pcap: update to version 1.0.0, add extension for changing the desired protocol for...

[openwrt.git] / package / firewall / files / uci_firewall.sh

diff --git a/package/firewall/files/uci_firewall.sh b/package/firewall/files/uci_firewall.sh
index fd10899..c197003 100755 (executable)
--- a/package/firewall/files/uci_firewall.sh
+++ b/package/firewall/files/uci_firewall.sh
@@ -154,21 +154,22 @@ fw_defaults() {
        $IPTABLES -P FORWARD DROP
 
        $IPTABLES -F
        $IPTABLES -P FORWARD DROP
 
        $IPTABLES -F

-       $IPTABLES -t mangle -F

        $IPTABLES -t nat -F
        $IPTABLES -t nat -F

-       $IPTABLES -t mangle -X

        $IPTABLES -t nat -X
        $IPTABLES -X
        $IPTABLES -t nat -X
        $IPTABLES -X

-       
-       $IPTABLES -A INPUT -m state --state INVALID -j DROP
+
+       config_get_bool drop_invalid $1 drop_invalid 1
+
+       [ "$drop_invalid" -gt 0 ] && {
+               $IPTABLES -A INPUT -m state --state INVALID -j DROP
+               $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
+               $IPTABLES -A FORWARD -m state --state INVALID -j DROP
+       }
+

        $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
        $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-               
-       $IPTABLES -A OUTPUT -m state --state INVALID -j DROP

        $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
        $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-       
-       $IPTABLES -A FORWARD -m state --state INVALID -j DROP

        $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
        $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-       
+

        $IPTABLES -A INPUT -i lo -j ACCEPT
        $IPTABLES -A OUTPUT -o lo -j ACCEPT
 
        $IPTABLES -A INPUT -i lo -j ACCEPT
        $IPTABLES -A OUTPUT -o lo -j ACCEPT
 


@@ -400,12 +401,12 @@ fw_init() {
        config_foreach fw_defaults defaults
        echo "Loading zones"
        config_foreach fw_zone zone
        config_foreach fw_defaults defaults
        echo "Loading zones"
        config_foreach fw_zone zone

-       echo "Loading rules"
-       config_foreach fw_rule rule

        echo "Loading forwarding"
        config_foreach fw_forwarding forwarding
        echo "Loading redirects"
        config_foreach fw_redirect redirect
        echo "Loading forwarding"
        config_foreach fw_forwarding forwarding
        echo "Loading redirects"
        config_foreach fw_redirect redirect

+       echo "Loading rules"
+       config_foreach fw_rule rule

        echo "Loading includes"
        config_foreach fw_include include
        uci_set_state firewall core loaded 1
        echo "Loading includes"
        config_foreach fw_include include
        uci_set_state firewall core loaded 1


@@ -416,9 +417,7 @@ fw_init() {
 
 fw_stop() {
        $IPTABLES -F
 
 fw_stop() {
        $IPTABLES -F

-       $IPTABLES -t mangle -F

        $IPTABLES -t nat -F
        $IPTABLES -t nat -F

-       $IPTABLES -t mangle -X

        $IPTABLES -t nat -X
        $IPTABLES -X
        $IPTABLES -P INPUT ACCEPT
        $IPTABLES -t nat -X
        $IPTABLES -X
        $IPTABLES -P INPUT ACCEPT