aboutsummaryrefslogtreecommitdiffstats
path: root/package/network
diff options
context:
space:
mode:
authorAlin Nastac <alin.nastac@gmail.com>2017-06-16 14:16:07 +0200
committerHans Dedecker <dedeckeh@gmail.com>2017-07-11 22:09:57 +0200
commitd8748e537f11ab5f2b5e2ed25d94baa5ce353984 (patch)
tree8cdc9cb604c2d5ddfbd208f004c42553a55549dc /package/network
parenta35a27e8ef05b6536cf12b2938488be499859b76 (diff)
downloadupstream-d8748e537f11ab5f2b5e2ed25d94baa5ce353984.tar.gz
upstream-d8748e537f11ab5f2b5e2ed25d94baa5ce353984.tar.bz2
upstream-d8748e537f11ab5f2b5e2ed25d94baa5ce353984.zip
netfilter: add iptables-mod-rpfilter package
Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
Diffstat (limited to 'package/network')
-rw-r--r--package/network/utils/iptables/Makefile14
1 files changed, 14 insertions, 0 deletions
diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile
index ca8b1976aa..89f4354d07 100644
--- a/package/network/utils/iptables/Makefile
+++ b/package/network/utils/iptables/Makefile
@@ -242,6 +242,19 @@ iptables extensions for hashlimit matching
endef
+define Package/iptables-mod-rpfilter
+$(call Package/iptables/Module, +kmod-ipt-rpfilter)
+ TITLE:=rpfilter iptables extension
+endef
+
+define Package/iptables-mod-rpfilter/description
+iptables extensions for reverse path filter test on a packet
+
+ Matches:
+ - rpfilter
+
+endef
+
define Package/iptables-mod-iprange
$(call Package/iptables/Module, +kmod-ipt-iprange)
TITLE:=IP range extension
@@ -565,6 +578,7 @@ $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
$(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
$(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
$(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
+$(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
$(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
$(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
$(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))