64898b2c79
Some checks failed
Code scanning / CodeQL (push) Failing after 15s
Zulip production suite / Ubuntu 22.04 production build (push) Failing after 26s
Zulip production suite / Debian 12 production install with custom db name and user (push) Has been skipped
Zulip production suite / Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga (push) Has been skipped
Zulip production suite / Ubuntu 24.04 production install (push) Has been skipped
Zulip production suite / Ubuntu 26.04 production install (push) Has been skipped
Zulip production suite / Debian 13 production install (push) Has been skipped
Zulip production suite / 7.0 Version Upgrade (push) Has been skipped
Zulip production suite / 8.0 Version Upgrade (push) Has been skipped
Zulip production suite / 6.0 Version Upgrade (push) Has been skipped
Zulip production suite / 10.0 Version Upgrade (push) Has been skipped
Zulip production suite / 9.0 Version Upgrade (push) Has been skipped
Zulip production suite / 12.0 Version Upgrade (push) Has been skipped
Zulip production suite / 11.0 Version Upgrade (push) Has been skipped
GitHub Actions Security Analysis with zizmor / zizmor (push) Failing after 3s
Zulip CI / Debian 12 (Python 3.11, backend + documentation) (push) Failing after 26s
Zulip CI / Ubuntu 22.04 (Python 3.10, backend + frontend) (push) Failing after 3s
Zulip CI / Ubuntu 24.04 (Python 3.12, backend) (push) Failing after 25s
Zulip CI / Ubuntu 26.04 (Python 3.14, backend) (push) Failing after 25s
Zulip CI / Debian 13 (Python 3.13, backend) (push) Failing after 28s
Zulip production suite / Required jobs (push) Has been cancelled
Zulip CI / Required jobs (push) Has been cancelled
API Documentation Update Check / check-feature-level-updated (push) Has been cancelled
API Documentation Update Check / notify-if-api-docs-changed (push) Has been cancelled
31 lines
962 B
Plaintext
31 lines
962 B
Plaintext
# This file was auto-generated by Puppet. Do not edit by hand.
|
|
|
|
# The raw table is used to disable connection tracking for DNS
|
|
# traffic, so it works even when the conntrack table fills.
|
|
*raw
|
|
:PREROUTING ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
-A PREROUTING -p udp -m udp --dport 53 -j CT --notrack
|
|
-A PREROUTING -p udp -m udp --sport 53 -j CT --notrack
|
|
-A OUTPUT -p udp -m udp --dport 53 -j CT --notrack
|
|
-A OUTPUT -p udp -m udp --sport 53 -j CT --notrack
|
|
COMMIT
|
|
|
|
|
|
*filter
|
|
# Allow all outbound traffic
|
|
-A OUTPUT -j ACCEPT
|
|
|
|
# Accept all loopback traffic
|
|
-A INPUT -i lo -j ACCEPT
|
|
|
|
# Drop all traffic to loopback IPs on other interfaces
|
|
-A INPUT ! -i lo -d 127.0.0.0/8 -j DROP
|
|
|
|
# Accept incoming traffic related to established connections, or the
|
|
# untracked port-53-UDP set up above. See iptables-extensions(8) for
|
|
# the --state flag. This drops INVALID and NEW states.
|
|
-A INPUT -m state --state ESTABLISHED,RELATED,UNTRACKED -j ACCEPT
|
|
|
|
# Host-specific rules follow:
|