diff options
| author | Alin Nastac <alin.nastac@gmail.com> | 2017-06-16 14:16:07 +0200 |
|---|---|---|
| committer | Hans Dedecker <dedeckeh@gmail.com> | 2017-07-11 22:09:57 +0200 |
| commit | d8748e537f11ab5f2b5e2ed25d94baa5ce353984 (patch) | |
| tree | 8cdc9cb604c2d5ddfbd208f004c42553a55549dc /include | |
| parent | a35a27e8ef05b6536cf12b2938488be499859b76 (diff) | |
| download | upstream-d8748e537f11ab5f2b5e2ed25d94baa5ce353984.tar.gz upstream-d8748e537f11ab5f2b5e2ed25d94baa5ce353984.tar.bz2 upstream-d8748e537f11ab5f2b5e2ed25d94baa5ce353984.zip | |
netfilter: add iptables-mod-rpfilter package
Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw
-I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to
become full when a packet flood with randomly selected source IP addresses
is received from the lan side.
Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/netfilter.mk | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/netfilter.mk b/include/netfilter.mk index 2cd3edbfe5..2d537583bd 100644 --- a/include/netfilter.mk +++ b/include/netfilter.mk @@ -106,6 +106,8 @@ $(eval $(call nf_add,IPT_FILTER,CONFIG_NETFILTER_XT_MATCH_STRING, $(P_XT)xt_stri $(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_DSCP, $(P_XT)xt_dscp)) $(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_TARGET_DSCP, $(P_XT)xt_DSCP)) $(eval $(call nf_add,IPT_HASHLIMIT,CONFIG_NETFILTER_XT_MATCH_HASHLIMIT, $(P_XT)xt_hashlimit)) +$(eval $(call nf_add,IPT_RPFILTER,CONFIG_IP_NF_MATCH_RPFILTER, $(P_V4)ipt_rpfilter)) +$(eval $(call nf_add,IPT_RPFILTER,CONFIG_IP6_NF_MATCH_RPFILTER, $(P_V6)ip6t_rpfilter)) $(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_LENGTH, $(P_XT)xt_length)) $(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_STATISTIC, $(P_XT)xt_statistic)) $(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_TCPMSS, $(P_XT)xt_tcpmss)) |