diff options
| author | Steven Barth <cyrus@openwrt.org> | 2015-05-05 13:22:41 +0000 |
|---|---|---|
| committer | Steven Barth <cyrus@openwrt.org> | 2015-05-05 13:22:41 +0000 |
| commit | d534883a52925f39c2579e8da45fab7ca57ad84b (patch) | |
| tree | 192a8bd049ba7eafb8c49aa89cdb4c46bc3fdf6f | |
| parent | 336fc7a702fdea9e6da9797c7d789949099390d7 (diff) | |
| download | master-31e0f0ae-d534883a52925f39c2579e8da45fab7ca57ad84b.tar.gz master-31e0f0ae-d534883a52925f39c2579e8da45fab7ca57ad84b.tar.bz2 master-31e0f0ae-d534883a52925f39c2579e8da45fab7ca57ad84b.zip | |
firewall: Allow IGMP and MLD input on WAN
The WAN port should at least respond to IGMP and MLD queries as
otherwise a snooping bridge/switch might drop traffic.
RFC4890 recommends to leave IGMP and MLD unfiltered as they are always
link-scoped anyways.
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
SVN-Revision: 45613
| -rw-r--r-- | package/network/config/firewall/files/firewall.config | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config index d149e77957..1a20e39ca5 100644 --- a/package/network/config/firewall/files/firewall.config +++ b/package/network/config/firewall/files/firewall.config @@ -46,6 +46,13 @@ config rule option family ipv4 option target ACCEPT +config rule + option name Allow-IGMP + option src wan + option proto igmp + option family ipv4 + option target ACCEPT + # Allow DHCPv6 replies # see https://dev.openwrt.org/ticket/10381 config rule @@ -59,6 +66,18 @@ config rule option family ipv6 option target ACCEPT +config rule + option name Allow-MLD + option src wan + option proto icmp + option src_ip fe80::/10 + list icmp_type '130/0' + list icmp_type '131/0' + list icmp_type '132/0' + list icmp_type '143/0' + option family ipv6 + option target ACCEPT + # Allow essential incoming IPv6 ICMP traffic config rule option name Allow-ICMPv6-Input |