holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Make a more conservative patch to fix the 'traceroute -I' problem

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@531 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2003-04-01 14:58:47 +00:00
parent e16e47893d
commit 850f18bea6
1 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Shorewall/firewall
View File

@ -3196,18 +3196,13 @@ initialize_netfilter () {
setcontinue INPUT setcontinue INPUT
setcontinue OUTPUT setcontinue OUTPUT
#
# Make 'traceroute -I' work
#
run_iptables -I OUTPUT -p icmp --icmp-type time-exceeded -j ACCEPT
# #
# Allow DNS lookups during startup for FQDNs and deep-six INVALID packets # Allow DNS lookups during startup for FQDNs and deep-six INVALID packets
# #
for chain in INPUT OUTPUT FORWARD; do for chain in INPUT OUTPUT FORWARD; do
run_iptables -A $chain -p udp --dport 53 -j ACCEPT run_iptables -A $chain -p udp --dport 53 -j ACCEPT
run_iptables -A $chain -m state --state INVALID -j DROP run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP
done done
[ -n "$CLAMPMSS" ] && \ [ -n "$CLAMPMSS" ] && \