Commit graph

104 commits

Author SHA1 Message Date
Steven Barth
9f2a17103f iptables: NFLOG and NFQUEUE targets' full support
NFLOG and NFQUEUE targets' full support for iptables.

Includes all needed kernel modules (Xtables's and Netlink's)
 and userspace libraries.
All added kernel modules can be individually disabled,
 all other new libraries get their own individual packages.

Reported-by: Fabian Hugelshofer <hugelshofer2006@gmx.ch>
Reported-by: Rainer Poisel <rainer.poisel@fhstp.ac.at>
Reported-by: Derek LaHousse <dlahouss@mtu.edu>
Signed-off-by: Guillaume Déflache <guillaume.deflache@ibwag.com>

SVN-Revision: 42022
2014-08-07 04:42:22 +00:00
Jo-Philipp Wich
baa7c211f5 netfilter: introduce xt_id match
This commit implements a new netfilter match "xt_id" which can be used to
attach unsigned 32bit IDs to iptables rules.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>

SVN-Revision: 41945
2014-08-01 22:49:47 +00:00
Felix Fietkau
4b241e9827 netfilter: split off header matching modules not used by the default config (reduces rootfs size and memory usage)
Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 40983
2014-06-02 18:13:38 +00:00
Steven Barth
97ea9e3c2a iptables/netfilter: add connlimit to conntrack-extra
SVN-Revision: 39878
2014-03-11 14:58:00 +00:00
Steven Barth
2e2c4c2dd3 Fix IPv6 NAT breaking older kernels
SVN-Revision: 37891
2013-09-03 06:29:46 +00:00
Steven Barth
0a85c59040 netfilter: Add IPv6-NAT support for kernel and ipt Thanks to Berni, Adam Novak and Sedat Dilek for patches and inspiration
SVN-Revision: 37866
2013-09-01 17:59:48 +00:00
Luka Perkov
e5e83478a9 netfilter: fix typo
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 37821
2013-08-21 23:17:08 +00:00
Felix Fietkau
c404cd5bfa netfilter: remove use of obsolete compatibility config symbols for mark and connmark
fixes duplication of xt_mark and xt_connmark module entries

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37344
2013-07-15 13:08:20 +00:00
Jo-Philipp Wich
8df6cd005c netfilter: move time, mark, set matches and MARK, REDIRECT, SET targets into base iptables package - drop iptables-mod-ipset
SVN-Revision: 36683
2013-05-21 12:58:15 +00:00
Steven Barth
ed083586aa netfilter: Fix typo in last commit
SVN-Revision: 35899
2013-03-07 09:30:52 +00:00
Steven Barth
62ea398cd8 iptables: Add missing IPv6 builtin modules
SVN-Revision: 35898
2013-03-07 08:48:41 +00:00
Gabor Juhos
b20cb26ed7 package/kernel: xt_NOTRACK has been removed in 3.7-rc1
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 35475
2013-02-04 10:02:52 +00:00
Jo-Philipp Wich
03a50b9087 netfilter.mk: add addrtype match to iptables-mod-extra (kmod-ipt-extra)
SVN-Revision: 35155
2013-01-14 16:12:56 +00:00
Florian Fainelli
3a57cd4929 netfilter: xt_NOTRACK is incorporated in xt_CT as of 3.8-rc3
Signed-off-by: Florian Fainelli <florian@openwrt.org>

SVN-Revision: 35087
2013-01-10 17:20:29 +00:00
John Crispin
b21458709a fix ipv4 nat on 3.7 by adding missing iptables modules
SVN-Revision: 34841
2012-12-22 10:17:29 +00:00
Gabor Juhos
cfc6489579 netfilter: fix module list for 3.7 kernel
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 34750
2012-12-18 14:50:42 +00:00
Jo-Philipp Wich
5ba9873914 netfilter.mk: extend nf_add macro to take a version dependency expression
- nf_add now takes an optional 4th argument which specifies a kernel version dependency, e.g. "lt 3.7.0"
	- remove CompareKernelPatchVer conditionals around nf_add invocations, use version depends instead
	- fixes xt_LOG.ko packaging with Linux 3.6.0 and later

