KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038)

Browse source 
SVN-Revision: 28148
This commit is contained in:
Jo-Philipp Wich 2011-09-01 20:37:22 +00:00
parent 99e422472c
commit 995face56d
2 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package/firewall/Makefile
View file

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall PKG_NAME:=firewall
PKG_VERSION:=2 PKG_VERSION:=2
PKG_RELEASE:=34 PKG_RELEASE:=35
include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/package.mk

16
package/firewall/files/lib/core_init.sh
View file

@ -1,4 +1,4 @@
# Copyright (C) 2009-2010 OpenWrt.org # Copyright (C) 2009-2011 OpenWrt.org
# Copyright (C) 2008 John Crispin <blogic@openwrt.org> # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
FW_INITIALIZED= FW_INITIALIZED=
@ -66,17 +66,17 @@ fw_load_defaults() {
done done
fw_sysctl_interface all fw_sysctl_interface all
fw add i f INPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
fw add i f OUTPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
[ $defaults_drop_invalid == 1 ] && { [ $defaults_drop_invalid == 1 ] && {
fw add i f INPUT DROP { -m state --state INVALID } fw add i f INPUT DROP { -m conntrack --ctstate INVALID }
fw add i f OUTPUT DROP { -m state --state INVALID } fw add i f OUTPUT DROP { -m conntrack --ctstate INVALID }
fw add i f FORWARD DROP { -m state --state INVALID } fw add i f FORWARD DROP { -m conntrack --ctstate INVALID }
FW_NOTRACK_DISABLED=1 FW_NOTRACK_DISABLED=1
} }
fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
fw add i f INPUT ACCEPT { -i lo } fw add i f INPUT ACCEPT { -i lo }
fw add i f OUTPUT ACCEPT { -o lo } fw add i f OUTPUT ACCEPT { -o lo }