2023-05-01 19:25:33 +00:00
|
|
|
gluon-nftables-source-filter
|
2017-04-09 16:18:51 +00:00
|
|
|
============================
|
|
|
|
|
|
2023-05-01 19:25:33 +00:00
|
|
|
The *gluon-nftables-source-filter* package adds an additional layer-2 filter
|
2017-04-09 16:18:51 +00:00
|
|
|
ruleset to prevent unreasonable traffic entering the network via the nodes.
|
|
|
|
|
Unreasonable means traffic entering the mesh via a node which source IP does
|
|
|
|
|
not belong to the configured IP space.
|
|
|
|
|
|
2017-12-27 20:48:21 +00:00
|
|
|
You may first check if there is a certain proportion of unreasonable traffic,
|
|
|
|
|
before adding this package to the firmware image. Furthermore, you should not
|
2017-04-09 16:18:51 +00:00
|
|
|
use this package if some kind of gateway or upstream network is provided by
|
|
|
|
|
a device connected to the client port.
|
|
|
|
|
|
|
|
|
|
site.conf
|
|
|
|
|
---------
|
|
|
|
|
|
|
|
|
|
prefix4 : optional
|
|
|
|
|
- IPv4 subnet
|
|
|
|
|
|
|
|
|
|
prefix6 :
|
|
|
|
|
- IPv6 subnet
|
|
|
|
|
|
|
|
|
|
extra_prefixes6 : optional
|
|
|
|
|
- list of additional IPv6 subnets
|
|
|
|
|
|
|
|
|
|
Example::
|
|
|
|
|
|
|
|
|
|
prefix4 = '198.51.100.0/21',
|
|
|
|
|
prefix6 = '2001:db8:8::/64',
|
2017-12-27 20:48:21 +00:00
|
|
|
extra_prefixes6 = {
|
|
|
|
|
'2001:db8:9::/64',
|
|
|
|
|
'2001:db8:100::/60',
|
|
|
|
|
},
|
