diff options
| author | Mike Baker <mbm@openwrt.org> | 2004-05-07 22:41:36 +0000 |
|---|---|---|
| committer | Mike Baker <mbm@openwrt.org> | 2004-05-07 22:41:36 +0000 |
| commit | c055b4eb2d14cdc74600041d30334fbf0d5de2a9 (patch) | |
| tree | d4696fe042a844d14719b109937a46dcf0f7ce57 /root/etc/init.d/S45firewall | |
| parent | 5517f1169f618f5e85f764d81c90472dd528a55b (diff) | |
| download | mtk-20170518-c055b4eb2d14cdc74600041d30334fbf0d5de2a9.zip mtk-20170518-c055b4eb2d14cdc74600041d30334fbf0d5de2a9.tar.gz mtk-20170518-c055b4eb2d14cdc74600041d30334fbf0d5de2a9.tar.bz2 | |
move to new init.d structure
SVN-Revision: 18
Diffstat (limited to 'root/etc/init.d/S45firewall')
| -rwxr-xr-x | root/etc/init.d/S45firewall | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/root/etc/init.d/S45firewall b/root/etc/init.d/S45firewall new file mode 100755 index 0000000..40ac81a --- /dev/null +++ b/root/etc/init.d/S45firewall @@ -0,0 +1,22 @@ +#!/bin/sh +. /etc/functions.sh + +WAN=$(nvram_get wan_ifname) + +IPT=/usr/sbin/iptables + +for T in filter nat mangle ; do + $IPT -t $T -F + $IPT -t $T -X +done + +$IPT -t filter -A INPUT -m state --state INVALID -j DROP +$IPT -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -t filter -A INPUT -p icmp -j ACCEPT +$IPT -t filter -A INPUT -i $WAN -p tcp -j REJECT --reject-with tcp-reset +$IPT -t filter -A INPUT -i $WAN -j REJECT --reject-with icmp-port-unreachable +$IPT -t filter -A FORWARD -m state --state INVALID -j DROP +$IPT -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -t filter -A FORWARD -i $WAN -m state --state NEW,INVALID -j DROP + +$IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE |