From 8a3660c1f5d30802baec439821c42ea93eb66584 Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Thu, 16 Mar 2023 18:09:32 +0000 Subject: [PATCH] local.m4: Fix the IPv4 version of the `inbound-untrusted' chain. This chain was introduced in 94ce6e764e92676c1a7dea68820bcf198ea4c466, but, for some reason, the IPv6 version was established correctly but the IPv4 version was hooked onto its parent `inbound' chain /after/ the properly-final `forbidden' jump. Fix this foolish bogosity. --- local.m4 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/local.m4 b/local.m4 index dfaae8f..5aa3bbd 100644 --- a/local.m4 +++ b/local.m4 @@ -405,13 +405,13 @@ m4_divert(88)m4_dnl openports inbound ## Inspect inbound packets from untrusted sources. +run iptables -A inbound -s 172.29.198.0/24 -g inbound-untrusted run ip6tables -A inbound -s 2001:8b0:c92:8000::/49 -g inbound-untrusted run ip6tables -A inbound -s 2001:ba8:1d9:8000::/49 -g inbound-untrusted run ip46tables -A inbound-untrusted -g forbidden run ip46tables -A inbound -g forbidden run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound -run iptables -A inbound -s 172.29.198.0/24 -j inbound-untrusted ## Allow responses from the scary outside world into the untrusted net, but ## don't let untrusted things run services. -- 2.11.0