aboutsummaryrefslogtreecommitdiffstats
path: root/package/kernel
diff options
context:
space:
mode:
authorMatthias Schiffer <mschiffer@universe-factory.net>2018-04-12 17:57:44 +0200
committerMatthias Schiffer <mschiffer@universe-factory.net>2018-04-13 10:16:45 +0200
commit445682c07d0669984f2cc8acb1fba5e1a5e3bc27 (patch)
tree1a7c0c1c1521850d157600e14965f27507d7b849 /package/kernel
parentbee696d66c95337d91fc0256afbf481dc93ddb27 (diff)
downloadupstream-445682c07d0669984f2cc8acb1fba5e1a5e3bc27.tar.gz
upstream-445682c07d0669984f2cc8acb1fba5e1a5e3bc27.tar.bz2
upstream-445682c07d0669984f2cc8acb1fba5e1a5e3bc27.zip
base-files: move netfilter sysctl defaults to specific kmod packages
Avoid warnings when applying settings for uninstalled kmods. See also FS#1073. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Diffstat (limited to 'package/kernel')
-rw-r--r--package/kernel/linux/files/sysctl-br-netfilter.conf7
-rw-r--r--package/kernel/linux/files/sysctl-nf-conntrack.conf9
-rw-r--r--package/kernel/linux/modules/netfilter.mk10
3 files changed, 26 insertions, 0 deletions
diff --git a/package/kernel/linux/files/sysctl-br-netfilter.conf b/package/kernel/linux/files/sysctl-br-netfilter.conf
new file mode 100644
index 0000000000..b10ddc0874
--- /dev/null
+++ b/package/kernel/linux/files/sysctl-br-netfilter.conf
@@ -0,0 +1,7 @@
+# Do not edit, changes to this file will be lost on upgrades
+# /etc/sysctl.conf can be used to customize sysctl settings
+
+# disable bridge firewalling by default
+net.bridge.bridge-nf-call-arptables=0
+net.bridge.bridge-nf-call-ip6tables=0
+net.bridge.bridge-nf-call-iptables=0
diff --git a/package/kernel/linux/files/sysctl-nf-conntrack.conf b/package/kernel/linux/files/sysctl-nf-conntrack.conf
new file mode 100644
index 0000000000..37baf5fd6f
--- /dev/null
+++ b/package/kernel/linux/files/sysctl-nf-conntrack.conf
@@ -0,0 +1,9 @@
+# Do not edit, changes to this file will be lost on upgrades
+# /etc/sysctl.conf can be used to customize sysctl settings
+
+net.netfilter.nf_conntrack_acct=1
+net.netfilter.nf_conntrack_checksum=0
+net.netfilter.nf_conntrack_max=16384
+net.netfilter.nf_conntrack_tcp_timeout_established=7440
+net.netfilter.nf_conntrack_udp_timeout=60
+net.netfilter.nf_conntrack_udp_timeout_stream=180
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index 99c24cc042..51f3544ed6 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -101,6 +101,11 @@ define KernelPackage/nf-conntrack
AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
endef
+define KernelPackage/nf-conntrack/install
+ $(INSTALL_DIR) $(1)/etc/sysctl.d
+ $(INSTALL_DATA) ./files/sysctl-nf-conntrack.conf $(1)/etc/sysctl.d/11-nf-conntrack.conf
+endef
+
$(eval $(call KernelPackage,nf-conntrack))
@@ -774,6 +779,11 @@ define KernelPackage/br-netfilter
AUTOLOAD:=$(call AutoProbe,br_netfilter)
endef
+define KernelPackage/br-netfilter/install
+ $(INSTALL_DIR) $(1)/etc/sysctl.d
+ $(INSTALL_DATA) ./files/sysctl-br-netfilter.conf $(1)/etc/sysctl.d/11-br-netfilter.conf
+endef
+
$(eval $(call KernelPackage,br-netfilter))