17370d8462
We must ensure that each node becomes IGMP/MLD querier for its local clients; having only a single querier for the whole mesh is generally unreliable, leading to frequent "IGMP/MLD querier appeared/disappeared" messages from batman-adv and unreliable snooping. In smaller meshes it might be interesting only segment querier domains, but allow membership reports to pass through the mesh, in order to support snooping switches outside the mesh without special configuration. A site.conf switch is provided to control this behaviour. Fixes #1320
21 lines
1.2 KiB
Plaintext
21 lines
1.2 KiB
Plaintext
local site = require 'gluon.site'
|
|
|
|
rule('MULTICAST_IN -p IPv4 --ip-protocol igmp --ip-igmp-type membership-query -j DROP', 'nat')
|
|
rule('MULTICAST_OUT -p IPv4 --ip-protocol igmp --ip-igmp-type membership-query -j DROP')
|
|
|
|
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 130 -j DROP') -- MLD Query
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 130 -j DROP', 'nat') -- MLD Query
|
|
|
|
if site.mesh.filter_membership_reports(true) then
|
|
rule('MULTICAST_IN -p IPv4 --ip-protocol igmp -j DROP', 'nat')
|
|
rule('MULTICAST_OUT -p IPv4 --ip-protocol igmp -j DROP')
|
|
|
|
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 131 -j DROP') -- MLDv1 Report
|
|
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 132 -j DROP') -- MLDv1 Done
|
|
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 143 -j DROP') -- MLDv2 Report
|
|
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 131 -j DROP', 'nat') -- MLDv1 Report
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 132 -j DROP', 'nat') -- MLDv1 Done
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 143 -j DROP', 'nat') -- MLDv2 Report
|
|
end
|