From 5c1af49c835921232a0312819025fb08dddae4b3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Peter=20M=C3=BCller?= Date: Thu, 17 Feb 2022 20:16:02 +0000 Subject: [PATCH] firewall: Add proper logging prefix for conntrack INVALID hits MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Fixes: #12778 Signed-off-by: Peter Müller --- src/initscripts/system/firewall | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index fc355cd5d4..2f4b4e30ed 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -119,9 +119,13 @@ iptables_init() { iptables -A FORWARD -p tcp -j BADTCP # Connection tracking chains + iptables -N CTINVALID + iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID " + iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID" + iptables -N CONNTRACK iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT - iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP + iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT # Restore any connection marks -- 2.39.5