From dad380658e5cb8f7233bc5f8ab328a2959f9f6ce Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Tue, 6 Mar 2012 10:42:58 +0000 Subject: [PATCH] radius.m4: Forbid traffic directly to the NAT address. It should only be for forwarded traffic. --- radius.m4 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/radius.m4 b/radius.m4 index 7f0dc2c..e543878 100644 --- a/radius.m4 +++ b/radius.m4 @@ -69,5 +69,8 @@ run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23 run iptables -t nat -A outbound -j SNAT --to-source 62.49.204.158 run iptables -t nat -A POSTROUTING -j outbound +## Forbid anything complicated to the NAT address. +run iptables -A INPUT -d 62.49.204.158 ! -p icmp -j REJECT + m4_divert(-1) ###----- That's all, folks -------------------------------------------------- -- 2.11.0