From d8ea5c652f81d3b8e31a4206eb68236772709f32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Bl=C3=A4se?= <fabian@blaese.de> Date: Tue, 10 Sep 2019 22:09:01 +0200 Subject: [PATCH] fff-gateway: Add firewall rules to ensure nothing is forwarded onto WAN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fabian Bläse <fabian@blaese.de> Reviewed-by: Christian Dresel <fff@chrisi01.de> Reviewed-by: Robert Langhammer <rlanghammer@web.de> --- .../fff/fff-gateway/files/usr/lib/firewall.d/10-no-forward-wan | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 src/packages/fff/fff-gateway/files/usr/lib/firewall.d/10-no-forward-wan diff --git a/src/packages/fff/fff-gateway/files/usr/lib/firewall.d/10-no-forward-wan b/src/packages/fff/fff-gateway/files/usr/lib/firewall.d/10-no-forward-wan new file mode 100644 index 00000000..f989d6be --- /dev/null +++ b/src/packages/fff/fff-gateway/files/usr/lib/firewall.d/10-no-forward-wan @@ -0,0 +1,3 @@ +# Ensure nothing is forwarded onto WAN interface +iptables -A FORWARD -o $IF_WAN -j REJECT --reject-with icmp-net-unreachable +ip6tables -A FORWARD -o $IF_WAN -j REJECT --reject-with no-route -- GitLab