firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Enhance spoofed packet handling: exclude loopback traffic in IP filtering

Browse Source
This commit is contained in:
chris
2026-10-27 22:30:44 +01:00
parent f6660709ce
commit 57861cb8ec
3 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/post_declarations.conf
+1 -1
View File
@@ -60,7 +60,7 @@ done
# ---
declare -a ext_ip_arr
for _ip in $ext_ips ; do
host_ip_arr+=("$_ip")
ext_ip_arr+=("$_ip")
done
# ---
ip6t-firewall-server
+7 -2
View File
@@ -815,13 +815,18 @@ echo_done
# ---
echononl "\tBlock spoofed (own ip) packets"
# Note:
# Exclude loopback - local traffic to an own address (e.g. a web application
# requesting its own domain) passes PREROUTING via 'lo' with src = dst.
#
if $log_spoofed || $log_all ; then
for _ip in ${ext_ip_arr[@]} ; do
$ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
$ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
done
fi
for _ip in ${ext_ip_arr[@]} ; do
$ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
$ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
done
echo_done
ipt-firewall-server
+7 -2
View File
@@ -814,13 +814,18 @@ echo_done
# ---
echononl "\tBlock spoofed (own ip) packets"
# Note:
# Exclude loopback - local traffic to an own address (e.g. a web application
# requesting its own domain) passes PREROUTING via 'lo' with src = dst.
#
if $log_spoofed || $log_all ; then
for _ip in ${ext_ip_arr[@]} ; do
$ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
$ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
done
fi
for _ip in ${ext_ip_arr[@]} ; do
$ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
$ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
done
echo_done