X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/ad1da4a00772c18bbc6392d94c603208c7a8db05..a45c1200e1b7b9ffdefe5fef3af9b1a93f5de31d:/cookbooks/networking/templates/default/shorewall6.conf.erb

diff --git a/cookbooks/networking/templates/default/shorewall6.conf.erb b/cookbooks/networking/templates/default/shorewall6.conf.erb
index 275848a23..a98408e0b 100644
--- a/cookbooks/networking/templates/default/shorewall6.conf.erb
+++ b/cookbooks/networking/templates/default/shorewall6.conf.erb
@@ -28,7 +28,11 @@ FIREWALL=
 #			       L O G G I N G
 ###############################################################################
 
+<% if node[:networking][:firewall][:log] -%>
 LOG_LEVEL="info"
+<% else -%>
+LOG_LEVEL="none"
+<% end -%>
 
 BLACKLIST_LOG_LEVEL=
 
@@ -100,20 +104,12 @@ TC=
 #		D E F A U L T   A C T I O N S / M A C R O S
 ###############################################################################
 
-<%- if node[:lsb][:release].to_f <= 16.04 %>
-ACCEPT_DEFAULT="none"
-DROP_DEFAULT="Drop"
-NFQUEUE_DEFAULT="none"
-QUEUE_DEFAULT="none"
-REJECT_DEFAULT="Reject"
-<%- else %>
 ACCEPT_DEFAULT="none"
 BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL"
 DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
 NFQUEUE_DEFAULT="none"
 QUEUE_DEFAULT="none"
 REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)"
-<%- end %>
 
 ###############################################################################
 #                        R S H / R C P  C O M M A N D S
@@ -136,17 +132,17 @@ AUTOCOMMENT=Yes
 
 AUTOHELPERS=Yes
 
-<%- if node[:lsb][:release].to_f <= 16.04 %>
-AUTOMAKE=No
-<%- else %>
 AUTOMAKE=Yes
-<%- end %>
 
 BALANCE_PROVIDERS=No
 
 BASIC_FILTERS=No
 
+<% if node[:networking][:firewall][:raw] -%>
 BLACKLIST="NEW,INVALID,UNTRACKED"
+<% else -%>
+BLACKLIST="NEW,INVALID"
+<% end -%>
 
 CLAMPMSS=No
 
@@ -168,7 +164,11 @@ EXPORTMODULES=Yes
 
 FASTACCEPT=No
 
+<% if node[:networking][:firewall][:mark] -%>
 FORWARD_CLEAR_MARK=Yes
+<% else -%>
+FORWARD_CLEAR_MARK=No
+<% end -%>
 
 HELPERS=
 
@@ -195,18 +195,10 @@ MANGLE_ENABLED=Yes
 MARK_IN_FORWARD_CHAIN=No
 
 MINIUPNPD=No
-<%- if node[:lsb][:release].to_f <= 16.04 %>
-
-MODULE_SUFFIX=ko
-<%- end %>
 
 MUTEX_TIMEOUT=60
 
-<%- if node[:lsb][:release].to_f <= 14.04 %>
-OPTIMIZE=1
-<%- else %>
 OPTIMIZE=All
-<%- end %>
 
 OPTIMIZE_ACCOUNTING=No
 
@@ -224,7 +216,11 @@ RESTORE_ROUTEMARKS=Yes
 
 SAVE_IPSETS=No
 
+<% if node[:networking][:firewall][:mangle] -%>
 TC_ENABLED=Shared
+<% else -%>
+TC_ENABLED=No
+<% end -%>
 
 TC_EXPERT=No
 
@@ -235,10 +231,8 @@ TRACK_PROVIDERS=Yes
 TRACK_RULES=No
 
 USE_DEFAULT_RT=Yes
-<%- if node[:lsb][:release].to_f >= 18.04 %>
 
 USE_NFLOG_SIZE=No
-<%- end %>
 
 USE_PHYSICAL_NAMES=No