Differences

This shows you the differences between two versions of the page.

--- linux:firewall [2012/02/21 13:28]
greebo
+++ linux:firewall [2019/04/15 10:18] (current)
zagi
@@ Line 66: / Line 66: @@
 .18.32.0/24"
+# enable IP forwarding (routing!)
 echo "0" > /proc/sys/net/ipv4/ip_forward
+# enable PMTU (mss/mtu discovery)
+echo "1" > /proc/sys/net/ipv4/tcp_mtu_probing
 # first we flush the tables and policy
@@ Line 204: / Line 208: @@
 # echo-reply
 #$IPTB -A INPUT -p icmp --icmp-type 0 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp0 -j ACCEPT
+# unreachables
 $IPTB -A INPUT -p icmp --icmp-type 3 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp3 -j ACCEPT
-$IPTB -A INPUT -p icmp --icmp-type 4 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp4 -j ACCEPT
+# source-quench (depreciated)
+#$IPTB -A INPUT -p icmp --icmp-type 4 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp4 -j ACCEPT
+# timeout (forward loop prevention)
 $IPTB -A INPUT -p icmp --icmp-type 11 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp11 -j ACCEPT
+# parameter problem
 $IPTB -A INPUT -p icmp --icmp-type 12 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp12 -j ACCEPT
 #icmp-traceroute
@@ Line 232: / Line 240: @@
 $IPTB -A FORWARD -m state --state INVALID -j DROP
 $IPTB -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-$IPTB -A FORWARD -m state --state NEW -i ! $INTERNET -j ACCEPT
+$IPTB -A FORWARD -m state --state NEW ! -i $INTERNET -j ACCEPT
 $IPTB -A FORWARD -m pkttype --pkt-type broadcast -j DROP