firewall: introduce drop_invalid option to allow disabling the invalid state match
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@14061 3c298f89-4303-0410-b956-a3cf2f4a3e73master
parent
c2a20b44bd
commit
053133c343
|
@ -160,13 +160,16 @@ fw_defaults() {
|
|||
$IPTABLES -t nat -X
|
||||
$IPTABLES -X
|
||||
|
||||
config_get_bool drop_invalid $1 drop_invalid 1
|
||||
|
||||
[ "$drop_invalid" -gt 0 ] && {
|
||||
$IPTABLES -A INPUT -m state --state INVALID -j DROP
|
||||
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP
|
||||
$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
$IPTABLES -A FORWARD -m state --state INVALID -j DROP
|
||||
}
|
||||
|
||||
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
$IPTABLES -A INPUT -i lo -j ACCEPT
|
||||
|
|
Loading…
Reference in New Issue