firewall: Extend rate limiting for ICMP error messages.

Fixes #10489.

diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
index d6a2f75048123728f5b44b7a245d200761e67c5f..a91aeb37f16dc82f5b183f45e9f278ad483f4283 100644 (file)
--- a/config/etc/sysctl.conf
+++ b/config/etc/sysctl.conf
@@ -1,7 +1,9 @@
 net.ipv4.ip_forward = 1
 net.ipv4.ip_dynaddr = 1
 net.ipv4.ip_forward = 1
 net.ipv4.ip_dynaddr = 1

+

 net.ipv4.icmp_echo_ignore_broadcasts = 1
 net.ipv4.icmp_ignore_bogus_error_responses = 1
 net.ipv4.icmp_echo_ignore_broadcasts = 1
 net.ipv4.icmp_ignore_bogus_error_responses = 1

+net.ipv4.icmp_ratemask = 88089

 
 net.ipv4.tcp_syncookies = 1
 net.ipv4.tcp_fin_timeout = 30
 
 net.ipv4.tcp_syncookies = 1
 net.ipv4.tcp_fin_timeout = 30