gluon-core: firewall: remove redundant ICMPv6 output rules
OUTPUT is always accepted, no need to allow ICMPv6 explicitly.
This commit is contained in:
		
							parent
							
								
									fe2048e4df
								
							
						
					
					
						commit
						a252383918
					
				| @ -59,26 +59,8 @@ for _, zone in ipairs ({ 'mesh', 'local_client' } ) do | |||||||
| 		target = 'ACCEPT', | 		target = 'ACCEPT', | ||||||
| 	}) | 	}) | ||||||
| 
 | 
 | ||||||
| 	uci:section('firewall', 'rule', zone .. '_ICMPv6_out', { | 	-- Can be removed soon: was never in a release | ||||||
| 		dest = zone, | 	uci:delete('firewall', zone .. '_ICMPv6_out') | ||||||
| 		proto = 'icmp', |  | ||||||
| 		icmp_type = { |  | ||||||
| 			'echo-request', |  | ||||||
| 			'echo-reply', |  | ||||||
| 			'destination-unreachable', |  | ||||||
| 			'packet-too-big', |  | ||||||
| 			'time-exceeded', |  | ||||||
| 			'bad-header', |  | ||||||
| 			'unknown-header-type', |  | ||||||
| 			'router-solicitation', |  | ||||||
| 			'neighbour-solicitation', |  | ||||||
| 			'router-advertisement', |  | ||||||
| 			'neighbour-advertisement', |  | ||||||
| 		}, |  | ||||||
| 		limit = '1000/sec', |  | ||||||
| 		family = 'ipv6', |  | ||||||
| 		target = 'ACCEPT', |  | ||||||
| 	}) |  | ||||||
| end | end | ||||||
| 
 | 
 | ||||||
| uci:save('firewall') | uci:save('firewall') | ||||||
|  | |||||||
		Loading…
	
		Reference in New Issue
	
	Block a user