From: Peter Müller Date: Thu, 17 Feb 2022 20:16:02 +0000 (+0000) Subject: firewall: Add proper logging prefix for conntrack INVALID hits X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5c1af49c835921232a0312819025fb08dddae4b3;p=people%2Fms%2Fipfire-2.x.git firewall: Add proper logging prefix for conntrack INVALID hits Fixes: #12778 Signed-off-by: Peter Müller --- diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index fc355cd5d4..2f4b4e30ed 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -119,9 +119,13 @@ iptables_init() { iptables -A FORWARD -p tcp -j BADTCP # Connection tracking chains + iptables -N CTINVALID + iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID " + iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID" + iptables -N CONNTRACK iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT - iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP + iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT # Restore any connection marks