X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/8cf73501a6dce9204f845c52b030032efeeb312a..d84128ea08ab3f1af3d2d25907ee18e2edf0283a:/vampire.m4

diff --git a/vampire.m4 b/vampire.m4
index f21009c..e378447 100644
--- a/vampire.m4
+++ b/vampire.m4
@@ -67,22 +67,17 @@ allowservices inbound udp \
 	gnutella_svc \
 	i2p
 
-## Provide DNS resolution to local untrusted hosts.
-for p in tcp udp; do
-  run iptables -A inbound -j ACCEPT \
-	  -s 172.29.198.0/24 \
-	  -p $p --destination-port $port_dns
-done
+## Extend some services to local untrusted hosts.
+clearchain inbound-untrusted
+run iptables -A inbound -j inbound-untrusted \
+	-s 172.29.198.0/24
 
-## Allow smb and nmb to untrusted hosts.  This is a bit experimental.
-run iptables -A inbound -j ACCEPT \
-	-s 172.29.198.0/24 \
-	-p udp -m multiport --destination-ports \
-		$port_netbios_ns,$port_netbios_dgm
-run iptables -A inbound -j ACCEPT \
-	-s 172.29.198.0/24 \
-	-p tcp -m multiport --destination-ports \
-		$port_netbios_ssn,$port_microsoft_ds
+allowservices inbound-untrusted tcp \
+	dns \
+	netbios_ssn microsoft_ds
+allowservices inbound-untrusted udp \
+	dns \
+	tftp
 
 ## Provide syslog for evolution.
 run iptables -A inbound -j ACCEPT \