SVN-Revision: 34681
2012-12-15 00:05:35 +00:00
Jo-Philipp Wich
8420783407 netfilter.mk: fix packaging of xt_LOG.ko, it moved between 3.3.8 and 3.6.x
SVN-Revision: 34625
2012-12-11 09:53:50 +00:00
Hauke Mehrtens
d648dad7fa kernel: fix loading of nf_nat_irc
nf_nat_irc depends on nf_conntrack_irc and it should be defined after that.
This fixes a problem introduced in r34247.

SVN-Revision: 34251
2012-11-18 21:18:37 +00:00
Imre Kaloz
935ca3f3eb add 3.7-rc6 support (patch 820 still has to be fixed)
SVN-Revision: 34247
2012-11-18 18:52:38 +00:00
Felix Fietkau
d406a5208f include/netfilter.mk: remove a few obsolete lines
SVN-Revision: 33518
2012-09-23 08:25:32 +00:00
Felix Fietkau
cfe79471d1 kmod-ipt-nathelper-extra: fix missing nf_conntrack_broadcast.ko
kmod-ipt-nathelper-extra is missing the package nf_conntrack_broadcast.ko

if it is not included into the kmod-ipt-nathelper-extra packge the modules
nf_conntrack_snmp and nf_nat_snmp_basic cant get loaded:

[   44.500000] nf_conntrack_snmp: Unknown symbol nf_conntrack_broadcast_help (err 0)
[   44.664000] nf_nat_snmp_basic: Unknown symbol nf_nat_snmp_hook (err 0)

Signed-off-by: Peter Wagner <tripolar@gmx.at>

SVN-Revision: 32434
2012-06-18 23:30:48 +00:00
Felix Fietkau
b4b60ab62f include/netfilter.mk: clean up, remove junk for old kernel versions
SVN-Revision: 32114
2012-06-07 16:30:48 +00:00
Jo-Philipp Wich
e6af9d374a fix ipt_ttl and ipt_TTL userspace library packaging
SVN-Revision: 30897
2012-03-12 02:07:22 +00:00
Jonas Gorski
c336de3d85 kernel: update module names and add new config symbols for linux 3.3
SVN-Revision: 29985
2012-02-02 08:23:44 +00:00
Jo-Philipp Wich
a529e3f09e add CT target and TTL/HL match+target
This patch adds the CT target for conntrack (enables manipulation of
conntrack events and supercedes NOTRACK) as well as the TTL/HL target and
match.

SVN-Revision: 29645
2012-01-04 02:52:54 +00:00
Jo-Philipp Wich
a788f199c9 remove current RTSP support
SVN-Revision: 29643
2012-01-04 00:29:29 +00:00
Jo-Philipp Wich
2ad90a1ec3 package CT target
SVN-Revision: 29609
2011-12-25 13:32:53 +00:00
Felix Fietkau
1027d262ef netfilter.mk: remove a few obsolete CompareKernelPatchVer calls
SVN-Revision: 27086
2011-06-01 18:08:12 +00:00
Jo-Philipp Wich
be906f6be5 package u32 match and TEE target, patches by Maxim Uvarov
SVN-Revision: 26977
2011-05-24 08:14:29 +00:00
Jo-Philipp Wich
a9977eca91 firewall: allow local redirection of ports
Allow a redirect like:

config redirect
        option src 'wan'
        option dest 'lan'
        option src_dport '22001'
        option dest_port '22'
        option proto 'tcp'

note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself.

This patch makes three changes:

(1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers).
(2) fixes a bug where the wrong table is used when the "dest_ip" field is absent.
(3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted
    connections.

