aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2007-02-08 01:25:18 +0000
committerFelix Fietkau <nbd@openwrt.org>2007-02-08 01:25:18 +0000
commitdc4d1dd12a9168cd49db359cde517f5dc181bfe6 (patch)
treed46b6bfdff0a783da768660baef6ad0bdb90373e
parent74f4d3ee6d2cb306a5e8c4aedddb974637af1880 (diff)
downloadupstream-dc4d1dd12a9168cd49db359cde517f5dc181bfe6.tar.gz
upstream-dc4d1dd12a9168cd49db359cde517f5dc181bfe6.tar.bz2
upstream-dc4d1dd12a9168cd49db359cde517f5dc181bfe6.zip
port [6229] to kamikaze
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@6275 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat
-rwxr-xr-xpackage/iptables/files/firewall.init9
-rw-r--r--target/linux/ar7-2.4/config4
-rw-r--r--target/linux/aruba-2.6/config2
-rw-r--r--target/linux/atheros-2.6/config2
-rw-r--r--target/linux/au1000-2.6/config2
-rw-r--r--target/linux/brcm-2.4/config4
-rw-r--r--target/linux/brcm-2.6/config2
-rw-r--r--target/linux/brcm47xx-2.6/config2
-rw-r--r--target/linux/brcm63xx-2.6/config2
-rw-r--r--target/linux/generic-2.6/config-template2
-rw-r--r--target/linux/ixp4xx-2.6/config2
-rw-r--r--target/linux/magicbox-2.6/config2
-rw-r--r--target/linux/pxa-2.6/config2
-rw-r--r--target/linux/rb532-2.6/config2
-rw-r--r--target/linux/rdc-2.6/config2
-rw-r--r--target/linux/sibyte-2.6/config2
-rw-r--r--target/linux/uml-2.6/config2
-rw-r--r--target/linux/x86-2.6/config2
18 files changed, 26 insertions, 21 deletions
diff --git a/package/iptables/files/firewall.init b/package/iptables/files/firewall.init
index a4014f3ee7..290bae1eac 100755
--- a/package/iptables/files/firewall.init
+++ b/package/iptables/files/firewall.init
@@ -22,7 +22,8 @@ start() {
iptables -N output_rule
iptables -N forwarding_rule
iptables -N forwarding_wan
-
+
+ iptables -t nat -N NEW
iptables -t nat -N prerouting_rule
iptables -t nat -N prerouting_wan
iptables -t nat -N postrouting_rule
@@ -99,11 +100,15 @@ start() {
# uses the default -P DROP
### MASQ
+ iptables -t nat -A PREROUTING -m state --state NEW -j NEW
iptables -t nat -A PREROUTING -j prerouting_rule
[ -z "$WAN" ] || iptables -t nat -A PREROUTING -i "$WAN" -j prerouting_wan
iptables -t nat -A POSTROUTING -j postrouting_rule
[ -z "$WAN" ] || iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
-
+
+ iptables -t nat -A NEW -m limit --limit 50 --limit-burst 100 -j RETURN && \
+ iptables -t nat -A NEW -j DROP
+
## USER RULES
[ -f /etc/firewall.user ] && . /etc/firewall.user
[ -n "$WAN" -a -e /etc/config/firewall ] && {
diff --git a/target/linux/ar7-2.4/config b/target/linux/ar7-2.4/config
index 1a58465d88..0729197d00 100644
--- a/target/linux/ar7-2.4/config
+++ b/target/linux/ar7-2.4/config
@@ -352,7 +352,7 @@ CONFIG_IP_NF_MMS=m
CONFIG_IP_NF_RTSP=m
CONFIG_IP_NF_QUEUE=m
CONFIG_IP_NF_IPTABLES=y
-CONFIG_IP_NF_MATCH_LIMIT=m
+CONFIG_IP_NF_MATCH_LIMIT=y
CONFIG_IP_NF_MATCH_QUOTA=m
CONFIG_IP_NF_SET=m
CONFIG_IP_NF_SET_MAX=256
@@ -434,7 +434,7 @@ CONFIG_IPV6=m
#
CONFIG_IP6_NF_QUEUE=m
CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_LIMIT=m
+CONFIG_IP6_NF_MATCH_LIMIT=y
CONFIG_IP6_NF_MATCH_CONDITION=m
CONFIG_IP6_NF_MATCH_MAC=m
# CONFIG_IP6_NF_MATCH_RT is not set
diff --git a/target/linux/aruba-2.6/config b/target/linux/aruba-2.6/config
index debebd146f..55833fd814 100644
--- a/target/linux/aruba-2.6/config
+++ b/target/linux/aruba-2.6/config
@@ -721,7 +721,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/atheros-2.6/config b/target/linux/atheros-2.6/config
index 52c4d7a23d..6852dc6b3b 100644
--- a/target/linux/atheros-2.6/config
+++ b/target/linux/atheros-2.6/config
@@ -720,7 +720,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/au1000-2.6/config b/target/linux/au1000-2.6/config
index eba8c5eed3..a25ef0477d 100644
--- a/target/linux/au1000-2.6/config
