From f80fb45dc24b042ca4f180999780031c8dcddd4c Mon Sep 17 00:00:00 2001
From: jow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73>
Date: Sun, 14 Aug 2011 00:33:29 +0000
Subject: [PATCH] [package] firewall: further tune ICMPv6 default rules
 according to RFC4890 (#9893)

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27979 3c298f89-4303-0410-b956-a3cf2f4a3e73
---
 package/firewall/Makefile                 |  2 +-
 package/firewall/files/firewall.config    | 16 ++++++++++++++++
 package/firewall/files/reflection.hotplug |  2 +-
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index cdb8dc6224..b192ad330e 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=2
-PKG_RELEASE:=33
+PKG_RELEASE:=34
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/firewall/files/firewall.config b/package/firewall/files/firewall.config
index b47823fe2d..5a5dfd0186 100644
--- a/package/firewall/files/firewall.config
+++ b/package/firewall/files/firewall.config
@@ -44,6 +44,22 @@ config rule
 	option target		ACCEPT
 
 # Allow essential incoming IPv6 ICMP traffic
+config rule
+	option src		wan
+	option proto	icmp
+	list icmp_type		echo-request
+	list icmp_type		destination-unreachable
+	list icmp_type		packet-too-big
+	list icmp_type		time-exceeded
+	list icmp_type		bad-header
+	list icmp_type		unknown-header-type
+	list icmp_type		router-solicitation
+	list icmp_type		neighbour-solicitation
+	option limit		1000/sec
+	option family		ipv6
+	option target		ACCEPT
+
+# Allow essential forwarded IPv6 ICMP traffic
 config rule                                   
 	option src		wan
 	option dest		*
diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug
index 15e350082a..1feb21075a 100644
--- a/package/firewall/files/reflection.hotplug
+++ b/package/firewall/files/reflection.hotplug
@@ -102,7 +102,7 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 				local p
 				for p in ${proto:-tcp udp}; do
 					case "$p" in
-						tcp|udp)
+						tcp|udp|6|17)
 							iptables -t nat -A nat_reflection_in \
 								-s $lanip/$lanmk -d $exthost \
 								-p $p $extport \
-- 
2.11.0