From: Steven Barth Date: Fri, 4 Jan 2013 15:59:28 +0000 (+0000) Subject: firewall: Add ULA site border for IPv6 traffic This prevents private traffic from... X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=b077480a59a66f3ed970c6a0c5336e4c28f9a27d;p=librecmc%2Flibrecmc.git firewall: Add ULA site border for IPv6 traffic This prevents private traffic from leaking out to the internet SVN-Revision: 35012 --- diff --git a/package/network/config/firewall/Makefile b/package/network/config/firewall/Makefile index 4d7970a502..1cfc734a32 100644 --- a/package/network/config/firewall/Makefile +++ b/package/network/config/firewall/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=firewall PKG_VERSION:=2 -PKG_RELEASE:=55 +PKG_RELEASE:=56 include $(INCLUDE_DIR)/package.mk diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config index a87413904d..6acfe1e86a 100644 --- a/package/network/config/firewall/files/firewall.config +++ b/package/network/config/firewall/files/firewall.config @@ -95,6 +95,25 @@ config rule option family ipv6 option target ACCEPT +# Block ULA-traffic from leaking out +config rule + option name Enforce-ULA-Border-Src + option src * + option dest wan + option proto all + option src_ip fc00::/7 + option family ipv6 + option target REJECT + +config rule + option name Enforce-ULA-Border-Dest + option src * + option dest wan + option proto all + option dest_ip fc00::/7 + option family ipv6 + option target REJECT + # include a file with users custom iptables rules config include option path /etc/firewall.user