From cbbd5e39a0460d98f3d0806e7d7e538e4c9c590d Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Fri, 8 Jun 2012 01:27:39 +0100 Subject: [PATCH] local.m4: Refactor common SSH permission between safe/untrusted hosts. Actually the same rules work for IPv4 and IPv6, so we should only write them once. --- local.m4 | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/local.m4 b/local.m4 index 9dfc464..d57b53d 100644 --- a/local.m4 +++ b/local.m4 @@ -200,17 +200,10 @@ case $forward in -m state --state ESTABLISHED ## Allow SSH from safe/noloop to untrusted networks. - run iptables -A fwd-spec-nofrag -j ACCEPT \ + run ip46tables -A fwd-spec-nofrag -j ACCEPT \ -p tcp --destination-port $port_ssh \ -m mark --mark $to_untrusted/$MASK_TO - run iptables -A fwd-spec-nofrag -j ACCEPT \ - -p tcp --source-port $port_ssh \ - -m mark --mark $from_untrusted/$MASK_FROM \ - -m state --state ESTABLISHED - run ip6tables -A fwd-spec-nofrag -j ACCEPT \ - -p tcp --destination-port $port_ssh \ - -m mark --mark $to_untrusted/$MASK_TO - run ip6tables -A fwd-spec-nofrag -j ACCEPT \ + run ip46tables -A fwd-spec-nofrag -j ACCEPT \ -p tcp --source-port $port_ssh \ -m mark --mark $from_untrusted/$MASK_FROM \ -m state --state ESTABLISHED -- 2.11.0