diff --git a/Shorewall/Perl/Shorewall/Actions.pm b/Shorewall/Perl/Shorewall/Actions.pm index 638e76ec9..4511696b2 100644 --- a/Shorewall/Perl/Shorewall/Actions.pm +++ b/Shorewall/Perl/Shorewall/Actions.pm @@ -776,7 +776,7 @@ sub dropBcast( $$$ ) { if ( $family == F_IPV4 ) { log_rule_limit $level, $chainref, 'dropBcast' , 'DROP', '', $tag, 'add', ' -d 224.0.0.0/4 '; } else { - log_rule_limit $level, $chainref, 'dropBcast' , 'DROP', '', $tag, 'add', ' -d ff00::/10 -j DROP '; + log_rule_limit $level, $chainref, 'dropBcast' , 'DROP', '', $tag, 'add', ' -d ff00::/8 -j DROP '; } } diff --git a/Shorewall6/action.Drop b/Shorewall6/action.Drop index 206b0cb22..3e8e94bfd 100644 --- a/Shorewall6/action.Drop +++ b/Shorewall6/action.Drop @@ -24,6 +24,11 @@ # Auth(REJECT) # +# Drop Broadcasts so they don't clutter up the log +# (broadcasts must *not* be rejected). +# +dropBcast +# # ACCEPT critical ICMP types # AllowICMPs - - ipv6-icmp diff --git a/Shorewall6/action.Reject b/Shorewall6/action.Reject index 49f3c683b..35ce5e34c 100644 --- a/Shorewall6/action.Reject +++ b/Shorewall6/action.Reject @@ -20,6 +20,11 @@ # Auth(REJECT) # +# Drop Multicasts so they don't clutter up the log +# (broadcasts must *not* be rejected). +# +dropBcast +# # ACCEPT critical ICMP types # AllowICMPs - - ipv6-icmp