From 040047ef04833541ea55ddf0285f940bf268d9b8 Mon Sep 17 00:00:00 2001 From: jow Date: Thu, 1 Sep 2011 20:37:22 +0000 Subject: [package] firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038) git-svn-id: svn://svn.openwrt.org/openwrt/trunk@28148 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- package/firewall/files/lib/core_init.sh | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'package/firewall/files/lib') diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh index 185fffb98..f2cde1c47 100644 --- a/package/firewall/files/lib/core_init.sh +++ b/package/firewall/files/lib/core_init.sh @@ -1,4 +1,4 @@ -# Copyright (C) 2009-2010 OpenWrt.org +# Copyright (C) 2009-2011 OpenWrt.org # Copyright (C) 2008 John Crispin FW_INITIALIZED= @@ -66,17 +66,17 @@ fw_load_defaults() { done fw_sysctl_interface all + fw add i f INPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED } + fw add i f OUTPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED } + fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED } + [ $defaults_drop_invalid == 1 ] && { - fw add i f INPUT DROP { -m state --state INVALID } - fw add i f OUTPUT DROP { -m state --state INVALID } - fw add i f FORWARD DROP { -m state --state INVALID } + fw add i f INPUT DROP { -m conntrack --ctstate INVALID } + fw add i f OUTPUT DROP { -m conntrack --ctstate INVALID } + fw add i f FORWARD DROP { -m conntrack --ctstate INVALID } FW_NOTRACK_DISABLED=1 } - fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED } - fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED } - fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED } - fw add i f INPUT ACCEPT { -i lo } fw add i f OUTPUT ACCEPT { -o lo } -- cgit v1.2.3