From c128371124ce4d197a5fbc00e42b58e9d82c571e Mon Sep 17 00:00:00 2001 From: Dmitry Tunin Date: Sat, 28 Jul 2018 17:48:42 +0300 Subject: igmpproxy: drop SSDP packets It is insecure to let this type of packets inside They can e.g. open ports on some other routers with UPnP, etc Signed-off-by: Dmitry Tunin --- package/network/services/igmpproxy/files/igmpproxy.init | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'package/network/services/igmpproxy/files') diff --git a/package/network/services/igmpproxy/files/igmpproxy.init b/package/network/services/igmpproxy/files/igmpproxy.init index 37fe62a..c4af430 100644 --- a/package/network/services/igmpproxy/files/igmpproxy.init +++ b/package/network/services/igmpproxy/files/igmpproxy.init @@ -68,6 +68,18 @@ igmp_add_firewall_routing() { [[ "$direction" = "downstream" && ! -z "$zone" ]] || return 0 +# First drop SSDP packets then accept all other multicast + + json_add_object "" + json_add_string type rule + json_add_string src "$upstream" + json_add_string dest "$zone" + json_add_string family ipv4 + json_add_string proto udp + json_add_string dest_ip "239.255.255.250" + json_add_string target DROP + json_close_object + json_add_object "" json_add_string type rule json_add_string src "$upstream" -- cgit v1.1