aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/config/firewall/files
Commit message (Collapse)AuthorAgeFilesLines
* firewall: add rule for traceroute supportPhilip Prindeville2020-05-211-0/+13
| | | | | | | | | | | | | | | | | Running your firewall's "wan" zone in REJECT zone (1) exposes the presence of the router, (2) depending on the sophistication of fingerprinting tools might identify the OS and release running on the firewall which then identifies known vulnerabilities with it and (3) perhaps most importantly of all, your firewall can be used in a DDoS reflection attack with spoofed traffic generating ICMP Unreachables or TCP RST's to overwhelm a victim or saturate his link. This rule, when enabled, allows traceroute to work even when the default input policy of the firewall for the wan zone has been set to DROP. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
* firewall: document rules for IPSec ESP/ISAKMP with 'name' optionYousong Zhou2017-03-281-14/+15
| | | | | | | | | | These are recommended practices by REC-22 and REC-24 of RFC6092: "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service" Fixes FS#640 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
* firewall: allow DHCPv6 traffic to/from fc00::/6 instead of fe80::/10Jo-Philipp Wich2015-09-251-2/+2
| | | | | | | | | | There is no RFC requirement that DHCPv6 servers must reply with a link local address and some ISP servers in the wild appear to using addresses in the ULA range to send DHCPv6 offers. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 47048
* firewall: Remove src_port from firewall.config to receive dhcpv6 repliesSteven Barth2015-09-111-1/+0
| | | | | | | | | | Seems like my second try was again whitespace broken. Sorry for the noise. Remove src_port from firewall.config to receive dhcpv6 replies. Fixes #20295. Signed-off-by: Anselm Eberhardt <a.eberhardt@cygnusnetworks.de> SVN-Revision: 46842
* firewall: fix typo in ESP ruleSteven Barth2015-07-271-1/+1
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46506
* firewall: comply with REC-22, REC-24 of RFC 6092Steven Barth2015-07-241-12/+11
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> SVN-Revision: 46478
* firewall: Allow IGMP and MLD input on WANSteven Barth2015-05-051-0/+19
| | | | | | | | | | | | The WAN port should at least respond to IGMP and MLD queries as otherwise a snooping bridge/switch might drop traffic. RFC4890 recommends to leave IGMP and MLD unfiltered as they are always link-scoped anyways. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> SVN-Revision: 45613
* package/*: remove useless explicit set of function returncodeJohn Crispin2014-08-251-4/+0
| | | | | | | | | | | | | | | | | | | | | | somebody started to set a function returncode in the validation stuff and everybody copies it, e.g. myfunction() { fire_command return $? } a function automatically returns with the last returncode, so we can safely remove the command 'return $?'. reference: http://tldp.org/LDP/abs/html/exit-status.html "The last command executed in the function or script determines the exit status." Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com> SVN-Revision: 42278
* firewall: the firewall did not start properly on bootJohn Crispin2014-08-211-1/+1
| | | | | | | | https://dev.openwrt.org/ticket/17593 Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 42233
* firewall: fix validation constraintsJo-Philipp Wich2014-02-211-8/+8
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> SVN-Revision: 39649
* firewall3: update init.d script to make use of procdJohn Crispin2014-02-181-9/+49
| | | | | | | | add validation data Signed-off-by: John Crispin <blogic@openwrt.org> SVN-Revision: 39617
* firewall: don't reload if there were no address or data changesSteven Barth2014-01-191-0/+1
| | | | | | | This fixes packet loss due to reloading firewall every minute with IPv6 implementation of certain ISPs. SVN-Revision: 39332
* firewall: improve logging in hotplug scriptJohn Crispin2014-01-151-1/+1
| | | | | | Signed-off-by: Nathan Hintz <nlhintz@hotmail.com> SVN-Revision: 39300
* firewall: Improve ubus supportSteven Barth2013-10-231-1/+1
| | | | | | | | | | * Use network.interface dump call instead of individual status calls to reduce overall netifd lookups and invokes to 1 per fw3 process. * Allow protocol handlers to assign a firewall zone for an interface in the data section to allow for dynamic firewall zone assignment. SVN-Revision: 38504
* firewall: allow routed lan<->lan traffic by defaultJo-Philipp Wich2013-07-041-1/+1
| | | | SVN-Revision: 37171
* firewall3: rename to firewall, move into base system menu, update to git ↵Jo-Philipp Wich2013-06-044-0/+219
| | | | | | head with compatibility fixes for AA SVN-Revision: 36838
* Drop legacy firewall packageJo-Philipp Wich2013-06-0416-1903/+0
| | | | SVN-Revision: 36837
* firewall: Remove obsoleted ULA-border ruleSteven Barth2013-05-131-19/+0
| | | | SVN-Revision: 36622
* firewall: fix logging rule regression (#12999)Jo-Philipp Wich2013-02-221-1/+1
| | | | SVN-Revision: 35745
* firewall: various enhancementsJo-Philipp Wich2013-02-046-96/+132
| | | | | | | | | | | | - reduce mssfix related log spam (#10681) - separate src and dest terminal chains (#11453, #12945) - disable per-zone custom chains by default, they're rarely used Additionally introduce options "device", "subnet", "extra", "extra_src" and "extra_dest" to allow defining zones not related to uci interfaces, e.g. to match "ppp+" or any tcp traffic to and from a specific port. SVN-Revision: 35484
* firewall: flush conntrack table after changing interface rulesJo-Philipp Wich2013-01-281-0/+3
| | | | SVN-Revision: 35348
* firewall: Add ULA site border for IPv6 traffic This prevents private traffic ↵Steven Barth2013-01-041-0/+19
| | | | | | from leaking out to the internet SVN-Revision: 35012
* firewall: fix typo in reflection hotplug scriptJo-Philipp Wich2012-12-071-1/+1
| | | | SVN-Revision: 34569
* firewall: extend nat reflection supportJo-Philipp Wich2012-12-041-85/+122
| | | | | | | | - use comment match to keep track of per-network rules - setup reflection for any interface which is part of a masqueraded zone, not just "wan" - delete per-network reflection rules if network is brought down SVN-Revision: 34472
* packages: sort network related packages into package/network/Felix Fietkau2012-10-1016-0/+1827
SVN-Revision: 33688
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-05 20:13:41 +0000