aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2011-09-01 20:37:22 +0000
committerJo-Philipp Wich <jow@openwrt.org>2011-09-01 20:37:22 +0000
commit995face56d5d8f701a505dd2ed9d827a69384675 (patch)
treeb6846ca303d2a712137fbd1ad8bb1f83703273b2
parent99e422472c4279c5a79faaa8a587b1ca33d04a5e (diff)
downloadupstream-995face56d5d8f701a505dd2ed9d827a69384675.tar.gz
upstream-995face56d5d8f701a505dd2ed9d827a69384675.tar.bz2
upstream-995face56d5d8f701a505dd2ed9d827a69384675.zip
firewall: make ESTABLISHED,RELATED rules match before INVALID, use conntrack instead of state match (#10038)
SVN-Revision: 28148
-rw-r--r--package/firewall/Makefile2
-rw-r--r--package/firewall/files/lib/core_init.sh16
2 files changed, 9 insertions, 9 deletions
diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index b192ad330e..597a37e140 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=2
-PKG_RELEASE:=34
+PKG_RELEASE:=35
include $(INCLUDE_DIR)/package.mk
diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh
index 185fffb98b..f2cde1c470 100644
--- a/package/firewall/files/lib/core_init.sh
+++ b/package/firewall/files/lib/core_init.sh
@@ -1,4 +1,4 @@
-# Copyright (C) 2009-2010 OpenWrt.org
+# Copyright (C) 2009-2011 OpenWrt.org
# Copyright (C) 2008 John Crispin <blogic@openwrt.org>
FW_INITIALIZED=
@@ -66,17 +66,17 @@ fw_load_defaults() {
done
fw_sysctl_interface all
+ fw add i f INPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+ fw add i f OUTPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+ fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+
[ $defaults_drop_invalid == 1 ] && {
- fw add i f INPUT DROP { -m state --state INVALID }
- fw add i f OUTPUT DROP { -m state --state INVALID }
- fw add i f FORWARD DROP { -m state --state INVALID }
+ fw add i f INPUT DROP { -m conntrack --ctstate INVALID }
+ fw add i f OUTPUT DROP { -m conntrack --ctstate INVALID }
+ fw add i f FORWARD DROP { -m conntrack --ctstate INVALID }
FW_NOTRACK_DISABLED=1
}
- fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
- fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
- fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
-
fw add i f INPUT ACCEPT { -i lo }
fw add i f OUTPUT ACCEPT { -o lo }