aboutsummaryrefslogtreecommitdiffstats
path: root/package/network/config/firewall/files
Commit message (Collapse)AuthorAgeFilesLines
* firewall: allow DHCPv6 traffic to/from fc00::/6 instead of fe80::/10Jo-Philipp Wich2015-09-251-2/+2
| | | | | | | | | | There is no RFC requirement that DHCPv6 servers must reply with a link local address and some ISP servers in the wild appear to using addresses in the ULA range to send DHCPv6 offers. Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@47048 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: Remove src_port from firewall.config to receive dhcpv6 repliesSteven Barth2015-09-111-1/+0
| | | | | | | | | | Seems like my second try was again whitespace broken. Sorry for the noise. Remove src_port from firewall.config to receive dhcpv6 replies. Fixes #20295. Signed-off-by: Anselm Eberhardt <a.eberhardt@cygnusnetworks.de> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46842 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: fix typo in ESP ruleSteven Barth2015-07-271-1/+1
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46506 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: comply with REC-22, REC-24 of RFC 6092Steven Barth2015-07-241-12/+11
| | | | | | Signed-off-by: Steven Barth <steven@midlink.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@46478 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: Allow IGMP and MLD input on WANSteven Barth2015-05-051-0/+19
| | | | | | | | | | | | The WAN port should at least respond to IGMP and MLD queries as otherwise a snooping bridge/switch might drop traffic. RFC4890 recommends to leave IGMP and MLD unfiltered as they are always link-scoped anyways. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@45613 3c298f89-4303-0410-b956-a3cf2f4a3e73
* package/*: remove useless explicit set of function returncodeJohn Crispin2014-08-251-4/+0
| | | | | | | | | | | | | | | | | | | | | | somebody started to set a function returncode in the validation stuff and everybody copies it, e.g. myfunction() { fire_command return $? } a function automatically returns with the last returncode, so we can safely remove the command 'return $?'. reference: http://tldp.org/LDP/abs/html/exit-status.html "The last command executed in the function or script determines the exit status." Signed-off-by: Bastian Bittorf <bittorf@bluebottle.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@42278 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: the firewall did not start properly on bootJohn Crispin2014-08-211-1/+1
| | | | | | | | https://dev.openwrt.org/ticket/17593 Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@42233 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: fix validation constraintsJo-Philipp Wich2014-02-211-8/+8
| | | | | | Signed-off-by: Jo-Philipp Wich <jow@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39649 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall3: update init.d script to make use of procdJohn Crispin2014-02-181-9/+49
| | | | | | | | add validation data Signed-off-by: John Crispin <blogic@openwrt.org> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39617 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: don't reload if there were no address or data changesSteven Barth2014-01-191-0/+1
| | | | | | | This fixes packet loss due to reloading firewall every minute with IPv6 implementation of certain ISPs. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39332 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: improve logging in hotplug scriptJohn Crispin2014-01-151-1/+1
| | | | | | Signed-off-by: Nathan Hintz <nlhintz@hotmail.com> git-svn-id: svn://svn.openwrt.org/openwrt/trunk@39300 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: Improve ubus supportSteven Barth2013-10-231-1/+1
| | | | | | | | | | * Use network.interface dump call instead of individual status calls to reduce overall netifd lookups and invokes to 1 per fw3 process. * Allow protocol handlers to assign a firewall zone for an interface in the data section to allow for dynamic firewall zone assignment. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38504 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: allow routed lan<->lan traffic by defaultJo-Philipp Wich2013-07-041-1/+1
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@37171 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall3: rename to firewall, move into base system menu, update to git ↵Jo-Philipp Wich2013-06-044-0/+219
| | | | | | head with compatibility fixes for AA git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36838 3c298f89-4303-0410-b956-a3cf2f4a3e73
* Drop legacy firewall packageJo-Philipp Wich2013-06-0416-1903/+0
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36837 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: Remove obsoleted ULA-border ruleSteven Barth2013-05-131-19/+0
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@36622 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: fix logging rule regression (#12999)Jo-Philipp Wich2013-02-221-1/+1
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35745 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: various enhancementsJo-Philipp Wich2013-02-046-96/+132
| | | | | | | | | | | | - reduce mssfix related log spam (#10681) - separate src and dest terminal chains (#11453, #12945) - disable per-zone custom chains by default, they're rarely used Additionally introduce options "device", "subnet", "extra", "extra_src" and "extra_dest" to allow defining zones not related to uci interfaces, e.g. to match "ppp+" or any tcp traffic to and from a specific port. git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35484 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: flush conntrack table after changing interface rulesJo-Philipp Wich2013-01-281-0/+3
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35348 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: Add ULA site border for IPv6 trafficSteven Barth2013-01-041-0/+19
| | | | | | This prevents private traffic from leaking out to the internet git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35012 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: fix typo in reflection hotplug scriptJo-Philipp Wich2012-12-071-1/+1
| | | | git-svn-id: svn://svn.openwrt.org/openwrt/trunk@34569 3c298f89-4303-0410-b956-a3cf2f4a3e73
* firewall: extend nat reflection supportJo-Philipp Wich2012-12-041-85/+122
| | | | | | | | - use comment match to keep track of per-network rules - setup reflection for any interface which is part of a masqueraded zone, not just "wan" - delete per-network reflection rules if network is brought down git-svn-id: svn://svn.openwrt.org/openwrt/trunk@34472 3c298f89-4303-0410-b956-a3cf2f4a3e73
* packages: sort network related packages into package/network/Felix Fietkau2012-10-1016-0/+1827
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@33688 3c298f89-4303-0410-b956-a3cf2f4a3e73
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-07 09:57:05 +0000