firewall: Add H.323 to the conntrack helpers

diff --git a/lfs/configroot b/lfs/configroot
index b8976c1f458fe969fbb522ef4451508da0c9ba02..8de5e6b517832cf33df0f5c40d53a0f2b82e1a5d 100644 (file)
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -136,7 +136,7 @@ $(TARGET) :
        echo  "POLICY1=MODE2"           >> $(CONFIG_ROOT)/firewall/settings
 
        # Add conntrack helper default settings
-       for proto in AMANDA FTP IRC PPTP SIP TFTP; do \
+       for proto in AMANDA FTP H323 IRC PPTP SIP TFTP; do \
                echo "CONNTRACK_$${proto}=on" >> $(CONFIG_ROOT)/optionsfw/settings; \
        done
 

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index d19329b9a9d3721522c0913ad3d167097d322912..d5c53b81c04f86a88de19b3d6797c22e961a65f4 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -105,6 +105,18 @@ iptables_init() {
                done
        fi
 
+       # H.323
+       if [ "${CONNTRACK_H323}" = "on" ]; then
+               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
+                       -m helper --helper h323 -j ACCEPT
+
+               # Gatekeeper RAS
+               iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper h323
+
+               # Q.931
+               iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper h323
+       fi
+
        # FTP
        if [ "${CONNTRACK_FTP}" = "on" ]; then
                iptables -A CONNTRACK -m conntrack --ctstate RELATED \