]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/commit
firewall: Drop legacy rules for PPPoE/PPTP
authorMichael Tremer <michael.tremer@ipfire.org>
Fri, 21 Apr 2023 12:23:00 +0000 (12:23 +0000)
committerPeter Müller <peter.mueller@ipfire.org>
Mon, 24 Apr 2023 18:44:39 +0000 (18:44 +0000)
commitaac0baea15bf3ef87ef878ffbe46efcafe24e06c
treec1d1a9a916ede0a692d2e6e93d38d120fcd5548f
parentef59185bf33a9609945602eeccfaa7bcf3009230
firewall: Drop legacy rules for PPPoE/PPTP

These rules where created to permit any local traffic to the firewall
when using a PPP connection that utilised Ethernet as transport.

This is however nonsensical and a security issue for any other
connection methods that call the RED interface "red0" and use PPP (e.g.
QMI).

Since PPPoE packets do not flow through iptables, these rules can be
dropped safely. We do not know whether PPTP works at all these days.

Fixes: #13088 - firewall: INPUT accepts all packets when using QMI for dial-in
Tested-by: Stefan Schantl <stefan.schantl@ipfire.org>
Tested-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
src/initscripts/system/firewall