mr/openwrt
2
0
Fork 1
Code Issues 7 Pull Requests Releases Wiki Activity
27,390 Commits 3 Branches 0 Tags 517 MiB
ae2c9a815a
Commit Graph

101 Commits

Author SHA1 Message Date
Steven Barth
97ea9e3c2a iptables/netfilter: add connlimit to conntrack-extra 
SVN-Revision: 39878
 2014-03-11 14:58:00 +00:00
Steven Barth
2e2c4c2dd3 Fix IPv6 NAT breaking older kernels 
SVN-Revision: 37891
 2013-09-03 06:29:46 +00:00
Steven Barth
0a85c59040 netfilter: Add IPv6-NAT support for kernel and ipt Thanks to Berni, Adam Novak and Sedat Dilek for patches and inspiration 
SVN-Revision: 37866
 2013-09-01 17:59:48 +00:00
Luka Perkov
e5e83478a9 netfilter: fix typo 
Signed-off-by: Luka Perkov <luka@openwrt.org>

SVN-Revision: 37821
 2013-08-21 23:17:08 +00:00
Felix Fietkau
c404cd5bfa netfilter: remove use of obsolete compatibility config symbols for mark and connmark 
fixes duplication of xt_mark and xt_connmark module entries

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

SVN-Revision: 37344
 2013-07-15 13:08:20 +00:00
Jo-Philipp Wich
8df6cd005c netfilter: move time, mark, set matches and MARK, REDIRECT, SET targets into base iptables package - drop iptables-mod-ipset 
SVN-Revision: 36683
 2013-05-21 12:58:15 +00:00
Steven Barth
ed083586aa netfilter: Fix typo in last commit 
SVN-Revision: 35899
 2013-03-07 09:30:52 +00:00
Steven Barth
62ea398cd8 iptables: Add missing IPv6 builtin modules 
SVN-Revision: 35898
 2013-03-07 08:48:41 +00:00
Gabor Juhos
b20cb26ed7 package/kernel: xt_NOTRACK has been removed in 3.7-rc1 
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 35475
 2013-02-04 10:02:52 +00:00
Jo-Philipp Wich
03a50b9087 netfilter.mk: add addrtype match to iptables-mod-extra (kmod-ipt-extra) 
SVN-Revision: 35155
 2013-01-14 16:12:56 +00:00
Florian Fainelli
3a57cd4929 netfilter: xt_NOTRACK is incorporated in xt_CT as of 3.8-rc3 
Signed-off-by: Florian Fainelli <florian@openwrt.org>

SVN-Revision: 35087
 2013-01-10 17:20:29 +00:00
John Crispin
b21458709a fix ipv4 nat on 3.7 by adding missing iptables modules 
SVN-Revision: 34841
 2012-12-22 10:17:29 +00:00
Gabor Juhos
cfc6489579 netfilter: fix module list for 3.7 kernel 
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>

SVN-Revision: 34750
 2012-12-18 14:50:42 +00:00
Jo-Philipp Wich
5ba9873914 netfilter.mk: extend nf_add macro to take a version dependency expression 
- nf_add now takes an optional 4th argument which specifies a kernel version dependency, e.g. "lt 3.7.0"
	- remove CompareKernelPatchVer conditionals around nf_add invocations, use version depends instead
	- fixes xt_LOG.ko packaging with Linux 3.6.0 and later

SVN-Revision: 34681
 2012-12-15 00:05:35 +00:00
Jo-Philipp Wich
8420783407 netfilter.mk: fix packaging of xt_LOG.ko, it moved between 3.3.8 and 3.6.x 
SVN-Revision: 34625
 2012-12-11 09:53:50 +00:00
Hauke Mehrtens
d648dad7fa kernel: fix loading of nf_nat_irc 
nf_nat_irc depends on nf_conntrack_irc and it should be defined after that.
This fixes a problem introduced in r34247.

SVN-Revision: 34251
 2012-11-18 21:18:37 +00:00
Imre Kaloz
935ca3f3eb add 3.7-rc6 support (patch 820 still has to be fixed) 
SVN-Revision: 34247
 2012-11-18 18:52:38 +00:00
Felix Fietkau
d406a5208f include/netfilter.mk: remove a few obsolete lines 
SVN-Revision: 33518
 2012-09-23 08:25:32 +00:00
Felix Fietkau
cfe79471d1 kmod-ipt-nathelper-extra: fix missing nf_conntrack_broadcast.ko 
kmod-ipt-nathelper-extra is missing the package nf_conntrack_broadcast.ko

if it is not included into the kmod-ipt-nathelper-extra packge the modules
nf_conntrack_snmp and nf_nat_snmp_basic cant get loaded:

