fish/immortalwrt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall4: disable fullcone nat on ipv6

Browse Source 
The native ipv6 will be changed to nat6, cause of the fullcone-nat mod.
This commit is contained in:
ZiMing Mo 2022-06-14 11:30:46 +08:00
parent 5830a17418
commit ce3b9cc717
No known key found for this signature in database
GPG Key ID: 1BED2E3A77AE5ECF
1 changed files with 8 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
package/network/config/firewall4/patches/001-firewall4-add-support-for-fullcone-nat.patch
View File

@ -45,7 +45,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
}
{% endif %}
@@ -246,20 +251,24 @@ table inet fw4 {
@@ -246,7 +251,7 @@ table inet fw4 {
{% for (let redirect in fw4.redirects(`srcnat_${zone.name}`)): %}
{%+ include("redirect.uc", { fw4, redirect }) %}
{% endfor %}
@ -54,14 +54,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
{% for (let saddrs in zone.masq4_src_subnets): %}
{% for (let daddrs in zone.masq4_dest_subnets): %}
{%+ include("zone-masq.uc", { fw4, zone, family: 4, saddrs, daddrs }) %}
{% endfor %}
{% endfor %}
{% endif %}
-{% if (zone.masq6): %}
+{% if (zone.masq6 && !fw4.default_option("fullcone")): %}
{% for (let saddrs in zone.masq6_src_subnets): %}
{% for (let daddrs in zone.masq6_dest_subnets): %}
{%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %}
@@ -260,6 +265,10 @@ table inet fw4 {
{% endfor %}
{% endfor %}
{% endif %}
@ -76,9 +69,9 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
+++ b/root/usr/share/firewall4/templates/zone-fullcone.uc
@@ -0,0 +1,4 @@
+{# /usr/share/firewall4/templates/zone-fullcone.uc #}
+ fullcone comment "!fw4: Handle {{
+ meta nfproto ipv4 fullcone comment "!fw4: Handle {{
+ zone.name
+}} IPv4/IPv6 fullcone NAT traffic"
+}} IPv4 fullcone NAT traffic"
--- a/root/usr/share/ucode/fw4.uc
+++ b/root/usr/share/ucode/fw4.uc
@@ -1,3 +1,5 @@
@ -113,7 +106,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
return {
read_kernel_version: function() {
@@ -1383,6 +1404,7 @@ return {
@@ -1377,6 +1398,7 @@ return {
"dnat",
"snat",
"masquerade",
@ -121,7 +114,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
"accept",
"reject",
"drop"
@@ -1802,6 +1824,7 @@ return {
@@ -1800,6 +1822,7 @@ return {
}
let defs = this.parse_options(data, {
@ -129,7 +122,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
input: [ "policy", "drop" ],
output: [ "policy", "drop" ],
forward: [ "policy", "drop" ],
@@ -1834,6 +1857,14 @@ return {
@@ -1832,6 +1855,14 @@ return {
delete defs.syn_flood;
@ -144,7 +137,7 @@ Renew: ZiMing Mo <msylgj@immortalwrt.org>
this.state.defaults = defs;
},
@@ -2058,10 +2089,15 @@ return {
@@ -2056,10 +2087,15 @@ return {
zone.related_subnets = related_subnets;
zone.related_physdevs = related_physdevs;