diff options
| author | Alin Nastac <alin.nastac@gmail.com> | 2017-06-16 14:16:07 +0200 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2017-12-13 16:23:38 +0100 |
| commit | c86490605c5511e88093d3584dc9a277afcb9d6d (patch) | |
| tree | c5f2c75f096cb0de17954906739fd9ee1f8bd8ef /package/network | |
| parent | ea23ba9a250714302e9fc21bfc52293b3cddfddd (diff) | |
| download | upstream-c86490605c5511e88093d3584dc9a277afcb9d6d.tar.gz upstream-c86490605c5511e88093d3584dc9a277afcb9d6d.tar.bz2 upstream-c86490605c5511e88093d3584dc9a277afcb9d6d.zip | |
netfilter: add iptables-mod-rpfilter package
Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw
-I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to
become full when a packet flood with randomly selected source IP addresses
is received from the lan side.
Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
(cherry picked from commit d8748e537f11ab5f2b5e2ed25d94baa5ce353984)
Diffstat (limited to 'package/network')
| -rw-r--r-- | package/network/utils/iptables/Makefile | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile index ac869f0385..bf1a792c00 100644 --- a/package/network/utils/iptables/Makefile +++ b/package/network/utils/iptables/Makefile @@ -229,6 +229,19 @@ iptables extensions for hashlimit matching endef +define Package/iptables-mod-rpfilter +$(call Package/iptables/Module, +kmod-ipt-rpfilter) + TITLE:=rpfilter iptables extension +endef + +define Package/iptables-mod-rpfilter/description +iptables extensions for reverse path filter test on a packet + + Matches: + - rpfilter + +endef + define Package/iptables-mod-iprange $(call Package/iptables/Module, +kmod-ipt-iprange) TITLE:=IP range extension @@ -543,6 +556,7 @@ $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m))) $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m))) $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m))) $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m))) +$(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m))) $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m))) $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m))) $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m))) |