qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-11-23 22:05:20 +02:00
Code

[package] firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038)

Browse Source 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28148 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
jow 2011-09-01 20:37:22 +00:00
parent a028d987c3
commit 040047ef04
2 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/firewall/Makefile
View File

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=2
PKG_RELEASE:=34
PKG_RELEASE:=35
include $(INCLUDE_DIR)/package.mk

16
package/firewall/files/lib/core_init.sh
View File

@ -1,4 +1,4 @@
# Copyright (C) 2009-2010 OpenWrt.org
# Copyright (C) 2009-2011 OpenWrt.org
# Copyright (C) 2008 John Crispin <blogic@openwrt.org>
FW_INITIALIZED=
@ -66,17 +66,17 @@ fw_load_defaults() {
done
fw_sysctl_interface all
fw add i f INPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
fw add i f OUTPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
[ $defaults_drop_invalid == 1 ] && {
fw add i f INPUT DROP { -m state --state INVALID }
fw add i f OUTPUT DROP { -m state --state INVALID }
fw add i f FORWARD DROP { -m state --state INVALID }
fw add i f INPUT DROP { -m conntrack --ctstate INVALID }
fw add i f OUTPUT DROP { -m conntrack --ctstate INVALID }
fw add i f FORWARD DROP { -m conntrack --ctstate INVALID }
FW_NOTRACK_DISABLED=1
}
fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
fw add i f INPUT ACCEPT { -i lo }
fw add i f OUTPUT ACCEPT { -o lo }