diff options
| author | Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi> | 2012-09-03 09:42:35 +0000 |
|---|---|---|
| committer | Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi> | 2012-09-03 09:53:28 +0000 |
| commit | 1aab0c8ff06412bc2f7b579355adcb6845776c35 (patch) | |
| tree | d9be7aaea7563caf0c577967b010d051ad80e680 /awall | |
| parent | 579e16a5d6f6f7a626dc7f514792f8f4bdf16316 (diff) | |
| download | awall-1aab0c8ff06412bc2f7b579355adcb6845776c35.tar.bz2 awall-1aab0c8ff06412bc2f7b579355adcb6845776c35.tar.xz | |
allow routing-related ICMP messages by default
Diffstat (limited to 'awall')
| -rw-r--r-- | awall/modules/filter.lua | 31 |
1 files changed, 24 insertions, 7 deletions
diff --git a/awall/modules/filter.lua b/awall/modules/filter.lua index a37e497..733263f 100644 --- a/awall/modules/filter.lua +++ b/awall/modules/filter.lua @@ -185,7 +185,9 @@ classes = {{'log', Log}, defrules = {} -local dar = combinations({{chain='FORWARD'}, {chain='INPUT'}, {chain='OUTPUT'}}, +local fchains = {{chain='FORWARD'}, {chain='INPUT'}, {chain='OUTPUT'}} + +local dar = combinations(fchains, {{opts='-m state --state RELATED,ESTABLISHED'}}) for i, chain in ipairs({'INPUT', 'OUTPUT'}) do table.insert(dar, @@ -196,12 +198,27 @@ defrules.pre = combinations(dar, {{table='filter', target='ACCEPT'}}, {{family='inet'}, {family='inet6'}}) -defrules['post-filter'] = combinations({{family='inet6', - table='filter', - opts='-p icmpv6', - target='ACCEPT'}}, - {{chain='INPUT'}, {chain='OUTPUT'}}) - +local icmp = {{family='inet', table='filter', opts='-p icmp'}} +local icmp6 = {{family='inet6', table='filter', opts='-p icmpv6'}} +defrules['post-filter'] = combinations(icmp6, + {{chain='INPUT'}, {chain='OUTPUT'}}, + {{target='ACCEPT'}}) +extend(defrules['post-filter'], + combinations(icmp6, {{chain='FORWARD', target='icmp-routing'}})) +extend(defrules['post-filter'], + combinations(icmp, fchains, {{target='icmp-routing'}})) + +local function icmprules(ofrag, oname, types) + extend(defrules['post-filter'], + combinations(ofrag, + {{chain='icmp-routing', target='ACCEPT'}}, + util.map(types, + function(t) + return {opts='--'..oname..' '..t} + end))) +end +icmprules(icmp, 'icmp-type', {3, 11, 12}) +icmprules(icmp6, 'icmpv6-type', {1, 2, 3, 4}) achains = combinations({{chain='tarpit'}}, {{opts='-p tcp', target='TARPIT'}, |