defaults: emit ctstate INVALID drop rules by default
authorJo-Philipp Wich <jow@openwrt.org>
Fri, 29 Jan 2016 17:22:34 +0000 (18:22 +0100)
committerJo-Philipp Wich <jow@openwrt.org>
Fri, 29 Jan 2016 17:22:38 +0000 (18:22 +0100)
Enable the creation of state invalid catch rules by default to prevent
unnatted traffic from leaking onto the wan.

Fixes OpenWrt ticket #21738.

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
defaults.c

index 4936b3879616fa5f9b539d80428319c1f2e6dce1..e246949b5a0ee2b2c16ff753f355dfa25e0250df 100644 (file)
@@ -93,6 +93,7 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
        defs->tcp_syncookies       = true;
        defs->tcp_window_scaling   = true;
        defs->custom_chains        = true;
+       defs->drop_invalid         = true;
 
        uci_foreach_element(&p->sections, e)
        {