fish/immortalwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall: refresh patches

Browse Source
This commit is contained in:
AmadeusGhost 2022-02-08 23:50:40 +08:00
parent eb0e45cb52
commit b4633aecc5
3 changed files with 18 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/network/config/firewall/Makefile
View File

@ -28,7 +28,9 @@ define Package/firewall
SECTION:=net
CATEGORY:=Base system
TITLE:=OpenWrt C Firewall
DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables +kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat +iptables-mod-fullconenat
DEPENDS:=+libubox +libubus +libuci +libip4tc +IPV6:libip6tc +libxtables \
+kmod-ipt-core +kmod-ipt-conntrack +IPV6:kmod-nf-conntrack6 +kmod-ipt-nat \
+iptables-mod-fullconenat
endef
define Package/firewall/description

10
package/network/config/firewall/files/firewall.config
View File

@ -3,7 +3,7 @@ config defaults
option input ACCEPT
option output ACCEPT
option forward REJECT
option fullcone 1
option fullcone 1
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
@ -130,10 +130,10 @@ config rule
option proto udp
option target ACCEPT
# allow interoperability with traceroute classic
# note that traceroute uses a fixed port range, and depends on getting
# back ICMP Unreachables. if we're operating in DROP mode, it won't
# work so we explicitly REJECT packets on these ports.
# Allow interoperability with traceroute classic note that
# traceroute uses a fixed port range, and depends on getting
# back ICMP Unreachables. If we're operating in DROP mode, it
# won't work so we explicitly REJECT packets on these ports.
config rule
option name Support-UDP-Traceroute
option src wan

26
package/network/config/firewall/patches/fullconenat.patch → package/network/config/firewall/patches/0100-fullconenat.patch
View File

@ -1,34 +1,28 @@
index 85a3750..9fac9b1 100644
--- a/defaults.c
+++ b/defaults.c
@@ -46,7 +46,9 @@ const struct fw3_option fw3_flag_opts[] = {
@@ -48,7 +48,9 @@ const struct fw3_option fw3_flag_opts[] = {
FW3_OPT("synflood_protect", bool, defaults, syn_flood),
FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate),
FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
-
+
+ FW3_OPT("fullcone", bool, defaults, fullcone),
+
+
+ FW3_OPT("fullcone", bool, defaults, fullcone),
FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
FW3_OPT("tcp_window_scaling", bool, defaults, tcp_window_scaling),
diff --git a/options.h b/options.h
index 6edd174..c02eb97 100644
--- a/options.h
+++ b/options.h
@@ -267,6 +267,7 @@ struct fw3_defaults
bool drop_invalid;
@@ -296,6 +296,7 @@ struct fw3_defaults
enum fw3_reject_code tcp_reject_code;
enum fw3_reject_code any_reject_code;
bool syn_flood;
+ bool fullcone;
bool syn_flood;
struct fw3_limit syn_flood_rate;
bool tcp_syncookies;
diff --git a/zones.c b/zones.c
index 2aa7473..57eead0 100644
--- a/zones.c
+++ b/zones.c
@@ -627,6 +627,7 @@ print_zone_rule(struct fw3_ipt_handle *h
@@ -670,6 +670,7 @@ print_zone_rule(struct fw3_ipt_handle *h
struct fw3_address *msrc;
struct fw3_address *mdest;
struct fw3_ipt_rule *r;
@ -36,7 +30,7 @@ index 2aa7473..57eead0 100644
if (!fw3_is_family(zone, handle->family))
return;
@@ -712,8 +713,22 @@ print_zone_rule(struct fw3_ipt_handle *h
@@ -755,8 +756,22 @@ print_zone_rule(struct fw3_ipt_handle *h
{
r = fw3_ipt_rule_new(handle);
fw3_ipt_rule_src_dest(r, msrc, mdest);