firewall: introduce drop_invalid option to allow disabling the invalid state match

SVN-Revision: 14061
This commit is contained in:
Jo-Philipp Wich 2009-01-16 18:09:19 +00:00
parent b693945d4f
commit 83c9ac173d

View File

@ -159,16 +159,19 @@ fw_defaults() {
$IPTABLES -t mangle -X
$IPTABLES -t nat -X
$IPTABLES -X
$IPTABLES -A INPUT -m state --state INVALID -j DROP
config_get_bool drop_invalid $1 drop_invalid 1
[ "$drop_invalid" -gt 0 ] && {
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP
$IPTABLES -A FORWARD -m state --state INVALID -j DROP
}
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -m state --state INVALID -j DROP
$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT