netfilter: add iptables-mod-rpfilter package
Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
This commit is contained in:
parent
a35a27e8ef
commit
d8748e537f
3 changed files with 34 additions and 0 deletions
|
@ -106,6 +106,8 @@ $(eval $(call nf_add,IPT_FILTER,CONFIG_NETFILTER_XT_MATCH_STRING, $(P_XT)xt_stri
|
|||
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_DSCP, $(P_XT)xt_dscp))
|
||||
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_TARGET_DSCP, $(P_XT)xt_DSCP))
|
||||
$(eval $(call nf_add,IPT_HASHLIMIT,CONFIG_NETFILTER_XT_MATCH_HASHLIMIT, $(P_XT)xt_hashlimit))
|
||||
$(eval $(call nf_add,IPT_RPFILTER,CONFIG_IP_NF_MATCH_RPFILTER, $(P_V4)ipt_rpfilter))
|
||||
$(eval $(call nf_add,IPT_RPFILTER,CONFIG_IP6_NF_MATCH_RPFILTER, $(P_V6)ip6t_rpfilter))
|
||||
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_LENGTH, $(P_XT)xt_length))
|
||||
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_STATISTIC, $(P_XT)xt_statistic))
|
||||
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_TCPMSS, $(P_XT)xt_tcpmss))
|
||||
|
|
|
@ -836,6 +836,24 @@ endef
|
|||
|
||||
$(eval $(call KernelPackage,ipt-hashlimit))
|
||||
|
||||
define KernelPackage/ipt-rpfilter
|
||||
SUBMENU:=$(NF_MENU)
|
||||
TITLE:=Netfilter rpfilter match
|
||||
DEPENDS:=+kmod-ipt-core
|
||||
KCONFIG:=$(KCONFIG_IPT_RPFILTER)
|
||||
FILES:=$(realpath \
|
||||
$(LINUX_DIR)/net/ipv4/netfilter/ipt_rpfilter.ko \
|
||||
$(LINUX_DIR)/net/ipv6/netfilter/ip6t_rpfilter.ko)
|
||||
AUTOLOAD:=$(call AutoProbe,ipt_rpfilter ip6t_rpfilter)
|
||||
$(call KernelPackage/ipt)
|
||||
endef
|
||||
|
||||
define KernelPackage/ipt-rpfilter/description
|
||||
Kernel modules support for the Netfilter rpfilter match
|
||||
endef
|
||||
|
||||
$(eval $(call KernelPackage,ipt-rpfilter))
|
||||
|
||||
|
||||
define KernelPackage/nft-core
|
||||
SUBMENU:=$(NF_MENU)
|
||||
|
|
|
@ -242,6 +242,19 @@ iptables extensions for hashlimit matching
|
|||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-rpfilter
|
||||
$(call Package/iptables/Module, +kmod-ipt-rpfilter)
|
||||
TITLE:=rpfilter iptables extension
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-rpfilter/description
|
||||
iptables extensions for reverse path filter test on a packet
|
||||
|
||||
Matches:
|
||||
- rpfilter
|
||||
|
||||
endef
|
||||
|
||||
define Package/iptables-mod-iprange
|
||||
$(call Package/iptables/Module, +kmod-ipt-iprange)
|
||||
TITLE:=IP range extension
|
||||
|
@ -565,6 +578,7 @@ $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
|
|||
$(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
|
||||
$(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))
|
||||
|
|
Loading…
Reference in a new issue