On Thu, Apr 04, 2013 at 09:09:29AM -0600, Lance Fredrickson wrote:
Looking at the docs, it appears LocalDiscovery should be off by
default. You could also try explicitly placing 'LocalDiscovery = no'
in your configs.
I didn't try it, but something tells me this will not help a lot at
makin local discovery work. Correct me if I am wrong.
Correct, but would prevent you VPN from going down.
I've always solved this with ebtables like I said.
For example, to block DHCP
ebtables -A INPUT --in-interface tap0 --protocol ipv4 --ip-protocol udp
--ip-destination-port 67:68 -j DROP
ebtables -A INPUT --in-interface tap0 --protocol ipv4 --ip-protocol udp
--ip-source-port 67:68 -j DROP
ebtables -A FORWARD --out-interface tap0 --protocol ipv4 --ip-protocol
udp --ip-destination-port 67:68 -j DROP
ebtables -A FORWARD --out-interface tap0 --protocol ipv4 --ip-protocol
udp --ip-source-port 67:68 -j DROP
ebtables -A FORWARD --in-interface tap0 --protocol ipv4 --ip-protocol
udp --ip-destination-port 67:68 -j DROP
ebtables -A FORWARD --in-interface tap0 --protocol ipv4 --ip-protocol
udp --ip-source-port 67:68 -j DROP
ebtables -A OUTPUT --out-interface tap0 --protocol ipv4 --ip-protocol
udp --ip-destination-port 67:68 -j DROP
ebtables -A OUTPUT --out-interface tap0 --protocol ipv4 --ip-protocol
udp --ip-source-port 67:68 -j DROP
Perhaps a bit redundant in some places, but it gets the job done, just
substituting your port number for whatever protocol.
Not sure what iptables rules you're using now. I haven't done this
myself, but looks like if your iptables has --pkt-type, you could try.
iptables -I INPUT --in-interface tap0 -m pkttype --pkt-type broadcast -p
udp --dport ### -j DROP
iptables -I FORWARD --in-interface tap0 -m pkttype --pkt-type broadcast
-p udp --dport ### -j DROP
iptables -I FORWARD --out-interface tap0 -m pkttype --pkt-type broadcast
-p udp --dport ### -j DROP
iptables -I OUTPUT --out-interface tap0 -m pkttype --pkt-type broadcast
-p udp --dport ### -j DROP
Of course matching your tap interface to what you're using, and adding
the port number.
Again, perhaps redundant, but should cover all your bases I think. Maybe
a hint at least, if at all useful.
Lance
_______________________________________________
tinc mailing list
[email protected]
http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
