mirror of
git://git.openwrt.org/openwrt/openwrt.git
synced 2024-12-13 18:34:53 +00:00
firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038)
SVN-Revision: 28148
This commit is contained in:
parent
99e422472c
commit
995face56d
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
||||
PKG_NAME:=firewall
|
||||
|
||||
PKG_VERSION:=2
|
||||
PKG_RELEASE:=34
|
||||
PKG_RELEASE:=35
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
|
@ -1,4 +1,4 @@
|
||||
# Copyright (C) 2009-2010 OpenWrt.org
|
||||
# Copyright (C) 2009-2011 OpenWrt.org
|
||||
# Copyright (C) 2008 John Crispin <blogic@openwrt.org>
|
||||
|
||||
FW_INITIALIZED=
|
||||
@ -66,17 +66,17 @@ fw_load_defaults() {
|
||||
done
|
||||
fw_sysctl_interface all
|
||||
|
||||
fw add i f INPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
|
||||
fw add i f OUTPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
|
||||
fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
|
||||
|
||||
[ $defaults_drop_invalid == 1 ] && {
|
||||
fw add i f INPUT DROP { -m state --state INVALID }
|
||||
fw add i f OUTPUT DROP { -m state --state INVALID }
|
||||
fw add i f FORWARD DROP { -m state --state INVALID }
|
||||
fw add i f INPUT DROP { -m conntrack --ctstate INVALID }
|
||||
fw add i f OUTPUT DROP { -m conntrack --ctstate INVALID }
|
||||
fw add i f FORWARD DROP { -m conntrack --ctstate INVALID }
|
||||
FW_NOTRACK_DISABLED=1
|
||||
}
|
||||
|
||||
fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
|
||||
fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
|
||||
fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
|
||||
|
||||
fw add i f INPUT ACCEPT { -i lo }
|
||||
fw add i f OUTPUT ACCEPT { -o lo }
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user