if flush or testing_mode_enabled %} - # IPv6 is missing! iptables_input_policy_accept: iptables.set_policy: - table: filter - chain: INPUT - policy: ACCEPT + iptables_input_policy_accept_v6: + iptables.set_policy: + - table: filter + - chain: INPUT + - family: ipv6 + - policy: ACCEPT + iptables_output_policy_accept: iptables.set_policy: - table: filter - chain: OUTPUT - policy: ACCEPT + iptables_output_policy_accept_v6: + iptables.set_policy: + - table: filter + - chain: OUTPUT + - family: ipv6 + - policy: ACCEPT + iptables_forward_policy_accept: iptables.set_policy: - table: filter - chain: FORWARD - policy: ACCEPT + iptables_forward_policy_accept_v6: + iptables.set_policy: + - table: filter + - chain: FORWARD + - family: ipv6 + - policy: ACCEPT + iptables_flush: iptables.flush: - table: filter @@ -34,6 +54,15 @@ - iptables: iptables_input_policy_accept - iptables: iptables_output_policy_accept - iptables: iptables_forward_policy_accept + + iptables_flush_v6: + iptables.flush: + - table: filter + - famile: ipv6 + - require: + - iptables: iptables_input_policy_accept_v6 + - iptables: iptables_output_policy_accept_v6 + - iptables: iptables_forward_policy_accept_v6 {%- endif %} {%- if testing_mode_enabled %} @@ -51,8 +80,27 @@ - order: last - require: - iptables: iptables_flush + + iptables_flush_v6_testing_mode: + schedule.present: + - function: state.sls_id + - job_args: + - iptables_flush_v6 + - iptables.flush + # This is a workaround to mimic "now + x seconds", since Salt schedule just supports ISO8601 time format. + # It generates "now" based on Unix Time, then it add x number of seconds, finally it converts that to ISO8601 time. + - once: "{{ (None|strftime("%s")|int + testing_mode_timer)|strftime("%Y-%m-%dT%H:%M:%S") }}" + - once_fmt: "%Y-%m-%dT%H:%M:%S" + - persist: False + - order: last + - require: + - iptables: iptables_flush_v6 {%- else %} delete_iptables_flush_testing_mode_job: schedule.absent: - name: iptables_flush_testing_mode + + delete_iptables_flush_v6_testing_mode_job: + schedule.absent: + - name: iptables_flush_v6_testing_mode {%- endif %}