nils/gluon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gluon-core: Firewall: allow Multicast Listener Query/Report/Done on mesh and client zone

Browse Source
This commit is contained in:
Christof Schulze 2017-12-26 13:59:27 +01:00
parent ab16cea161
commit 047c2cae6f
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
View File

@ -15,7 +15,6 @@ end
uci:foreach('firewall', 'zone', reject_input_on_wan) uci:foreach('firewall', 'zone', reject_input_on_wan)
-- the client zone is set up by gluon-client-bridge -- the client zone is set up by gluon-client-bridge
--
uci:section('firewall', 'zone', 'mesh', { uci:section('firewall', 'zone', 'mesh', {
name = 'mesh', name = 'mesh',
network = {}, network = {},
@ -35,13 +34,12 @@ for _, zone in ipairs({ 'wan', 'local_client', 'mesh' }) do
}) })
end end
-- allow icmp in/out on all relevant zones
-- allow icmp in/out/forward on all relevant zones
for _, zone in ipairs ({ 'mesh', 'local_client' } ) do for _, zone in ipairs ({ 'mesh', 'local_client' } ) do
uci:section('firewall', 'rule', zone .. '_ICMPv6_in', { uci:section('firewall', 'rule', zone .. '_ICMPv6_in', {
src = zone, src = zone,
proto = 'icmp', proto = 'icmp',
icmp_type = {'echo-request', 'echo-reply', 'destination-unreachable', 'packet-too-big', 'time-exceeded', 'bad-header', 'unknown-header-type', 'router-solicitation', 'neighbour-solicitation', 'router-advertisement', 'neighbour-advertisement', }, icmp_type = {'echo-request', 'echo-reply', 'destination-unreachable', 'packet-too-big', 'time-exceeded', 'bad-header', 'unknown-header-type', 'router-solicitation', 'neighbour-solicitation', 'router-advertisement', 'neighbour-advertisement', '130/0', '131/0', '132/0' },
limit = '1000/sec', limit = '1000/sec',
family = 'ipv6', family = 'ipv6',
target = 'ACCEPT', target = 'ACCEPT',
@ -50,7 +48,7 @@ for _, zone in ipairs ({ 'mesh', 'local_client' } ) do
uci:section('firewall', 'rule', zone .. '_ICMPv6_out', { uci:section('firewall', 'rule', zone .. '_ICMPv6_out', {
dest = zone, dest = zone,
proto = 'icmp', proto = 'icmp',
icmp_type = {'echo-request', 'echo-reply', 'destination-unreachable', 'packet-too-big', 'time-exceeded', 'bad-header', 'unknown-header-type', 'router-solicitation', 'neighbour-solicitation', 'router-advertisement', 'neighbour-advertisement' }, icmp_type = {'echo-request', 'echo-reply', 'destination-unreachable', 'packet-too-big', 'time-exceeded', 'bad-header', 'unknown-header-type', 'router-solicitation', 'neighbour-solicitation', 'router-advertisement', 'neighbour-advertisement', '130/0', '131/0', '132/0' },
limit = '1000/sec', limit = '1000/sec',
family = 'ipv6', family = 'ipv6',
target = 'ACCEPT', target = 'ACCEPT',