86 lines
3.4 KiB
Diff
86 lines
3.4 KiB
Diff
|
From: Matthias Schiffer <mschiffer@universe-factory.net>
|
||
|
|
Date: Thu, 12 Apr 2018 17:57:44 +0200
|
||
|
|
Subject: base-files: move netfilter sysctl defaults to specific kmod packages
|
||
|
|
|
||
|
|
Avoid warnings when applying settings for uninstalled kmods. See also
|
||
|
|
FS#1073.
|
||
|
|
|
||
|
|
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
|
||
|
|
|
||
|
|
diff --git a/package/base-files/files/etc/sysctl.d/10-default.conf b/package/base-files/files/etc/sysctl.d/10-default.conf
|
||
|
|
index 7c3344dba339514c023c3b13c592e9ce9ca1ff55..98867b7c7ba1d1ce181f721cdfd17517069fcdf2 100644
|
||
|
|
--- a/package/base-files/files/etc/sysctl.d/10-default.conf
|
||
|
|
+++ b/package/base-files/files/etc/sysctl.d/10-default.conf
|
||
|
|
@@ -20,15 +20,3 @@ net.ipv4.tcp_dsack=1
|
||
|
|
|
||
|
|
net.ipv6.conf.default.forwarding=1
|
||
|
|
net.ipv6.conf.all.forwarding=1
|
||
|
|
-
|
||
|
|
-net.netfilter.nf_conntrack_acct=1
|
||
|
|
-net.netfilter.nf_conntrack_checksum=0
|
||
|
|
-net.netfilter.nf_conntrack_max=16384
|
||
|
|
-net.netfilter.nf_conntrack_tcp_timeout_established=7440
|
||
|
|
-net.netfilter.nf_conntrack_udp_timeout=60
|
||
|
|
-net.netfilter.nf_conntrack_udp_timeout_stream=180
|
||
|
|
-
|
||
|
|
-# disable bridge firewalling by default
|
||
|
|
-net.bridge.bridge-nf-call-arptables=0
|
||
|
|
-net.bridge.bridge-nf-call-ip6tables=0
|
||
|
|
-net.bridge.bridge-nf-call-iptables=0
|
||
|
|
diff --git a/package/kernel/linux/files/sysctl-br-netfilter.conf b/package/kernel/linux/files/sysctl-br-netfilter.conf
|
||
|
|
new file mode 100644
|
||
|
|
index 0000000000000000000000000000000000000000..b10ddc0874b6d393458e646e396716bd67b6b381
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/package/kernel/linux/files/sysctl-br-netfilter.conf
|
||
|
|
@@ -0,0 +1,7 @@
|
||
|
|
+# Do not edit, changes to this file will be lost on upgrades
|
||
|
|
+# /etc/sysctl.conf can be used to customize sysctl settings
|
||
|
|
+
|
||
|
|
+# disable bridge firewalling by default
|
||
|
|
+net.bridge.bridge-nf-call-arptables=0
|
||
|
|
+net.bridge.bridge-nf-call-ip6tables=0
|
||
|
|
+net.bridge.bridge-nf-call-iptables=0
|
||
|
|
diff --git a/package/kernel/linux/files/sysctl-nf-conntrack.conf b/package/kernel/linux/files/sysctl-nf-conntrack.conf
|
||
|
|
new file mode 100644
|
||
|
|
index 0000000000000000000000000000000000000000..37baf5fd6ff9d99d37554f5e38bf1d749a7f21e2
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/package/kernel/linux/files/sysctl-nf-conntrack.conf
|
||
|
|
@@ -0,0 +1,9 @@
|
||
|
|
+# Do not edit, changes to this file will be lost on upgrades
|
||
|
|
+# /etc/sysctl.conf can be used to customize sysctl settings
|
||
|
|
+
|
||
|
|
+net.netfilter.nf_conntrack_acct=1
|
||
|
|
+net.netfilter.nf_conntrack_checksum=0
|
||
|
|
+net.netfilter.nf_conntrack_max=16384
|
||
|
|
+net.netfilter.nf_conntrack_tcp_timeout_established=7440
|
||
|
|
+net.netfilter.nf_conntrack_udp_timeout=60
|
||
|
|
+net.netfilter.nf_conntrack_udp_timeout_stream=180
|
||
|
|
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
|
||
|
|
index 3b26ad1fbf3e261d84ae18216c51c87c53579c06..bb882363f3df4df733424ca6bba72badc96f06f8 100644
|
||
|
|
--- a/package/kernel/linux/modules/netfilter.mk
|
||
|
|
+++ b/package/kernel/linux/modules/netfilter.mk
|
||
|
|
@@ -74,6 +74,11 @@ define KernelPackage/nf-conntrack
|
||
|
|
AUTOLOAD:=$(call AutoProbe,$(notdir $(NF_CONNTRACK-m)))
|
||
|
|
endef
|
||
|
|
|
||
|
|
+define KernelPackage/nf-conntrack/install
|
||
|
|
+ $(INSTALL_DIR) $(1)/etc/sysctl.d
|
||
|
|
+ $(INSTALL_DATA) ./files/sysctl-nf-conntrack.conf $(1)/etc/sysctl.d/11-nf-conntrack.conf
|
||
|
|
+endef
|
||
|
|
+
|
||
|
|
$(eval $(call KernelPackage,nf-conntrack))
|
||
|
|
|
||
|
|
|
||
|
|
@@ -674,6 +679,11 @@ define KernelPackage/br-netfilter
|
||
|
|
AUTOLOAD:=$(call AutoProbe,br_netfilter)
|
||
|
|
endef
|
||
|
|
|
||
|
|
+define KernelPackage/br-netfilter/install
|
||
|
|
+ $(INSTALL_DIR) $(1)/etc/sysctl.d
|
||
|
|
+ $(INSTALL_DATA) ./files/sysctl-br-netfilter.conf $(1)/etc/sysctl.d/11-br-netfilter.conf
|
||
|
|
+endef
|
||
|
|
+
|
||
|
|
$(eval $(call KernelPackage,br-netfilter))
|
||
|
|
|
||
|
|
|