X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/beb4f0eeafb386d83f2593fec489f4291583e08b..7dff27544f73e78dc1ba1c74604a5836862cbd0e:/radius.m4 diff --git a/radius.m4 b/radius.m4 index 72a8e1f..978a877 100644 --- a/radius.m4 +++ b/radius.m4 @@ -22,16 +22,9 @@ ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ###-------------------------------------------------------------------------- -### Config settings. - -## This router is involved in a routing asymmetry. -setconf(rp_filter, 0) -setconf(log_martians, 0) - -###-------------------------------------------------------------------------- ### radius-specific rules. -m4_divert(84)m4_dnl +m4_divert(86)m4_dnl ## Externally visible services. allowservices inbound tcp \ ident \ @@ -69,12 +62,15 @@ run iptables -t nat -F run iptables -t nat -X run iptables -t nat -N outbound -run iptables -t nat -A outbound -j RETURN ! -o $if_dmz +run iptables -t nat -A outbound -j RETURN ! -o eth0 run iptables -t nat -A outbound -j RETURN ! -s 172.29.198.0/23 run iptables -t nat -A outbound -j RETURN -d 62.49.204.144/28 run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23 run iptables -t nat -A outbound -j SNAT --to-source 62.49.204.158 run iptables -t nat -A POSTROUTING -j outbound +## Forbid anything complicated to the NAT address. +run iptables -A INPUT -d 62.49.204.158 ! -p icmp -j REJECT + m4_divert(-1) ###----- That's all, folks --------------------------------------------------