diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2016-08-08 16:48:47 +0200 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2016-08-08 16:48:47 +0200 |
| commit | 6818f758fe8b0de9eae45adf4bae91a312cc8f0c (patch) | |
| tree | c9a289855f98c20606bcd4e377cf807a4f6ee9cc | |
| parent | b33f78371e7c7b6a131c2b6c01673cbd4b3c13d1 (diff) | |
| download | firewall3-6818f758fe8b0de9eae45adf4bae91a312cc8f0c.tar.gz | |
zones: allow untracked traffic as well
Now that we only allow ctstate NEW traffic by default we also need to
whitelist traffic explicitely marked by --notrack.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
| -rw-r--r-- | zones.c | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -350,7 +350,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, fw3_ipt_rule_extra(r, zone->extra_src); if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) - fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_extra(r, + "-m conntrack --ctstate NEW,UNTRACKED"); fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name, fw3_flag_names[t]); @@ -363,7 +364,8 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, fw3_ipt_rule_extra(r, zone->extra_dest); if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid) - fw3_ipt_rule_extra(r, "-m conntrack --ctstate NEW"); + fw3_ipt_rule_extra(r, + "-m conntrack --ctstate NEW,UNTRACKED"); fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name, fw3_flag_names[t]); |