diff options
| author | Nikolay Amiantov <ab@fmap.me> | 2018-08-29 21:50:53 +0300 |
|---|---|---|
| committer | xeji <36407913+xeji@users.noreply.github.com> | 2018-08-29 20:50:53 +0200 |
| commit | 69407cb0136fb6a04b21a00aa6768c45fed00060 (patch) | |
| tree | f7115b47a89a1f78602d57df8e7d5e8418f84a8b | |
| parent | 364c5047bc75443e080d79c4e9f44cb0609bd3ad (diff) | |
| download | nixlib-69407cb0136fb6a04b21a00aa6768c45fed00060.tar nixlib-69407cb0136fb6a04b21a00aa6768c45fed00060.tar.gz nixlib-69407cb0136fb6a04b21a00aa6768c45fed00060.tar.bz2 nixlib-69407cb0136fb6a04b21a00aa6768c45fed00060.tar.lz nixlib-69407cb0136fb6a04b21a00aa6768c45fed00060.tar.xz nixlib-69407cb0136fb6a04b21a00aa6768c45fed00060.tar.zst nixlib-69407cb0136fb6a04b21a00aa6768c45fed00060.zip | |
firewall service: respect marks in rpfilter (#39054)
This allows one to add rules which change a packet's routing table: iptables -t raw -I PREROUTING 1 -m set --match-set myset src -j MARK --set-mark 2 ip rule add fwmark 2 table 1 priority 1000 ip route add default dev wg0 table 1 to the beginning of raw table PREROUTING chain, and still have rpfilter.
| -rw-r--r-- | nixos/modules/services/networking/firewall.nix | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 36f1dd8d2479..86463f276c65 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -123,7 +123,7 @@ let # Perform a reverse-path test to refuse spoofers # For now, we just drop, as the raw table doesn't have a log-refuse yet ip46tables -t raw -N nixos-fw-rpfilter 2> /dev/null || true - ip46tables -t raw -A nixos-fw-rpfilter -m rpfilter ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN + ip46tables -t raw -A nixos-fw-rpfilter -m rpfilter --validmark ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN # Allows this host to act as a DHCP4 client without first having to use APIPA iptables -t raw -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN |