extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-29 02:54:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove ICMP.DEF and replace with FORWARDPING option

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@189 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2002-08-12 17:33:05 +00:00
parent befb70c1ec
commit 3c8515aa6b
3 changed files with 18 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Shorewall/firewall
View File

@ -2814,16 +2814,15 @@ add_common_rules() {
echo " $interface"
done
fi
###########################################################################
# PING
#
[ -n "$FORWARDPING" ] && \
run_iptables -A common -p icmp --icmp-type echo-request -j ACCEPT
############################################################################
# Common ICMP rules
#
icmpdef=`find_file icmpdef`
if [ -f $icmpdef ]; then
. $icmpdef
else
. `find_file icmp.def`
fi
run_user_exit icmpdef
############################################################################
# Common rules in each chain
#
@ -2838,7 +2837,6 @@ add_common_rules() {
# BROADCASTS
#
drop_broadcasts `find_broadcasts`
###########################################################################
# RFC 1918
#
@ -3400,6 +3398,7 @@ do_initialize() {
MERGE_HOSTS=
MUTEX_TIMEOUT=
LOGNEWNOTSYN=
FORWARDPING=
stopping=
have_mutex=
masq_seq=1
@ -3476,6 +3475,7 @@ do_initialize() {
MULTIPORT=`added_param_value_no MULTIPORT $MULTIPORT`
DETECT_DNAT_IPADDRS=`added_param_value_no DETECT_DNAT_IPADDRS $DETECT_DNAT_IPADDRS`
MERGE_HOSTS=`added_param_value_no MERGE_HOSTS $MERGE_HOSTS`
FORWARDPING=`added_param_value_no FORWARDPING $FORWARDPING`
}
################################################################################

20
Shorewall/icmp.def
View File

@ -1,22 +1,6 @@
##############################################################################
# Shorewall 1.3 /etc/shorewall/icmp.def
#
# This file defines the default rules for accepting ICMP packets.
# This file is obsolete and is included for compatibility with existing
# icmpdef extension scripts that source it.
#
# Do not modify this file -- if you wish to change these rules, create
# /etc/shorewall/icmpdef to replace it. It is suggested that you include
# the command "source /etc/shorewall/icmp.def" in your
# /etc/shorewall/icmpdef file so that you will continue to get the
# advantage of new releases of this file.
#
# For example, if you want to accept 'ping' everywhere then create
# /etc/shorewall/icmpdef with the following two lines:
#
# source /etc/shorewall/icmp.def
# run_iptables -A icmpdef -p ICMP --icmp-type echo-request -j ACCEPT
#
run_iptables -A icmpdef -p ICMP --icmp-type echo-reply -j ACCEPT
run_iptables -A icmpdef -p ICMP --icmp-type source-quench -j ACCEPT
run_iptables -A icmpdef -p ICMP --icmp-type destination-unreachable -j ACCEPT
run_iptables -A icmpdef -p ICMP --icmp-type time-exceeded -j ACCEPT
run_iptables -A icmpdef -p ICMP --icmp-type parameter-problem -j ACCEPT

8
Shorewall/shorewall.conf
View File

@ -349,4 +349,12 @@ MUTEX_TIMEOUT=60
LOGNEWNOTSYN=
#
# Forward "Ping"
#
# If FORWARDPING is set to "Yes" then Echo Request ("Ping") packets are
# forwarded by the firewall.
FORWARDPING=Yes
#LAST LINE -- DO NOT REMOVE