Author: cyrus Date: 2015-05-05 15:22:41 +0200 (Tue, 05 May 2015) New Revision: 45613
Modified: trunk/package/network/config/firewall/files/firewall.config Log: firewall: Allow IGMP and MLD input on WAN The WAN port should at least respond to IGMP and MLD queries as otherwise a snooping bridge/switch might drop traffic. RFC4890 recommends to leave IGMP and MLD unfiltered as they are always link-scoped anyways. Signed-off-by: Linus L?\195?\188ssing <[email protected]> Modified: trunk/package/network/config/firewall/files/firewall.config =================================================================== --- trunk/package/network/config/firewall/files/firewall.config 2015-05-05 13:22:33 UTC (rev 45612) +++ trunk/package/network/config/firewall/files/firewall.config 2015-05-05 13:22:41 UTC (rev 45613) @@ -46,6 +46,13 @@ option family ipv4 option target ACCEPT +config rule + option name Allow-IGMP + option src wan + option proto igmp + option family ipv4 + option target ACCEPT + # Allow DHCPv6 replies # see https://dev.openwrt.org/ticket/10381 config rule @@ -59,6 +66,18 @@ option family ipv6 option target ACCEPT +config rule + option name Allow-MLD + option src wan + option proto icmp + option src_ip fe80::/10 + list icmp_type '130/0' + list icmp_type '131/0' + list icmp_type '132/0' + list icmp_type '143/0' + option family ipv6 + option target ACCEPT + # Allow essential incoming IPv6 ICMP traffic config rule option name Allow-ICMPv6-Input _______________________________________________ openwrt-commits mailing list [email protected] https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-commits
