From 86a3fe1a88dce6531edb8653c45ff2477d6fa9d9 Mon Sep 17 00:00:00 2001
From: jow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73>
Date: Thu, 30 Jun 2011 12:22:05 +0000
Subject: [package] firewall: refine default ICMPv6 rules to better conform
 with RFC4890, do not forward link local ICMP message types, allow parameter
 problem

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27321 3c298f89-4303-0410-b956-a3cf2f4a3e73
---
 package/firewall/files/firewall.config | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

(limited to 'package')

diff --git a/package/firewall/files/firewall.config b/package/firewall/files/firewall.config
index c7bc798250..b47823fe2d 100644
--- a/package/firewall/files/firewall.config
+++ b/package/firewall/files/firewall.config
@@ -48,27 +48,16 @@ config rule
 	option src		wan
 	option dest		*
 	option proto		icmp
-	list icmp_type		router-solicitation
-	list icmp_type		router-advertisement
-	list icmp_type		neighbour-solicitation
-	list icmp_type		neighbour-advertisement
 	list icmp_type		echo-request
 	list icmp_type		destination-unreachable
 	list icmp_type		packet-too-big
 	list icmp_type		time-exceeded
+	list icmp_type		bad-header
+	list icmp_type		unknown-header-type
 	option limit		1000/sec
 	option family		ipv6
 	option target		ACCEPT
 
-# Drop leaking router advertisements on WAN
-config rule
-	option src		*
-	option dest		wan
-	option proto		icmp
-	option icmp_type	router-advertisement
-	option family		ipv6
-	option target		DROP
-
 # include a file with users custom iptables rules
 config include
 	option path /etc/firewall.user
-- 
cgit v1.2.3