From patchwork Sat Aug 4 14:34:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [v3,5/8] fff-firewall: Fix match in ip6tables and add dependencies From: Adrian Schmutzler X-Patchwork-Id: 910 Message-Id: <20180804143427.18488-6-freifunk@adrianschmutzler.de> To: franken-dev@freifunk.net Date: Sat, 4 Aug 2018 16:34:24 +0200 The syntax " -m state --state " seems to be not supported anymore. The replace should not change behavior compared to lede-17.01-based firmware. Added required dependency. Signed-off-by: Adrian Schmutzler Reviewed-by: Tim Niemeyer --- src/packages/fff/fff-firewall/Makefile | 5 +++-- src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/packages/fff/fff-firewall/Makefile b/src/packages/fff/fff-firewall/Makefile index 727901d0..e63010cb 100644 --- a/src/packages/fff/fff-firewall/Makefile +++ b/src/packages/fff/fff-firewall/Makefile @@ -1,7 +1,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=fff-firewall -PKG_VERSION:=2 +PKG_VERSION:=3 PKG_RELEASE:=1 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME) @@ -16,7 +16,8 @@ define Package/$(PKG_NAME) DEPENDS:=+arptables \ +ebtables +ebtables-utils \ +kmod-ebtables-ipv4 +kmod-ebtables-ipv6 \ - +iptables-mod-filter +iptables-mod-ipopt +iptables-mod-conntrack-extra + +iptables-mod-filter +iptables-mod-ipopt +iptables-mod-conntrack-extra \ + +kmod-nf-conntrack6 endef define Package/$(PKG_NAME)/description diff --git a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh index d5cc07ac..50fa087b 100644 --- a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh +++ b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh @@ -3,5 +3,5 @@ iptables -A INPUT -i $IF_WAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEP iptables -A INPUT -i $IF_WAN -j REJECT # Limit ssh to 6 new connections per 60 seconds -/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name dropbear -/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 6 --rttl --name dropbear -j DROP +/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name dropbear +/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --rttl --name dropbear -j DROP