crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall6] on rajoute l'ingress filtering

Browse source 
Ignore-this: 70bb869f58f85e481e7a8329fcf80e06

darcs-hash:20110308203846-8fbb1-a2688cf00d420dc48de79c6cb5e22415d43e17f1.gz
This commit is contained in:
Olivier Huber 2011-03-08 21:38:46 +01:00
parent acef69c7da
commit 7a6a840c0f
2 changed files with 27 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
gestion/gen_confs/firewall6.py
View file

@ -135,6 +135,12 @@ def main_router():
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j \
ACCEPT')
# On filtre les réseaux non routable et aussi on accepte en entrée
# que les paquets dont la source n'est pas notre plage, pour éviter
# http://travaux.ovh.net/?do=details&id=5183
ingress_filtering(ip6tables)
ip6tables.filter.forward('-j INGRESS_FILTERING')
# Pour les autres connections
for type_m in [i for i in ['fil', 'fil-v6'] if not 'v6' in i]: