From 850f18bea6bc003278ba2b1d75264fc3e3becdd4 Mon Sep 17 00:00:00 2001 From: teastep Date: Tue, 1 Apr 2003 14:58:47 +0000 Subject: [PATCH] Make a more conservative patch to fix the 'traceroute -I' problem git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@531 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- Shorewall/firewall | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/Shorewall/firewall b/Shorewall/firewall index c67cc1290..de2e55df0 100755 --- a/Shorewall/firewall +++ b/Shorewall/firewall @@ -3196,18 +3196,13 @@ initialize_netfilter () { setcontinue INPUT setcontinue OUTPUT - # - # Make 'traceroute -I' work - # - run_iptables -I OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT - # # Allow DNS lookups during startup for FQDNs and deep-six INVALID packets # for chain in INPUT OUTPUT FORWARD; do run_iptables -A $chain -p udp --dport 53 -j ACCEPT - run_iptables -A $chain -m state --state INVALID -j DROP + run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP done [ -n "$CLAMPMSS" ] && \