diff mbox series

firewall: config: drop input traffic by default

Message ID 20221019150003.3829141-1-baptiste@bitsofnetworks.org
State Accepted
Delegated to: Baptiste Jonglez
Headers show
Series firewall: config: drop input traffic by default | expand

Commit Message

Baptiste Jonglez Oct. 19, 2022, 3 p.m. UTC 
From: Baptiste Jonglez <git@bitsofnetworks.org>

This is necessary with firewall4 to avoid a hard-to-diagnose race
condition during boot, causing DNAT rules not to be taken into account
correctly.

The root cause is that, during boot, the ruleset is mostly empty, and
interface-related rules (including DNAT rules) are added incrementally.
If a packet hits the input chain before the DNAT rules are setup, it can
create buggy conntrack entries that will persist indefinitely.

This new default should be safe because firewall4 explicitly accepts
authorized traffic and rejects the rest.  Thus, in normal operations, the
default policy is not used.

Fixes: #10749
Ref: https://github.com/openwrt/openwrt/issues/10749
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
---
 package/network/config/firewall/files/firewall.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/package/network/config/firewall/files/firewall.config b/package/network/config/firewall/files/firewall.config
index 61cfe665e4..b90ac7af0a 100644
--- a/package/network/config/firewall/files/firewall.config
+++ b/package/network/config/firewall/files/firewall.config
@@ -1,6 +1,6 @@ 
 config defaults
 	option syn_flood	1
-	option input		ACCEPT
+	option input		REJECT
 	option output		ACCEPT
 	option forward		REJECT
 # Uncomment this line to disable ipv6 rules