diff options
| author | Steven Barth <steven@midlink.org> | 2013-01-04 15:59:28 +0000 |
|---|---|---|
| committer | Steven Barth <steven@midlink.org> | 2013-01-04 15:59:28 +0000 |
| commit | d2072402f76d5c2c93e2981b0fd6d954cdce5136 (patch) | |
| tree | e3b81c8f25b49464cef98cd021d2ddb55400be63 /package/network/config | |
| parent | f537f292a3161a296f8d5166671e158cd09a9c14 (diff) | |
| download | master-187ad058-d2072402f76d5c2c93e2981b0fd6d954cdce5136.tar.gz master-187ad058-d2072402f76d5c2c93e2981b0fd6d954cdce5136.tar.bz2 master-187ad058-d2072402f76d5c2c93e2981b0fd6d954cdce5136.zip | |
firewall: Add ULA site border for IPv6 traffic
This prevents private traffic from leaking out to the internet
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@35012 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/network/config')
| -rw-r--r-- | package/network/config/firewall/Makefile | 2 | ||||
| -rw-r--r-- | package/network/config/firewall/files/firewall.config | 19 |
2 files changed, 20 insertions, 1 deletions
diff --git a/package/network/config/firewall/Makefile b/package/network/config/firewall/Makefile index 4d7970a502..1cfc734a32 100644 --- a/package/network/config/firewall/Makefile +++ b/package/network/config/firewall/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=firewall PKG_VERSION:=2 -PKG_RELEASE:=55 +PKG_RELEASE:=56 include $(INCLUDE_DIR)/package.mk diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config index a87413904d..6acfe1e86a 100644 --- a/package/network/config/firewall/files/firewall.config +++ b/package/network/config/firewall/files/firewall.config @@ -95,6 +95,25 @@ config rule option family ipv6 option target ACCEPT +# Block ULA-traffic from leaking out +config rule + option name Enforce-ULA-Border-Src + option src * + option dest wan + option proto all + option src_ip fc00::/7 + option family ipv6 + option target REJECT + +config rule + option name Enforce-ULA-Border-Dest + option src * + option dest wan + option proto all + option dest_ip fc00::/7 + option family ipv6 + option target REJECT + # include a file with users custom iptables rules config include option path /etc/firewall.user |