mirror of
https://gitlab.com/shorewall/code.git
synced 2024-12-16 11:20:53 +01:00
Make a more conservative patch to fix the 'traceroute -I' problem
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@531 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
e16e47893d
commit
850f18bea6
@ -3196,18 +3196,13 @@ initialize_netfilter () {
|
||||
setcontinue INPUT
|
||||
setcontinue OUTPUT
|
||||
|
||||
#
|
||||
# Make 'traceroute -I' work
|
||||
#
|
||||
run_iptables -I OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT
|
||||
|
||||
#
|
||||
# Allow DNS lookups during startup for FQDNs and deep-six INVALID packets
|
||||
#
|
||||
|
||||
for chain in INPUT OUTPUT FORWARD; do
|
||||
run_iptables -A $chain -p udp --dport 53 -j ACCEPT
|
||||
run_iptables -A $chain -m state --state INVALID -j DROP
|
||||
run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP
|
||||
done
|
||||
|
||||
[ -n "$CLAMPMSS" ] && \
|
||||
|
Loading…
Reference in New Issue
Block a user