brielle
/
Firewall-SOSDG
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

master
bruns@2mbit.com 2010-05-15 17:15:39 +00:00
parent 07240dc620
commit 6669bd5a4d
1 changed files with 18 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
rc.firewall
View File

@ -61,13 +61,6 @@ if [ $CLAMPMSS ]; then
$IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed \ $IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed \
-i $i -j ACCEPT -i $i -j ACCEPT
done done
#$IPTABLES -t mangle -o $CLAMPMSS -A FORWARD -p tcp \
# --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 \
# -j TCPMSS --clamp-mss-to-pmtu
#$IPTABLES -t mangle -o $CLAMPMSS -A OUTPUT -p tcp \
# --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 \
# -j TCPMSS --clamp-mss-to-pmtu
fi fi
echo -en "\n" echo -en "\n"
@ -206,11 +199,24 @@ if [ $IPV6 ]; then
if [ $CLAMPMSSIPV6 ]; then if [ $CLAMPMSSIPV6 ]; then
echo "Clamping IPv6 MSS to PMTU..." echo "Clamping IPV6 MSS to PMTU..."
ip6tables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \ for i in $CLAMPMSS; do
--clamp-mss-to-pmtu $IP6TABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
ip6tables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \ -j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
--clamp-mss-to-pmtu --mss 1400:1536
$IP6TABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
--mss 1400:1536
# This is necessary to make sure that PMTU works
$IP6TABLES -A OUTPUT -p icmp --icmp-type time-exceeded \
-o $i -j ACCEPT
$IP6TABLES -A INPUT -p icmp --icmp-type time-exceeded \
-i $i -j ACCEPT
$IP6TABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
-o $i -j ACCEPT
$IP6TABLES -A INPUT -p icmp --icmp-type fragmentation-needed \
-i $i -j ACCEPT
done
fi fi
echo -n "Adding allowed IPv6 port: " echo -n "Adding allowed IPv6 port: "