From 379b58f628349caad6dc1be2493aad02cd933e8a Mon Sep 17 00:00:00 2001 From: teastep Date: Wed, 13 Jul 2005 15:26:51 +0000 Subject: [PATCH] A better patch to avoid blocking DHCP broadcasts during MAC verification git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2330 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- Shorewall/firewall | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/Shorewall/firewall b/Shorewall/firewall index 321743faa..6e1b4182b 100755 --- a/Shorewall/firewall +++ b/Shorewall/firewall @@ -2392,10 +2392,6 @@ setup_mac_lists() { run_iptables -A $chain -s $address -d 224.0.0.0/4 -j $chain1 done - if $(interface_has_option $interface dhcp); then - run_iptables -A $chain -p udp --sport 68 --dport 67 -s 0.0.0.0 -d 255.255.255.255 -j ACCEPT - fi - if [ -n "$MACLIST_LOG_LEVEL" ]; then log_rule $MACLIST_LOG_LEVEL $chain $MACLIST_DISPOSITION fi @@ -6697,7 +6693,7 @@ add_common_rules() { for interface in $interfaces; do if [ -n "$BRIDGING" ]; then - eval is_bridge=\$$(chain_base $interface)_ports + is_bridge=$( brctl show $interface 2> /dev/null | grep ^$interface[[:space:]] ) [ -n "$is_bridge" ] && \ $IPTABLES -A $(forward_chain $interface) -p udp -o $interface --dport 67:68 -j ACCEPT fi