evolix/minifirewall
21
0
Fork 0
Code Issues 4 Pull requests 3 Releases 1 Activity

It's easier to just accept all icmp

Browse source
This commit is contained in:
Tristan PILAT 2020-10-14 16:49:23 +02:00
parent 79f6d47a6c
commit 5af8fad976
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
minifirewall-start.sh
View file

@ -116,8 +116,7 @@ $NFT add rule inet minifirewall minifirewall_input ip saddr $INTLAN accept
$NFT add rule inet minifirewall minifirewall_input ct state invalid drop
# ICMP and IGMP traffic is accepted
$NFT add rule inet minifirewall minifirewall_input meta l4proto ipv6-icmp icmpv6 accept
$NFT add rule inet minifirewall minifirewall_input meta l4proto icmp icmp accept
$NFT add rule inet minifirewall minifirewall_input ip protocol icmp accept
$NFT add rule inet minifirewall minifirewall_input ip protocol igmp accept
# New UDP traffic from trusted IPs jumps to the private_udp_ports chain