mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-27 05:01:37 +02:00
Allow RST and ACK packets under NEWNOTSYN=Yes
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@238 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
53f8743591
commit
87890954b7
@ -2829,6 +2829,42 @@ initialize_netfilter () {
|
|||||||
done
|
done
|
||||||
}
|
}
|
||||||
|
|
||||||
|
################################################################################
|
||||||
|
# Build the common chain -- called during [re]start and refresh #
|
||||||
|
################################################################################
|
||||||
|
build_common_chain() {
|
||||||
|
###########################################################################
|
||||||
|
# PING
|
||||||
|
#
|
||||||
|
[ -n "$FORWARDPING" ] && \
|
||||||
|
run_iptables -A icmpdef -p icmp --icmp-type echo-request -j ACCEPT
|
||||||
|
############################################################################
|
||||||
|
# Common ICMP rules
|
||||||
|
#
|
||||||
|
run_user_exit icmpdef
|
||||||
|
############################################################################
|
||||||
|
# Common rules in each chain
|
||||||
|
#
|
||||||
|
common=`find_file common`
|
||||||
|
|
||||||
|
if [ -f $common ]; then
|
||||||
|
. $common
|
||||||
|
else
|
||||||
|
. `find_file common.def`
|
||||||
|
fi
|
||||||
|
###########################################################################
|
||||||
|
# New Not Syn Stuff
|
||||||
|
#
|
||||||
|
if [ -n "$NEWNOTSYN" ]; then
|
||||||
|
run_iptables -A common -p tcp --tcp-flags ACK ACK -j ACCEPT
|
||||||
|
run_iptables -A common -p tcp --tcp-flags RST RST -j ACCEPT
|
||||||
|
fi
|
||||||
|
###########################################################################
|
||||||
|
# BROADCASTS
|
||||||
|
#
|
||||||
|
drop_broadcasts `find_broadcasts`
|
||||||
|
}
|
||||||
|
|
||||||
################################################################################
|
################################################################################
|
||||||
# Construct zone-independent rules #
|
# Construct zone-independent rules #
|
||||||
################################################################################
|
################################################################################
|
||||||
@ -2892,29 +2928,9 @@ add_common_rules() {
|
|||||||
echo " $interface"
|
echo " $interface"
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
###########################################################################
|
|
||||||
# PING
|
|
||||||
#
|
|
||||||
[ -n "$FORWARDPING" ] && \
|
|
||||||
run_iptables -A icmpdef -p icmp --icmp-type echo-request -j ACCEPT
|
|
||||||
############################################################################
|
|
||||||
# Common ICMP rules
|
|
||||||
#
|
|
||||||
run_user_exit icmpdef
|
|
||||||
############################################################################
|
|
||||||
# Common rules in each chain
|
|
||||||
#
|
|
||||||
common=`find_file common`
|
|
||||||
|
|
||||||
if [ -f $common ]; then
|
build_common_chain
|
||||||
. $common
|
|
||||||
else
|
|
||||||
. `find_file common.def`
|
|
||||||
fi
|
|
||||||
###########################################################################
|
|
||||||
# BROADCASTS
|
|
||||||
#
|
|
||||||
drop_broadcasts `find_broadcasts`
|
|
||||||
###########################################################################
|
###########################################################################
|
||||||
# DHCP
|
# DHCP
|
||||||
#
|
#
|
||||||
@ -3380,20 +3396,8 @@ refresh_firewall()
|
|||||||
run_iptables -F common
|
run_iptables -F common
|
||||||
|
|
||||||
echo "Adding Common Rules"
|
echo "Adding Common Rules"
|
||||||
############################################################################
|
|
||||||
# Common rules in each chain
|
|
||||||
#
|
|
||||||
common=`find_file common`
|
|
||||||
|
|
||||||
if [ -f $common ]; then
|
build_common_chain
|
||||||
. $common
|
|
||||||
else
|
|
||||||
. `find_file common.def`
|
|
||||||
fi
|
|
||||||
###########################################################################
|
|
||||||
# BROADCASTS
|
|
||||||
#
|
|
||||||
drop_broadcasts `find_broadcasts`
|
|
||||||
|
|
||||||
###########################################################################
|
###########################################################################
|
||||||
# Blacklist
|
# Blacklist
|
||||||
|
Loading…
x
Reference in New Issue
Block a user