iptables: Only jump into BADTCP for TCP packets.

This saves us from evaluating lots of rules for non-TCP
packets.

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 851f3ec6de00eba7014f0220f4ca76ea797216c1..000d3252d87cbdbbe7663f863fd8121d1732e521 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -70,13 +70,13 @@ iptables_init() {
        # NEW TCP without SYN
        /sbin/iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 
        # NEW TCP without SYN
        /sbin/iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 

+       /sbin/iptables -A INPUT   -p tcp -j BADTCP
+       /sbin/iptables -A FORWARD -p tcp -j BADTCP
+

        # Connection tracking chain
        /sbin/iptables -N CONNTRACK
        /sbin/iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
        # Connection tracking chain
        /sbin/iptables -N CONNTRACK
        /sbin/iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 

-       /sbin/iptables -A INPUT   -j BADTCP
-       /sbin/iptables -A FORWARD -j BADTCP
-

        # Fix for braindead ISP's
        /sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 
        # Fix for braindead ISP's
        /sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu