holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Include workaround for ICMP bug in firewall script.

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@61 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2002-06-09 16:30:52 +00:00
parent b50d647981
commit d58c3ac29e
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Shorewall/common.def
View File

@ -14,8 +14,13 @@
# #
run_iptables -A common -p icmp -j icmpdef run_iptables -A common -p icmp -j icmpdef
############################################################################ ############################################################################
# Drop invalid state TCP packets
#
run_iptables -A common -m state -p tcp --state INVALID -j DROP
############################################################################
# accept ACKs and RSTs that aren't related to any session so that the # accept ACKs and RSTs that aren't related to any session so that the
# protocol stack can handle them # protocol stack can handle them and so the ACKs can create connection
# tracking entries.
# #
run_iptables -A common -p tcp --tcp-flags ACK ACK -j ACCEPT run_iptables -A common -p tcp --tcp-flags ACK ACK -j ACCEPT
run_iptables -A common -p tcp --tcp-flags RST RST -j ACCEPT run_iptables -A common -p tcp --tcp-flags RST RST -j ACCEPT

2
Shorewall/firewall
View File

@ -2707,7 +2707,7 @@ add_common_rules() {
############################################################################ ############################################################################
# Enable icmp output # Enable icmp output
# #
run_iptables -A OUTPUT -p icmp -j ACCEPT run_iptables -A OUTPUT -m state --state ! INVALID -p icmp -j ACCEPT
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 0 > $f echo 0 > $f