Qubes/core-agent-linux
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

network: use more strict policy about incoming traffic

Browse Source 
Do not allow ICMP from uplink VM (or the outside world). Also do not
send ICMP icmp-host-prohibited to the uplink.

Fixes QubesOS/qubes-issues#1346
This commit is contained in:
Marek Marczykowski-Górecki 2015-12-30 02:09:23 +01:00
parent 7835f4da2b
commit b9e51f9ab3
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
network/iptables
View File

@ -19,9 +19,10 @@ COMMIT
:OUTPUT ACCEPT [128:12536]
-A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i vif+ -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -i vif+ -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j DROP
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i vif+ -o vif+ -j DROP
-A FORWARD -i vif+ -j ACCEPT