firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adjust firewall scripts to support NTP TCO/4460.

Browse Source
This commit is contained in:
chris
2026-09-09 15:43:30 +02:00
parent 76d60cae2a
commit cd25250624
2 changed files with 10 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ip6t-firewall-gateway
+5 -8
View File
@@ -3553,14 +3553,11 @@ fi
echononl "\t\tNTP Service out only" echononl "\t\tNTP Service out only"
if $allow_ntp_request_out ; then if $allow_ntp_request_out ; then
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
# see : out_tcp_port_arr out_udp_port_arr at post_decalrations.conf
#
echo_done echo_done
else else
echo_skipped echo_skipped
fi fi
@@ -3574,10 +3571,10 @@ echononl "\t\tNTP Service Gateway"
if $local_ntp_service ; then if $local_ntp_service ; then
if ! $allow_ntp_request_out ; then if ! $allow_ntp_request_out ; then
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT $ip6t -A OUTPUT -o $_dev -p udp --dport $standard_ntp_udp_port -m conntrack --ctstate NEW -j ACCEPT
done done
fi fi
$ip6t -A INPUT -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT $ip6t -A INPUT -p udp --dport $standard_ntp_udp_port -m conntrack --ctstate NEW -j ACCEPT
echo_done echo_done
else else
echo_skipped echo_skipped
ipt-firewall-gateway
+5 -8
View File
@@ -4386,14 +4386,11 @@ fi
echononl "\t\tNTP Service out only" echononl "\t\tNTP Service out only"
if $allow_ntp_request_out ; then if $allow_ntp_request_out ; then
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
# see : out_tcp_port_arr out_udp_port_arr at post_decalrations.conf
#
echo_done echo_done
else else
echo_skipped echo_skipped
fi fi
@@ -4407,10 +4404,10 @@ echononl "\t\tNTP Service Gateway"
if $local_ntp_service ; then if $local_ntp_service ; then
if ! $allow_ntp_request_out ; then if ! $allow_ntp_request_out ; then
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT $ipt -A OUTPUT -o $_dev -p udp --dport $standard_ntp_udp_port -m conntrack --ctstate NEW -j ACCEPT
done done
fi fi
$ipt -A INPUT -p udp --dport $standard_ntp_port -m conntrack --ctstate NEW -j ACCEPT $ipt -A INPUT -p udp --dport $standard_ntp_udp_port -m conntrack --ctstate NEW -j ACCEPT
echo_done echo_done
else else
echo_skipped echo_skipped