From 8e88bb54ba6a806865059ee47c13acb581c05dfb Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 8 Feb 2007 01:25:18 +0000 Subject: [PATCH] port [6229] to kamikaze SVN-Revision: 6275 --- package/iptables/files/firewall.init | 9 +++++++-- target/linux/ar7-2.4/config | 4 ++-- target/linux/aruba-2.6/config | 2 +- target/linux/atheros-2.6/config | 2 +- target/linux/au1000-2.6/config | 2 +- target/linux/brcm-2.4/config | 4 ++-- target/linux/brcm-2.6/config | 2 +- target/linux/brcm47xx-2.6/config | 2 +- target/linux/brcm63xx-2.6/config | 2 +- target/linux/generic-2.6/config-template | 2 +- target/linux/ixp4xx-2.6/config | 2 +- target/linux/magicbox-2.6/config | 2 +- target/linux/pxa-2.6/config | 2 +- target/linux/rb532-2.6/config | 2 +- target/linux/rdc-2.6/config | 2 +- target/linux/sibyte-2.6/config | 2 +- target/linux/uml-2.6/config | 2 +- target/linux/x86-2.6/config | 2 +- 18 files changed, 26 insertions(+), 21 deletions(-) diff --git a/package/iptables/files/firewall.init b/package/iptables/files/firewall.init index a4014f3ee71..290bae1eacc 100755 --- a/package/iptables/files/firewall.init +++ b/package/iptables/files/firewall.init @@ -22,7 +22,8 @@ start() { iptables -N output_rule iptables -N forwarding_rule iptables -N forwarding_wan - + + iptables -t nat -N NEW iptables -t nat -N prerouting_rule iptables -t nat -N prerouting_wan iptables -t nat -N postrouting_rule @@ -99,11 +100,15 @@ start() { # uses the default -P DROP ### MASQ + iptables -t nat -A PREROUTING -m state --state NEW -j NEW iptables -t nat -A PREROUTING -j prerouting_rule [ -z "$WAN" ] || iptables -t nat -A PREROUTING -i "$WAN" -j prerouting_wan iptables -t nat -A POSTROUTING -j postrouting_rule [ -z "$WAN" ] || iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE - + + iptables -t nat -A NEW -m limit --limit 50 --limit-burst 100 -j RETURN && \ + iptables -t nat -A NEW -j DROP + ## USER RULES [ -f /etc/firewall.user ] && . /etc/firewall.user [ -n "$WAN" -a -e /etc/config/firewall ] && { diff --git a/target/linux/ar7-2.4/config b/target/linux/ar7-2.4/config index 1a58465d882..0729197d00a 100644 --- a/target/linux/ar7-2.4/config +++ b/target/linux/ar7-2.4/config @@ -352,7 +352,7 @@ CONFIG_IP_NF_MMS=m CONFIG_IP_NF_RTSP=m CONFIG_IP_NF_QUEUE=m CONFIG_IP_NF_IPTABLES=y -CONFIG_IP_NF_MATCH_LIMIT=m +CONFIG_IP_NF_MATCH_LIMIT=y CONFIG_IP_NF_MATCH_QUOTA=m CONFIG_IP_NF_SET=m CONFIG_IP_NF_SET_MAX=256 @@ -434,7 +434,7 @@ CONFIG_IPV6=m # CONFIG_IP6_NF_QUEUE=m CONFIG_IP6_NF_IPTABLES=m -CONFIG_IP6_NF_MATCH_LIMIT=m +CONFIG_IP6_NF_MATCH_LIMIT=y CONFIG_IP6_NF_MATCH_CONDITION=m CONFIG_IP6_NF_MATCH_MAC=m # CONFIG_IP6_NF_MATCH_RT is not set diff --git a/target/linux/aruba-2.6/config b/target/linux/aruba-2.6/config index debebd146fc..55833fd8140 100644 --- a/target/linux/aruba-2.6/config +++ b/target/linux/aruba-2.6/config @@ -721,7 +721,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/atheros-2.6/config b/target/linux/atheros-2.6/config index 52c4d7a23d3..6852dc6b3bf 100644 --- a/target/linux/atheros-2.6/config +++ b/target/linux/atheros-2.6/config @@ -720,7 +720,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/au1000-2.6/config b/target/linux/au1000-2.6/config index eba8c5eed37..a25ef0477de 100644 --- a/target/linux/au1000-2.6/config +++ b/target/linux/au1000-2.6/config @@ -367,7 +367,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_POLICY=m diff --git a/target/linux/brcm-2.4/config b/target/linux/brcm-2.4/config index 91bd41ac9db..fd52f4dcac8 100644 --- a/target/linux/brcm-2.4/config +++ b/target/linux/brcm-2.4/config @@ -366,7 +366,7 @@ CONFIG_IP_NF_RTSP=m CONFIG_IP_NF_MMS=m CONFIG_IP_NF_QUEUE=m CONFIG_IP_NF_IPTABLES=y -CONFIG_IP_NF_MATCH_LIMIT=m +CONFIG_IP_NF_MATCH_LIMIT=y CONFIG_IP_NF_MATCH_QUOTA=m