jcarr
/
wit-network-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fixing DHCP6 offer packets on firewall to come through

This commit is contained in:
toby 2018-09-09 23:37:24 +02:00
parent d96371752d
commit 7d30951603
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
files/firewall
View File

@ -41,7 +41,8 @@ case $1 in
ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT # ntp
ip6tables -A INPUT -s fe80::/10 -p tcp --sport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s fe80::/10 -p tcp --dport 179 -j ACCEPT # bgp (allow init as well as responding)
ip6tables -A INPUT -s fe80::/10 -p udp --dport 546 -j ACCEPT # dhcp offers
### mgmt
ip6tables -A INPUT -i mgmt1 -s fe80::/10 -p udp --dport 546 -j ACCEPT # allow dhcp replys
### DROP the rest
ip6tables -P INPUT DROP
@ -56,12 +57,15 @@ case $1 in
ip6tables -t raw -F
ip6tables -t raw -A PREROUTING -j NOTRACK
ip6tables -t raw -A OUTPUT -j NOTRACK
ip6tables -t raw -A PREROUTING ! -i mgmt1 -j NOTRACK
ip6tables -t raw -A OUTPUT ! -o mgmt -j NOTRACK
ip6tables -A INPUT -i mgmt1 -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A INPUT -i mgmt1 -p tcp --dport 22 -j ACCEPT
##### temp rules till we get VRF in place in the factory, just flip the 3 rules below
if ip link show dev mgmt >/dev/null 2>&1; then
iptables -t raw -A PREROUTING ! -i mgmt1 -j NOTRACK
iptables -t raw -A OUTPUT ! -o mgmt -j NOTRACK
iptables -t raw -A OUTPUT ! -o mgmt -j NOTRACK
iptables -A INPUT -i mgmt -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i mgmt -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT
else