diff --git a/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/ansible/shared.yml b/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/ansible/shared.yml new file mode 100644 index 00000000000..95355b668e2 --- /dev/null +++ b/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/ansible/shared.yml @@ -0,0 +1,30 @@ +# platform = multi_platform_sle + +- name: Check if IPv6 is enabled + command: sysctl -n net.ipv6.conf.all.disable_ipv6 + register: ipv6_status + failed_when: ipv6_status.stdout != "0" + +- name: Allow incoming traffic on the loopback interface + ansible.builtin.iptables: + ipv6: yes + chain: INPUT + in_interface: lo + jump: ACCEPT + when: "{{ ipv6_status.stdout == '0' }}" + +- name: Allow outgoing traffic on the loopback interface + ansible.builtin.iptables: + ipv6: yes + chain: OUTPUT + out_interface: lo + jump: ACCEPT + when: "{{ ipv6_status.stdout == '0' }}" + +- name: Drop incoming traffic from the localhost + ansible.builtin.iptables: + ipv6: yes + chain: INPUT + source: "::1" + jump: DROP + when: "{{ ipv6_status.stdout == '0' }}" diff --git a/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/bash/shared.sh b/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/bash/shared.sh index 1cf0625e02f..c0e09d6c16f 100644 --- a/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/bash/shared.sh +++ b/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/bash/shared.sh @@ -1,5 +1,8 @@ # platform = multi_platform_sle -iptables -A INPUT -i lo -j ACCEPT -iptables -A OUTPUT -o lo -j ACCEPT -iptables -A INPUT -s 127.0.0.0/8 -j DROP +if [ "$(sysctl -n net.ipv6.conf.all.disable_ipv6)" -eq 0 ]; then + # IPv6 is not disabled, so run the script + ip6tables -A INPUT -i lo -j ACCEPT + ip6tables -A OUTPUT -o lo -j ACCEPT + ip6tables -A INPUT -s ::1 -j DROP +fi diff --git a/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/rule.yml b/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/rule.yml index b317466ce6e..9515ab2a791 100644 --- a/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/rule.yml +++ b/linux_os/guide/system/network/network-iptables/iptables_activation/set_ipv6_loopback_traffic/rule.yml @@ -22,7 +22,7 @@ identifiers: references: cis@sle12: 3.5.3.1 - cis@sle15: 3.5.3.2.2 + cis@sle15: 3.5.3.3.2 pcidss: Req-1.4.1 warnings: