aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/config/firewall/files
diff options
context:
space:
mode:
authorSteven Barth <cyrus@openwrt.org>2015-05-05 13:22:41 +0000
committerSteven Barth <cyrus@openwrt.org>2015-05-05 13:22:41 +0000
commitd534883a52925f39c2579e8da45fab7ca57ad84b (patch)
tree192a8bd049ba7eafb8c49aa89cdb4c46bc3fdf6f /package/network/config/firewall/files
parent336fc7a702fdea9e6da9797c7d789949099390d7 (diff)
downloadupstream-d534883a52925f39c2579e8da45fab7ca57ad84b.tar.gz
upstream-d534883a52925f39c2579e8da45fab7ca57ad84b.tar.bz2
upstream-d534883a52925f39c2579e8da45fab7ca57ad84b.zip
firewall: Allow IGMP and MLD input on WAN
The WAN port should at least respond to IGMP and MLD queries as otherwise a snooping bridge/switch might drop traffic. RFC4890 recommends to leave IGMP and MLD unfiltered as they are always link-scoped anyways. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> SVN-Revision: 45613
Diffstat (limited to 'package/network/config/firewall/files')
-rw-r--r--package/network/config/firewall/files/firewall.config19
1 files changed, 19 insertions, 0 deletions
diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config
index d149e77957..1a20e39ca5 100644
--- a/package/network/config/firewall/files/firewall.config
+++ b/package/network/config/firewall/files/firewall.config
@@ -46,6 +46,13 @@ config rule
option family ipv4
option target ACCEPT
+config rule
+ option name Allow-IGMP
+ option src wan
+ option proto igmp
+ option family ipv4
+ option target ACCEPT
+
# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
@@ -59,6 +66,18 @@ config rule
option family ipv6
option target ACCEPT
+config rule
+ option name Allow-MLD
+ option src wan
+ option proto icmp
+ option src_ip fe80::/10
+ list icmp_type '130/0'
+ list icmp_type '131/0'
+ list icmp_type '132/0'
+ list icmp_type '143/0'
+ option family ipv6
+ option target ACCEPT
+
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input