From d8748e537f11ab5f2b5e2ed25d94baa5ce353984 Mon Sep 17 00:00:00 2001 From: Alin Nastac Date: Fri, 16 Jun 2017 14:16:07 +0200 Subject: netfilter: add iptables-mod-rpfilter package Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw -I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to become full when a packet flood with randomly selected source IP addresses is received from the lan side. Signed-off-by: Alin Nastac --- package/network/utils/iptables/Makefile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'package/network/utils/iptables') diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile index ca8b1976aa..89f4354d07 100644 --- a/package/network/utils/iptables/Makefile +++ b/package/network/utils/iptables/Makefile @@ -242,6 +242,19 @@ iptables extensions for hashlimit matching endef +define Package/iptables-mod-rpfilter +$(call Package/iptables/Module, +kmod-ipt-rpfilter) + TITLE:=rpfilter iptables extension +endef + +define Package/iptables-mod-rpfilter/description +iptables extensions for reverse path filter test on a packet + + Matches: + - rpfilter + +endef + define Package/iptables-mod-iprange $(call Package/iptables/Module, +kmod-ipt-iprange) TITLE:=IP range extension @@ -565,6 +578,7 @@ $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m))) $(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m))) $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m))) $(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m))) +$(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m))) $(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m))) $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m))) $(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m))) -- cgit v1.2.3