CONFIG_IP_NF_SET=m CONFIG_IP_NF_SET_MAX=256 @@ -468,7 +468,7 @@ CONFIG_IPV6=m # CONFIG_IP6_NF_QUEUE=m CONFIG_IP6_NF_IPTABLES=m -CONFIG_IP6_NF_MATCH_LIMIT=m +CONFIG_IP6_NF_MATCH_LIMIT=y CONFIG_IP6_NF_MATCH_CONDITION=m CONFIG_IP6_NF_MATCH_MAC=m # CONFIG_IP6_NF_MATCH_RT is not set diff --git a/target/linux/brcm-2.6/config b/target/linux/brcm-2.6/config index 7e5e4a09228..e392959186f 100644 --- a/target/linux/brcm-2.6/config +++ b/target/linux/brcm-2.6/config @@ -377,7 +377,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_POLICY=m diff --git a/target/linux/brcm47xx-2.6/config b/target/linux/brcm47xx-2.6/config index e55b2af3265..6c682551aa1 100644 --- a/target/linux/brcm47xx-2.6/config +++ b/target/linux/brcm47xx-2.6/config @@ -708,7 +708,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/brcm63xx-2.6/config b/target/linux/brcm63xx-2.6/config index a23233d5652..eaadc3a8497 100644 --- a/target/linux/brcm63xx-2.6/config +++ b/target/linux/brcm63xx-2.6/config @@ -422,7 +422,7 @@ CONFIG_NETFILTER_XT_MATCH_DCCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_POLICY=m diff --git a/target/linux/generic-2.6/config-template b/target/linux/generic-2.6/config-template index 58097ae7672..b1326347fae 100644 --- a/target/linux/generic-2.6/config-template +++ b/target/linux/generic-2.6/config-template @@ -575,7 +575,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/ixp4xx-2.6/config b/target/linux/ixp4xx-2.6/config index e28bf9114eb..80253904226 100644 --- a/target/linux/ixp4xx-2.6/config +++ b/target/linux/ixp4xx-2.6/config @@ -336,7 +336,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_PORTSCAN=m diff --git a/target/linux/magicbox-2.6/config b/target/linux/magicbox-2.6/config index b99a265a458..17829ac1316 100644 --- a/target/linux/magicbox-2.6/config +++ b/target/linux/magicbox-2.6/config @@ -682,7 +682,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/pxa-2.6/config b/target/linux/pxa-2.6/config index ba94adcd654..86c05d0a19e 100644 --- a/target/linux/pxa-2.6/config +++ b/target/linux/pxa-2.6/config @@ -308,7 +308,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/rb532-2.6/config b/target/linux/rb532-2.6/config index dd2bac26e55..092419e9271 100644 --- a/target/linux/rb532-2.6/config +++ b/target/linux/rb532-2.6/config @@ -648,7 +648,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/rdc-2.6/config b/target/linux/rdc-2.6/config index 04b8d703c6f..c27522c9394 100644 --- a/target/linux/rdc-2.6/config +++ b/target/linux/rdc-2.6/config @@ -379,7 +379,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_POLICY=m diff --git a/target/linux/sibyte-2.6/config b/target/linux/sibyte-2.6/config index 89f7289d6f3..6eb45fab971 100644 --- a/target/linux/sibyte-2.6/config +++ b/target/linux/sibyte-2.6/config @@ -345,7 +345,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y # CONFIG_NETFILTER_XT_MATCH_DCCP is not set CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_POLICY=m diff --git a/target/linux/uml-2.6/config b/target/linux/uml-2.6/config index fd1eb57b3b7..bfffff47afd 100644 --- a/target/linux/uml-2.6/config +++ b/target/linux/uml-2.6/config @@ -634,7 +634,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y diff --git a/target/linux/x86-2.6/config b/target/linux/x86-2.6/config index 2d7cd564df9..154275dd687 100644 --- a/target/linux/x86-2.6/config +++ b/target/linux/x86-2.6/config @@ -831,7 +831,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m CONFIG_NETFILTER_XT_MATCH_ESP=m CONFIG_NETFILTER_XT_MATCH_HELPER=m CONFIG_NETFILTER_XT_MATCH_LENGTH=m -CONFIG_NETFILTER_XT_MATCH_LIMIT=m +CONFIG_NETFILTER_XT_MATCH_LIMIT=y CONFIG_NETFILTER_XT_MATCH_MAC=m CONFIG_NETFILTER_XT_MATCH_MARK=m CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y -- 2.30.2