summaryrefslogtreecommitdiffstats
path: root/lass/2configs
diff options
context:
space:
mode:
authorlassulus <lass@aidsballs.de>2016-11-26 19:10:23 +0100
committerlassulus <lass@aidsballs.de>2016-11-26 19:10:23 +0100
commit2b42e312d9c709701b7ba41f569e2041b1f975b8 (patch)
tree49e20b2a5157b2a95edff607aa6fe53e820e2673 /lass/2configs
parent2070da74ab09d5dacaf62c3d8a72adab41c0be37 (diff)
l 2: reject the correct way with iptables
Diffstat (limited to 'lass/2configs')
-rw-r--r--lass/2configs/default.nix4
1 files changed, 3 insertions, 1 deletions
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index a7d2a6cef..21a2ec038 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -194,7 +194,9 @@ with import <stockholm/lib>;
{ predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
{ predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
- { predicate = "-i retiolum"; target = "REJECT"; precedence = -10000; }
+ { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; precedence = -10000; }
+ { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; precedence = -10000; }
+ { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; precedence = -10000; }
];
};
};