From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 1/6] firewall: Split CONNTRACK chain Date: Thu, 18 Apr 2024 21:11:39 +0000 Message-ID: <20240418211144.3318938-1-michael.tremer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============4416572787266442198==" List-Id: --===============4416572787266442198== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit This is preparation to handle incoming/outgoing packets differently. Signed-off-by: Michael Tremer --- src/initscripts/system/firewall | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 69bdcb594..d14466ef0 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -149,10 +149,15 @@ iptables_init() { fi iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID" - iptables -N CONNTRACK - iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT - iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID - iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT + iptables -N CTINPUT + iptables -A CTINPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT + iptables -A CTINPUT -m conntrack --ctstate INVALID -j CTINVALID + iptables -A CTINPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT + + iptables -N CTOUTPUT + iptables -A CTOUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT + iptables -A CTOUTPUT -m conntrack --ctstate INVALID -j CTINVALID + iptables -A CTOUTPUT -p icmp -m conntrack --ctstate RELATED -j ACCEPT # Restore any connection marks iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark @@ -261,9 +266,9 @@ iptables_init() { done # Accept everything connected - for i in INPUT FORWARD OUTPUT; do - iptables -A ${i} -j CONNTRACK - done + iptables -A INPUT -j CTINPUT + iptables -A FORWARD -j CTINPUT + iptables -A OUTPUT -j CTOUTPUT # Allow DHCP iptables -N DHCPINPUT -- 2.39.2 --===============4416572787266442198==--