From c31ac521e420aa0cfd3ddbc0859b29b0e2a3ff3e Mon Sep 17 00:00:00 2001
From: mbm <mbm@3c298f89-4303-0410-b956-a3cf2f4a3e73>
Date: Sun, 6 Feb 2005 00:52:16 +0000
Subject: openwrt root filesystem

git-svn-id: svn://svn.openwrt.org/openwrt/trunk/openwrt@211 3c298f89-4303-0410-b956-a3cf2f4a3e73
---
 .../default/target_skeleton/etc/init.d/S45firewall | 23 ++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100755 target/default/target_skeleton/etc/init.d/S45firewall

(limited to 'target/default/target_skeleton/etc/init.d/S45firewall')

diff --git a/target/default/target_skeleton/etc/init.d/S45firewall b/target/default/target_skeleton/etc/init.d/S45firewall
new file mode 100755
index 0000000000..49b9df0004
--- /dev/null
+++ b/target/default/target_skeleton/etc/init.d/S45firewall
@@ -0,0 +1,23 @@
+#!/bin/sh
+. /etc/functions.sh
+
+WAN=$(nvram get wan_ifname)
+
+IPT=/usr/sbin/iptables
+
+for T in filter nat mangle ; do
+  $IPT -t $T -F
+  $IPT -t $T -X
+done
+
+$IPT -t filter -A INPUT -m state --state INVALID -j DROP
+$IPT -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
+$IPT -t filter -A INPUT -p icmp -j ACCEPT 
+$IPT -t filter -A INPUT -i $WAN -p tcp -j REJECT --reject-with tcp-reset 
+$IPT -t filter -A INPUT -i $WAN -j REJECT --reject-with icmp-port-unreachable 
+$IPT -t filter -A FORWARD -m state --state INVALID -j DROP 
+$IPT -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
+$IPT -t filter -A FORWARD -i $WAN -m state --state NEW,INVALID -j DROP
+$IPT -t filter -A FORWARD -o $WAN -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+
+$IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE
-- 
cgit v1.2.3