X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/216285e1f550316101d0c49d4420664a5dc74963..3b250fe6986bd168aa7e4f46336b3a43b2735b37:/local.m4

diff --git a/local.m4 b/local.m4
index f139f00..251cf59 100644
--- a/local.m4
+++ b/local.m4
@@ -161,7 +161,7 @@ case $forward in
     run iptables -A fwd-spec-nofrag -j RETURN --fragment
     run ip6tables -A fwd-spec-nofrag -j RETURN \
 	    -m ipv6header --soft --header frag
-    run iptables -A FORWARD -j fwd-spec-nofrag
+    run ip46tables -A FORWARD -j fwd-spec-nofrag
 
     ## Allow ping from safe/noloop to untrusted networks.
     run iptables -A fwd-spec-nofrag -j ACCEPT \
@@ -172,10 +172,10 @@ case $forward in
 	    -m mark --mark $from_untrusted/$MASK_FROM \
 	    -m state --state ESTABLISHED
     run ip6tables -A fwd-spec-nofrag -j ACCEPT \
-	    -p ipv6-icmp --icmpv6-type echo-request \
+	    -p icmpv6 --icmpv6-type echo-request \
 	    -m mark --mark $to_untrusted/$MASK_TO
     run ip6tables -A fwd-spec-nofrag -j ACCEPT \
-	    -p ipv6-icmp --icmpv6-type echo-reply \
+	    -p icmpv6 --icmpv6-type echo-reply \
 	    -m mark --mark $from_untrusted/$MASK_FROM \
 	    -m state --state ESTABLISHED
 
@@ -264,12 +264,9 @@ run ip46tables -A inbound -j forbidden
 run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
 
 ## Otherwise process as indicated by the mark.
-run ip46tables -A INPUT -m mark ! --mark 0/$MASK_MASK -j ACCEPT
-case $forward in
-  1)
-    run ip46tables -A FORWARD -m mark ! --mark 0/$MASK_MASK -j ACCEPT
-    ;;
-esac
+for i in $inchains; do
+  run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
+done
 
 m4_divert(-1)
 ###----- That's all, folks --------------------------------------------------