projects / project / firewall3.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 47b2394) | patch
zones: restrict default ACCEPT rules to NEW ctstate
authorJo-Philipp Wich <jo@mein.io>
Mon, 8 Aug 2016 13:52:28 +0000 (15:52 +0200)
committerJo-Philipp Wich <jo@mein.io>
Mon, 8 Aug 2016 14:16:04 +0000 (16:16 +0200)
commit6009904eb4dfe91e3d0b5cb96c4095232a303835
tree5e34398dc80b2632aeea2138acfaf693831f7737tree | snapshot
parent47b23946cb2d51c486cd01596744955f850e2060commit | diff
zones: restrict default ACCEPT rules to NEW ctstate

Restrict the per-zone default accept rules to only accept streams with
conntrack state NEW when drop_invalid is disabled.

This commit hardens the firewall in order to allow disabling drop_invalid
by default since ctstate INVALID also matches desired traffic like IPv6
neighbour discovery messages.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
zones.c diff | blob | history
OpenWrt firewall configuration utility