In the above example,

ssh -p 22 root@myrouter

would fail from the outside, but:

ssh -p 22001 root@myrouter

would succeed.  This is handy if:

(1) you want to avoid ssh probes on your router, or
(2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but
    still want to allow firewall access from outside.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

SVN-Revision: 26617
2011-04-12 20:03:59 +00:00
Hauke Mehrtens
24c1caef5f iipt-debug: create bundle of netfilter modules for debugging
Add a bundle for including commonly useful modules for IPtables debugging and development.

For now, it just contains xt_TRACE.ko

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

SVN-Revision: 26567
2011-04-09 23:23:46 +00:00
Florian Fainelli
5959cd2850 add kmod-ipt-led
Netfilter LED target triggers blinkenlichten when a network packet hits
a rule.

LED target requires iptables 1.4.9 or higher

Signed-off-by: Łukasz Stelmach <stlman@poczta.fm>

SVN-Revision: 26451
2011-04-03 18:30:37 +00:00
Felix Fietkau
c864843cbf netfilter.mk: put ipv6 conntrack in the right package
SVN-Revision: 25750
2011-02-27 11:22:30 +00:00
Felix Fietkau
2d14f4e2f8 netfilter: add missing modules for v6 conntrack (patch from #8940)
SVN-Revision: 25731
2011-02-26 15:50:01 +00:00
Felix Fietkau
831e597d7c move nf_{conntrack,nat}_tftp to ipt-nathelper-extra, most people don't need this
SVN-Revision: 25722
2011-02-26 00:35:22 +00:00
Felix Fietkau
9dad83362d kernel: remove imq support, refresh patches
SVN-Revision: 25641
2011-02-21 02:06:51 +00:00
Jo-Philipp Wich
d2d990e41e netfilter.mk: fix connmark packaging for Kernels >= 2.6.35, thanks Daniel Gimpelevich
SVN-Revision: 24729
2010-12-19 16:47:30 +00:00
Jo-Philipp Wich
c32a125607 netfilter: workaround a userspace/kernel mismatch on Linux 2.6.35 and later
SVN-Revision: 23521
2010-10-18 20:39:07 +00:00
Alexandros C. Couloumbis
57d2e57b02 finalize r22241 fixes
SVN-Revision: 22242
2010-07-17 08:50:19 +00:00
Jo-Philipp Wich
91468dcf4f package TPROXY target and module infrastructure
SVN-Revision: 21883
2010-06-22 22:39:22 +00:00
Alexandros C. Couloumbis
b6e28298fe include/netfilter.mk fix typo on r21795
SVN-Revision: 21796
2010-06-14 14:51:51 +00:00
Alexandros C. Couloumbis
e491939c70 include/netfilter.mk: add 2.6.35 kernel support
SVN-Revision: 21795
2010-06-14 14:44:27 +00:00
Nicolas Thill
aa8e2e8685 netfilter: extension fixes (partially closes: #7045) * add missing xt_owner (2.6) * enable ipt_quota (2.4), disabled in [8499] is building fine with recent iptables * add missing ipt_nat_tftp (2.4) * add missing nf_nat_amanda (2.6)
SVN-Revision: 20693
2010-04-04 12:35:06 +00:00
Nicolas Thill
1b0a9b51c4 include/netfilter.mk: move ebtables definitions at the end
SVN-Revision: 20690
2010-04-04 03:43:13 +00:00
Jo-Philipp Wich
42e453a2e3 properly package xt_comment.ko (#6742)
SVN-Revision: 19861
2010-02-26 00:23:39 +00:00
Jo-Philipp Wich
15c4e22d31 netfilter: add support for raw table and NOTRACK target (#5504)
SVN-Revision: 19721
2010-02-19 01:36:47 +00:00
Jo-Philipp Wich
e830181f47 iptables: add comment match to the core package
SVN-Revision: 18706
2009-12-08 20:52:58 +00:00
Nicolas Thill
72dbf7cdca netfilter: remove IPset leftovers missed from [17844]
SVN-Revision: 18032
2009-10-11 14:08:31 +00:00
Hauke Mehrtens
e014faf13f Update ipset to version 3.2
SVN-Revision: 17764
2009-09-27 15:03:41 +00:00