7308220484
When generically rejecting connections, we'd prefer to signal to users clearly that it's the firewall rejecting them. For IPv4 we previously emitted generic ICMP "no route to host" responses, but this tends to make it look incorrectly like a routing failure. Switch to flagging our error responses as "administratively prohibited" which is more accurate and less confusing. We're also already using icmp6-adm-prohibited for the v6 rules, so this makes our v4 ruleset more consistent. Note that the iptables-extensions(8) manpage indicates "Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT" but all our kernels should have support for it these days so this isn't a concern. Change-Id: Id423f3ec03d0c3c4e40ddef34c38f97167b173f6
Install and configure iptables
Role Variables