From: Mark Wooding <mdw@distorted.org.uk>
Date: Mon, 23 Apr 2012 00:20:28 +0000 (+0100)
Subject: local.m4: Untrusted source addresses appear on the backbone.
X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/commitdiff_plain/c353339c5f8e4afececd952fbebb09109b55dca1

local.m4: Untrusted source addresses appear on the backbone.

This happens because of router redundancy.  Case in point: suppose
vampire is selected via IPv6 router discovery, but radius owns the
external tunnel.  Then vampire will forward the packet over the
backbone to radius, which mustn't reject it.

(This isn't a security problem because the untrusted network isn't (by
definition) trusted very much for anything.
---

diff --git a/local.m4 b/local.m4
index 71c146f..f0e093d 100644
--- a/local.m4
+++ b/local.m4
@@ -72,8 +72,8 @@ defnet housebdry virtual
 ## House hosts.
 defhost radius
 	hosttype router
-	iface eth0 dmz unsafe safe default
-	iface eth1 dmz unsafe safe default
+	iface eth0 dmz unsafe safe untrusted default
+	iface eth1 dmz unsafe safe untrusted default
 	iface eth2 safe
 	iface eth3 untrusted default
 	iface t6-he default
@@ -90,8 +90,8 @@ defhost artist
 	iface eth3 untrusted
 defhost vampire
 	hosttype router
-	iface eth0.0 dmz unsafe safe
-	iface eth0.1 dmz unsafe safe
+	iface eth0.0 dmz unsafe untrusted safe
+	iface eth0.1 dmz unsafe untrusted safe
 	iface eth0.2 safe
 	iface eth0.3 untrusted
 	iface dns0 iodine