+++ b/target/linux/au1000-2.6/config
@@ -367,7 +367,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
diff --git a/target/linux/brcm-2.4/config b/target/linux/brcm-2.4/config
index 91bd41ac9d..fd52f4dcac 100644
--- a/target/linux/brcm-2.4/config
+++ b/target/linux/brcm-2.4/config
@@ -366,7 +366,7 @@ CONFIG_IP_NF_RTSP=m
CONFIG_IP_NF_MMS=m
CONFIG_IP_NF_QUEUE=m
CONFIG_IP_NF_IPTABLES=y
-CONFIG_IP_NF_MATCH_LIMIT=m
+CONFIG_IP_NF_MATCH_LIMIT=y
CONFIG_IP_NF_MATCH_QUOTA=m
CONFIG_IP_NF_SET=m
CONFIG_IP_NF_SET_MAX=256
@@ -468,7 +468,7 @@ CONFIG_IPV6=m
#
CONFIG_IP6_NF_QUEUE=m
CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_LIMIT=m
+CONFIG_IP6_NF_MATCH_LIMIT=y
CONFIG_IP6_NF_MATCH_CONDITION=m
CONFIG_IP6_NF_MATCH_MAC=m
# CONFIG_IP6_NF_MATCH_RT is not set
diff --git a/target/linux/brcm-2.6/config b/target/linux/brcm-2.6/config
index 7e5e4a0922..e392959186 100644
--- a/target/linux/brcm-2.6/config
+++ b/target/linux/brcm-2.6/config
@@ -377,7 +377,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
diff --git a/target/linux/brcm47xx-2.6/config b/target/linux/brcm47xx-2.6/config
index e55b2af326..6c682551aa 100644
--- a/target/linux/brcm47xx-2.6/config
+++ b/target/linux/brcm47xx-2.6/config
@@ -708,7 +708,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/brcm63xx-2.6/config b/target/linux/brcm63xx-2.6/config
index a23233d565..eaadc3a849 100644
--- a/target/linux/brcm63xx-2.6/config
+++ b/target/linux/brcm63xx-2.6/config
@@ -422,7 +422,7 @@ CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
diff --git a/target/linux/generic-2.6/config-template b/target/linux/generic-2.6/config-template
index 58097ae767..b1326347fa 100644
--- a/target/linux/generic-2.6/config-template
+++ b/target/linux/generic-2.6/config-template
@@ -575,7 +575,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/ixp4xx-2.6/config b/target/linux/ixp4xx-2.6/config
index e28bf9114e..8025390422 100644
--- a/target/linux/ixp4xx-2.6/config
+++ b/target/linux/ixp4xx-2.6/config
@@ -336,7 +336,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_PORTSCAN=m
diff --git a/target/linux/magicbox-2.6/config b/target/linux/magicbox-2.6/config
index b99a265a45..17829ac131 100644
--- a/target/linux/magicbox-2.6/config
+++ b/target/linux/magicbox-2.6/config
@@ -682,7 +682,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/pxa-2.6/config b/target/linux/pxa-2.6/config
index ba94adcd65..86c05d0a19 100644
--- a/target/linux/pxa-2.6/config
+++ b/target/linux/pxa-2.6/config
@@ -308,7 +308,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/rb532-2.6/config b/target/linux/rb532-2.6/config
index dd2bac26e5..092419e927 100644
--- a/target/linux/rb532-2.6/config
+++ b/target/linux/rb532-2.6/config
@@ -648,7 +648,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/rdc-2.6/config b/target/linux/rdc-2.6/config
index 04b8d703c6..c27522c939 100644
--- a/target/linux/rdc-2.6/config
+++ b/target/linux/rdc-2.6/config
@@ -379,7 +379,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
diff --git a/target/linux/sibyte-2.6/config b/target/linux/sibyte-2.6/config
index 89f7289d6f..6eb45fab97 100644
--- a/target/linux/sibyte-2.6/config
+++ b/target/linux/sibyte-2.6/config
@@ -345,7 +345,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
diff --git a/target/linux/uml-2.6/config b/target/linux/uml-2.6/config
index fd1eb57b3b..bfffff47af 100644
--- a/target/linux/uml-2.6/config
+++ b/target/linux/uml-2.6/config
@@ -634,7 +634,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
diff --git a/target/linux/x86-2.6/config b/target/linux/x86-2.6/config
index 2d7cd564df..154275dd68 100644
--- a/target/linux/x86-2.6/config
+++ b/target/linux/x86-2.6/config
@@ -831,7 +831,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-15 17:54:35 +0000