4199b216c6
This patch adds a new gluon-ebtables package to filter IGMP/MLD messages via ebtables. For one thing this reduces multicast overhead: About one third of all ICMPv6 multicast traffic in Lübeck or Hamburg is MLD. Furthermore it removes a potential Distributed Denial-of-Service vector (see Gluon ticket #553). Finally, it is a prerequisite for enabling bridge multicast snooping in a decentral and robust fashion. Note that IGMP/MLD are filtered for multicast traffic coming from the mesh, too (new MULTICAST_IN), as unfortunately there seem to be other queriers somewhere in the mesh at least for Freifunk Lübeck. Also adding these rules to be prepared to anyone intentionally or unintentionally disabling these filters on his/her node. Node operators not running Gluon (for instance gateway nodes) should make sure to either enable multicast_router towards bat0 or disable multicast snooping entirely if they have a bridge on top of bat0. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
10 lines
863 B
Plaintext
10 lines
863 B
Plaintext
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 130 -j DROP') -- MLD Query
|
|
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 131 -j DROP') -- MLDv1 Report
|
|
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 132 -j DROP') -- MLDv1 Done
|
|
rule('MULTICAST_OUT_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 143 -j DROP') -- MLDv2 Report
|
|
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 130 -j DROP', 'nat') -- MLD Query
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 131 -j DROP', 'nat') -- MLDv1 Report
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 132 -j DROP', 'nat') -- MLDv1 Done
|
|
rule('MULTICAST_IN_ICMPV6 -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type 143 -j DROP', 'nat') -- MLDv2 Report
|