diff options
| author | Steven Barth <steven@midlink.org> | 2015-05-05 13:22:41 +0000 |
|---|---|---|
| committer | Steven Barth <steven@midlink.org> | 2015-05-05 13:22:41 +0000 |
| commit | b0b59d14ed78ba585d2e849828a5bf68544a3faa (patch) | |
| tree | e4d889b46f81cc1ade5ebe3a8e5fdb38e8a4e43e /package/network | |
| parent | dcf8ac794b77b8de9f1ea017b07b47e69112e0f7 (diff) | |
| download | upstream-b0b59d14ed78ba585d2e849828a5bf68544a3faa.tar.gz upstream-b0b59d14ed78ba585d2e849828a5bf68544a3faa.tar.bz2 upstream-b0b59d14ed78ba585d2e849828a5bf68544a3faa.zip | |
firewall: Allow IGMP and MLD input on WAN
The WAN port should at least respond to IGMP and MLD queries as
otherwise a snooping bridge/switch might drop traffic.
RFC4890 recommends to leave IGMP and MLD unfiltered as they are always
link-scoped anyways.
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@45613 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/network')
| -rw-r--r-- | package/network/config/firewall/files/firewall.config | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config index d149e77957..1a20e39ca5 100644 --- a/package/network/config/firewall/files/firewall.config +++ b/package/network/config/firewall/files/firewall.config @@ -46,6 +46,13 @@ config rule option family ipv4 option target ACCEPT +config rule + option name Allow-IGMP + option src wan + option proto igmp + option family ipv4 + option target ACCEPT + # Allow DHCPv6 replies # see https://dev.openwrt.org/ticket/10381 config rule @@ -59,6 +66,18 @@ config rule option family ipv6 option target ACCEPT +config rule + option name Allow-MLD + option src wan + option proto icmp + option src_ip fe80::/10 + list icmp_type '130/0' + list icmp_type '131/0' + list icmp_type '132/0' + list icmp_type '143/0' + option family ipv6 + option target ACCEPT + # Allow essential incoming IPv6 ICMP traffic config rule option name Allow-ICMPv6-Input |