diff options
| author | mbm <mbm@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2005-02-06 00:52:16 +0000 |
|---|---|---|
| committer | mbm <mbm@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2005-02-06 00:52:16 +0000 |
| commit | 6fa165042b07cbb6ff52d2439e79d8ffe17be4ab (patch) | |
| tree | e27ce18c541d0166fa93d2d596091036835321b0 /openwrt/target/default/target_skeleton/etc/init.d/S45firewall | |
| parent | b7edba48e2818e1d302f385c1757feca86353366 (diff) | |
openwrt root filesystem
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@211 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'openwrt/target/default/target_skeleton/etc/init.d/S45firewall')
| -rwxr-xr-x | openwrt/target/default/target_skeleton/etc/init.d/S45firewall | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/openwrt/target/default/target_skeleton/etc/init.d/S45firewall b/openwrt/target/default/target_skeleton/etc/init.d/S45firewall new file mode 100755 index 000000000..49b9df000 --- /dev/null +++ b/openwrt/target/default/target_skeleton/etc/init.d/S45firewall @@ -0,0 +1,23 @@ +#!/bin/sh +. /etc/functions.sh + +WAN=$(nvram get wan_ifname) + +IPT=/usr/sbin/iptables + +for T in filter nat mangle ; do + $IPT -t $T -F + $IPT -t $T -X +done + +$IPT -t filter -A INPUT -m state --state INVALID -j DROP +$IPT -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -t filter -A INPUT -p icmp -j ACCEPT +$IPT -t filter -A INPUT -i $WAN -p tcp -j REJECT --reject-with tcp-reset +$IPT -t filter -A INPUT -i $WAN -j REJECT --reject-with icmp-port-unreachable +$IPT -t filter -A FORWARD -m state --state INVALID -j DROP +$IPT -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -t filter -A FORWARD -i $WAN -m state --state NEW,INVALID -j DROP +$IPT -t filter -A FORWARD -o $WAN -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu + +$IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE |