From: Michael Tremer <michael.tremer@ipfire.org>
Date: Mon, 8 Jul 2013 13:17:56 +0000 (+0200)
Subject: iptables: Only jump into BADTCP for TCP packets.
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0bb1c918db8a435881a94a77948fa10839230a1e;p=people%2Fms%2Fipfire-2.x.git

iptables: Only jump into BADTCP for TCP packets.

This saves us from evaluating lots of rules for non-TCP
packets.
---

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 851f3ec6de..000d3252d8 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -70,13 +70,13 @@ iptables_init() {
 	# NEW TCP without SYN
 	/sbin/iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 
+	/sbin/iptables -A INPUT   -p tcp -j BADTCP
+	/sbin/iptables -A FORWARD -p tcp -j BADTCP
+
 	# Connection tracking chain
 	/sbin/iptables -N CONNTRACK
 	/sbin/iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
-	/sbin/iptables -A INPUT   -j BADTCP
-	/sbin/iptables -A FORWARD -j BADTCP
-
 	# Fix for braindead ISP's
 	/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu