diff --git a/ChangeLog b/ChangeLog index f6fb1ab..d9f7e50 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,6 @@ 0.8 - Brielle Bruns - IPv6 Connection Tracking fixes + - Strip ECN off of specific outbound packets 0.7 - Brielle Bruns - MSS Clamp on IPv6 diff --git a/options.default b/options.default index c1858c2..e127f27 100755 --- a/options.default +++ b/options.default @@ -60,6 +60,10 @@ NATEXTIF="eth0" # IP Ranges to block all traffic incoming/outgoing BLOCKEDIP=$BASEDIR/blocked +# Strip ECN off of packets - helps with blackholes +# Either individual IPs or 0.0.0.0/0 +STRIPECN="0.0.0.0/0" + # IPv6 related features. Commenting out IPV6 variable disables ALL # IPv6 related items diff --git a/rc.firewall b/rc.firewall index 6327998..aa71c43 100755 --- a/rc.firewall +++ b/rc.firewall @@ -44,6 +44,16 @@ if [ $BLOCKEDIP ]; then echo -ne "\n" fi +if [ "$STRIPECN" ]; then + for i in $STRIPECN; do + echo "Stripping ECN off of TCP packets to $i" + $IPTABLES -A PREROUTING -t mangle -p tcp -d $i -j ECN \ + --ecn-remove 1 + done +echo -ne "\n" +fi + + if [ "$CLAMPMSS" ]; then echo "Clamping MSS to PMTU..." for i in $CLAMPMSS; do