1
0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-12-11 23:53:10 +02:00
Commit Graph

18 Commits

Author SHA1 Message Date
jow
f7ec5e7119 [package] firewall: add DHCPv6 default rule (#10381)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28874 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-11-09 11:10:37 +00:00
jow
f80fb45dc2 [package] firewall: further tune ICMPv6 default rules according to RFC4890 (#9893)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27979 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-08-14 00:33:29 +00:00
jow
86a3fe1a88 [package] firewall: refine default ICMPv6 rules to better conform with RFC4890, do not forward link local ICMP message types, allow parameter problem
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27321 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-06-30 12:22:05 +00:00
jow
87281df903 [package] firewall:
- allow multiple ports, protocols, macs, icmp types per rule
	- implement "limit" and "limit_burst" options for rules
	- implement "extra" option to rules and redirects for passing arbritary flags to iptables
	- implement negations for "src_port", "dest_port", "src_dport", "src_mac", "proto" and "icmp_type" options
	- allow wildcard (*) "src" and "dest" options in rules to allow specifying "any" source or destination
	- validate symbolic icmp-type names against the selected iptables binary
	- properly handle forwarded ICMPv6 traffic in the default configuration


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27317 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-06-30 01:31:23 +00:00
jow
4eff224df3 [package] firewall: explictely mention network in default configuration, makes it less confusing
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26961 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-05-20 13:45:40 +00:00
jow
667c11ec82 [PATCH] firewall: provide examples of ssh port relocation on firewall and IPsec passthrough
Two examples of potentially useful configurations (commented out, of course):

(a) map the ssh service running on the firewall to 22001 externally, without modifying the configuration of the daemon itself. this allows port 22 on the WAN side to then be port-forwarded to a 
LAN-based machine if desired, or if not, simply obscures the port from external attack.

(b) allow IPsec/ESP and ISAKMP (UDP-based key exchange) to happen by default. useful for most modern VPN clients you might have on your WAN.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@26805 3c298f89-4303-0410-b956-a3cf2f4a3e73
2011-05-02 12:54:31 +00:00
jow
cf06be1395 [package] firewall: don't apply default udp/68 rule to ip6tables
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21509 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-19 21:37:12 +00:00
jow
eecea36854 [package] firewall: add commented disable_ipv6 option to default config
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21505 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-05-19 09:49:21 +00:00
thepeople
1054800824 allow ping
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@20261 3c298f89-4303-0410-b956-a3cf2f4a3e73
2010-03-18 03:46:41 +00:00
nico
dc1a20a020 [package] firewall: fix MSS issue affection RELATED new connections (closes: #5173)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@17762 3c298f89-4303-0410-b956-a3cf2f4a3e73
2009-09-27 13:57:09 +00:00
jow
930ebf26f0 [package] firewall: allow incoming udp/68 packets in the default configuration (#4108, #4781)
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@17238 3c298f89-4303-0410-b956-a3cf2f4a3e73
2009-08-13 03:31:53 +00:00
jow
4ed7156513 [package] firewall: enable /etc/firewall.user by default and install sample firewall.user file
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@15221 3c298f89-4303-0410-b956-a3cf2f4a3e73
2009-04-12 22:38:34 +00:00
nbd
759aaf7754 re-enable the mss fix by default for now - see discussion at http://lists.openwrt.org/pipermail/openwrt-devel/2009-January/003724.html for more information
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@14293 3c298f89-4303-0410-b956-a3cf2f4a3e73
2009-01-31 02:14:27 +00:00
nbd
e8530f33a9 disable the MSS fixup hack by default (most ISPs don't require this as a workaround for MTU problems, only some do). this should give a nice speedup for routing on standard-compliant ISPs
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@13788 3c298f89-4303-0410-b956-a3cf2f4a3e73
2008-12-31 19:02:03 +00:00
nbd
740dc63d5f set default input policy to ACCEPT to bring the firewall behavior closer to the one of previous versions
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@12766 3c298f89-4303-0410-b956-a3cf2f4a3e73
2008-09-28 16:17:49 +00:00
nico
1fa1f8e7d8 firewall changes:
- implement a REJECT policy and enable it by default, reject packets with approriate response (closes: #3970)
 - cleanup syn_flood and remove logging


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@12688 3c298f89-4303-0410-b956-a3cf2f4a3e73
2008-09-24 15:10:16 +00:00
blogic
6a94232068 use proto instead of protocol in uci firewall
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@12391 3c298f89-4303-0410-b956-a3cf2f4a3e73
2008-08-26 07:23:29 +00:00
blogic
aa954c1c5d uci firewall
- make uci firewall default and remove old code
- fix up dependencies


git-svn-id: svn://svn.openwrt.org/openwrt/trunk@12284 3c298f89-4303-0410-b956-a3cf2f4a3e73
2008-08-11 22:27:36 +00:00