c5ce1525e6
Filter IGMP/MLD messges so that we can have an IGMP/MLD querier per node. Segmenting the IGMP/MLD domain on a per node basis allows us to *not* rely on a central querier (on a gateway for instance) to take advantage of multicast snooping. Even though we receive no more reports from other nodes anymore then, the "multicast_router" bridge port setting will ensure to always forward multicast packets towards bat0 (unless filtered by another ebtables rule). Note that IGMP/MLD are filtered for multicast traffic coming from the mesh, too (new MULTICAST_IN), as unfortunately there seem to be other queriers somewhere in the mesh at least for Freifunk Lübeck. Such queriers would potentially confuse / silence the querier on a node. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
77 lines
1.5 KiB
Bash
Executable File
77 lines
1.5 KiB
Bash
Executable File
#!/bin/sh /etc/rc.common
|
|
# Copyright (C) 2013 Project Gluon
|
|
#
|
|
# Firewall script for inserting and removing ebtables rules.
|
|
#
|
|
# Example format, for filtering any IPv4 multicast packets to the SSDP UDP port:
|
|
# rule FORWARD --logical-out br-client -d Multicast -p IPv4 --ip-protocol udp --ip-destination-port 5355 -j DROP
|
|
#
|
|
# Removing all rules:
|
|
# $ ./firewall-ebtables stop
|
|
# Inserting all rules:
|
|
# $ ./firewall-ebtables start
|
|
# Inserting a specific rule file:
|
|
# $ ./firewall-ebtables start /lib/gluon/ebtables/100-mcast-chain
|
|
# Removing a specific rule file:
|
|
# $ ./firewall-ebtables stop /lib/gluon/ebtables/100-mcast-chain
|
|
|
|
|
|
START=19
|
|
STOP=91
|
|
|
|
|
|
exec_file() {
|
|
local file="$1"
|
|
|
|
/usr/bin/lua -e "
|
|
function rule(command, table)
|
|
table = table or 'filter'
|
|
os.execute($EBTABLES_RULE)
|
|
end
|
|
function chain(name, policy, table)
|
|
table = table or 'filter'
|
|
os.execute($EBTABLES_CHAIN)
|
|
end
|
|
|
|
" "$file"
|
|
}
|
|
|
|
exec_all() {
|
|
local sort_arg="$1"
|
|
|
|
local old_ifs="$IFS"
|
|
IFS='
|
|
'
|
|
for file in `find /lib/gluon/ebtables -type f | sort $sort_arg`; do
|
|
exec_file "$file"
|
|
done
|
|
IFS="$old_ifs"
|
|
}
|
|
|
|
|
|
start() {
|
|
(
|
|
export EBTABLES_RULE='"ebtables -t " .. table .. " -A " .. command'
|
|
export EBTABLES_CHAIN='"ebtables -t " .. table .. " -N " .. name .. " -P " .. policy'
|
|
|
|
if [ -z "$1" ]; then
|
|
exec_all ''
|
|
else
|
|
exec_file "$1"
|
|
fi
|
|
)
|
|
}
|
|
|
|
stop() {
|
|
(
|
|
export EBTABLES_RULE='"ebtables -t " .. table .. " -D " .. command'
|
|
export EBTABLES_CHAIN='"ebtables -t " .. table .. " -X " .. name'
|
|
|
|
if [ -z "$1" ]; then
|
|
exec_all '-r'
|
|
else
|
|
exec_file "$1"
|
|
fi
|
|
)
|
|
}
|