Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

vm/network: place anti-spoof rules in 'raw' table

Browse Source
This commit is contained in:
Marek Marczykowski 2012-03-03 01:30:04 +01:00
parent 720bc5c67e
commit 4d6899827d
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
network/vif-route-qubes
View File

@ -30,13 +30,13 @@ case "$command" in
ifconfig ${vif} up ifconfig ${vif} up
echo 1 >/proc/sys/net/ipv4/conf/${vif}/proxy_arp echo 1 >/proc/sys/net/ipv4/conf/${vif}/proxy_arp
ipcmd='replace' ipcmd='replace'
iptables_cmd='-I FORWARD 1' iptables_cmd='-I PREROUTING 1'
cmdprefix='' cmdprefix=''
;; ;;
offline) offline)
do_without_error ifdown ${vif} do_without_error ifdown ${vif}
ipcmd='del' ipcmd='del'
iptables_cmd='-D FORWARD' iptables_cmd='-D PREROUTING'
cmdprefix='do_without_error' cmdprefix='do_without_error'
;; ;;
esac esac
@ -47,7 +47,7 @@ if [ "${ip}" ] ; then
for addr in ${ip} ; do for addr in ${ip} ; do
${cmdprefix} ip route ${ipcmd} ${addr} dev ${vif} || true ${cmdprefix} ip route ${ipcmd} ${addr} dev ${vif} || true
done done
echo ${cmdprefix} iptables $iptables_cmd -i ${vif} \! -s ${ip} -j DROP echo ${cmdprefix} iptables -t raw $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
${cmdprefix} iptables $iptables_cmd -i ${vif} \! -s ${ip} -j DROP ${cmdprefix} iptables $iptables_cmd -i ${vif} \! -s ${ip} -j DROP
fi fi