diff options
| author | lassulus <lass@aidsballs.de> | 2016-11-26 19:10:23 +0100 |
|---|---|---|
| committer | lassulus <lass@aidsballs.de> | 2016-11-26 19:10:23 +0100 |
| commit | 2b42e312d9c709701b7ba41f569e2041b1f975b8 (patch) | |
| tree | 49e20b2a5157b2a95edff607aa6fe53e820e2673 | |
| parent | 2070da74ab09d5dacaf62c3d8a72adab41c0be37 (diff) | |
l 2: reject the correct way with iptables
| -rw-r--r-- | lass/2configs/default.nix | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index a7d2a6cef..21a2ec038 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -194,7 +194,9 @@ with import <stockholm/lib>; { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; } { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; } { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; } - { predicate = "-i retiolum"; target = "REJECT"; precedence = -10000; } + { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; precedence = -10000; } + { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; precedence = -10000; } + { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; precedence = -10000; } ]; }; }; |