3 Commits

Include renames

Author	SHA1	Message	Date
asepharyanaandAsep Haryana	97b635e8c6	firewall: whitelist TCPShield proxy ranges untuk port 25565 (Minecraft)	2026-08-06 20:42:39 +07:00
Asep Haryana	7da1727603	fix(firewall): accept IPv6 MLD/ND multicast (ff02::1, ff02::2, ff02::fb) ... Neighbor multicast to ff02::1 (MLDv2 reports from other hosts) was hitting the LOG+DROP tail — ~1800 FW6-DROP lines/6h in journald, i.e. ~5/min of pure log spam from ICMPv6 layer-2 discovery. Accept link-local multicast ranges before the logging rule.	2026-08-03 04:06:32 +07:00
asepharyana	e6033c8b12	feat(infra): hardening firewall + sysctl + ssh ... - deny-by-default iptables/ip6tables: public cuma 22/80/443/4013, sisanya localhost + tailscale CGNAT; log FW-DROP rate-limited - persist via netfilter-persistent (rules.v4/v6) + /usr/local/bin/firewall.sh - sysctl hardening: syncookies, rp_filter, redirect off, kptr/dmesg restrict, protected links, somaxconn, tcp retries tuner - sshd: PasswordAuthentication no (fix 50-cloud-init.conf override), PermitRootLogin prohibit-password, MaxAuthTries 4, LoginGraceTime 30, X11Forwarding no	2026-08-02 20:22:49 +07:00