fish/immortalwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall4: disable ipv6 fullcone nat

Browse Source 
IPv6 fullcone nat based on nft-fullcone will lead to kernel panic rightnow.
This commit is contained in:
ZiMing Mo 2022-05-04 16:18:21 +08:00
parent 0e64bc6216
commit 308317f29a
No known key found for this signature in database
GPG Key ID: 1BED2E3A77AE5ECF
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
package/network/config/firewall4/patches/001-firewall4-add-support-for-fullcone-nat.patch
View File

@ -11,10 +11,10 @@ invalid
Renew: ZiMing Mo <msylgj@immortalwrt.org>
---
root/etc/config/firewall | 1 +
root/usr/share/firewall4/templates/ruleset.uc | 13 +++++-
root/usr/share/firewall4/templates/ruleset.uc | 11 +++++-
.../firewall4/templates/zone-fullcone.uc | 4 ++
root/usr/share/ucode/fw4.uc | 38 ++++++++++++++++++-
4 files changed, 53 insertions(+), 3 deletions(-)
4 files changed, 52 insertions(+), 2 deletions(-)
create mode 100644 root/usr/share/firewall4/templates/zone-fullcone.uc
--- a/root/etc/config/firewall
@ -57,8 +57,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
{% endfor %}
{% endfor %}
{% endif %}
-{% if (zone.masq6): %}
+{% if (zone.masq6 && !fw4.default_option("fullcone")): %}
{% if (zone.masq6): %}
{% for (let saddrs in zone.masq6_src_subnets): %}
{% for (let daddrs in zone.masq6_dest_subnets): %}
{%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %}
@ -76,9 +75,9 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
+++ b/root/usr/share/firewall4/templates/zone-fullcone.uc
@@ -0,0 +1,4 @@
+{# /usr/share/firewall4/templates/zone-fullcone.uc #}
+ fullcone comment "!fw4: Handle {{
+ meta nfproto ipv4 fullcone comment "!fw4: Handle {{
+ zone.name
+}} IPv4/IPv6 fullcone NAT traffic"
+}} IPv4 fullcone NAT traffic"
--- a/root/usr/share/ucode/fw4.uc
+++ b/root/usr/share/ucode/fw4.uc
@@ -1,3 +1,5 @@