[   44.500000] nf_conntrack_snmp: Unknown symbol nf_conntrack_broadcast_help (err 0)
[   44.664000] nf_nat_snmp_basic: Unknown symbol nf_nat_snmp_hook (err 0)

Signed-off-by: Peter Wagner <tripolar@gmx.at>

SVN-Revision: 32434
 2012-06-18 23:30:48 +00:00
Felix Fietkau
b4b60ab62f include/netfilter.mk: clean up, remove junk for old kernel versions 
SVN-Revision: 32114
 2012-06-07 16:30:48 +00:00
Jo-Philipp Wich
e6af9d374a fix ipt_ttl and ipt_TTL userspace library packaging 
SVN-Revision: 30897
 2012-03-12 02:07:22 +00:00
Jonas Gorski
c336de3d85 kernel: update module names and add new config symbols for linux 3.3 
SVN-Revision: 29985
 2012-02-02 08:23:44 +00:00
Jo-Philipp Wich
a529e3f09e add CT target and TTL/HL match+target 
This patch adds the CT target for conntrack (enables manipulation of
conntrack events and supercedes NOTRACK) as well as the TTL/HL target and
match.

SVN-Revision: 29645
 2012-01-04 02:52:54 +00:00
Jo-Philipp Wich
a788f199c9 remove current RTSP support 
SVN-Revision: 29643
 2012-01-04 00:29:29 +00:00
Jo-Philipp Wich
2ad90a1ec3 package CT target 
SVN-Revision: 29609
 2011-12-25 13:32:53 +00:00
Felix Fietkau
1027d262ef netfilter.mk: remove a few obsolete CompareKernelPatchVer calls 
SVN-Revision: 27086
 2011-06-01 18:08:12 +00:00
Jo-Philipp Wich
be906f6be5 package u32 match and TEE target, patches by Maxim Uvarov 
SVN-Revision: 26977
 2011-05-24 08:14:29 +00:00
Jo-Philipp Wich
a9977eca91 firewall: allow local redirection of ports 
Allow a redirect like:

config redirect
        option src 'wan'
        option dest 'lan'
        option src_dport '22001'
        option dest_port '22'
        option proto 'tcp'

note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself.

This patch makes three changes:

(1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers).
(2) fixes a bug where the wrong table is used when the "dest_ip" field is absent.
(3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted
    connections.

In the above example,

ssh -p 22 root@myrouter

would fail from the outside, but:

ssh -p 22001 root@myrouter

would succeed.  This is handy if:

(1) you want to avoid ssh probes on your router, or
(2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but
    still want to allow firewall access from outside.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

SVN-Revision: 26617
 2011-04-12 20:03:59 +00:00
Hauke Mehrtens
24c1caef5f iipt-debug: create bundle of netfilter modules for debugging 
Add a bundle for including commonly useful modules for IPtables debugging and development.

For now, it just contains xt_TRACE.ko

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

SVN-Revision: 26567
 2011-04-09 23:23:46 +00:00
Florian Fainelli
5959cd2850 add kmod-ipt-led 
Netfilter LED target triggers blinkenlichten when a network packet hits
a rule.

LED target requires iptables 1.4.9 or higher

Signed-off-by: Łukasz Stelmach <stlman@poczta.fm>

SVN-Revision: 26451
 2011-04-03 18:30:37 +00:00
Felix Fietkau
c864843cbf netfilter.mk: put ipv6 conntrack in the right package 
SVN-Revision: 25750
 2011-02-27 11:22:30 +00:00
Felix Fietkau
2d14f4e2f8 netfilter: add missing modules for v6 conntrack (patch from #8940) 
SVN-Revision: 25731
 2011-02-26 15:50:01 +00:00
Felix Fietkau
831e597d7c move nf_{conntrack,nat}_tftp to ipt-nathelper-extra, most people don't need this 
SVN-Revision: 25722
 2011-02-26 00:35:22 +00:00
Felix Fietkau
9dad83362d kernel: remove imq support, refresh patches 
SVN-Revision: 25641
 2011-02-21 02:06:51 +00:00
Jo-Philipp Wich
d2d990e41e netfilter.mk: fix connmark packaging for Kernels >= 2.6.35, thanks Daniel Gimpelevich 
SVN-Revision: 24729
 2010-12-19 16:47:30 +00:00
Jo-Philipp Wich
c32a125607 netfilter: workaround a userspace/kernel mismatch on Linux 2.6.35 and later 
SVN-Revision: 23521
 2010-10-18 20:39:07 +00:00
Alexandros C. Couloumbis
57d2e57b02 finalize r22241 fixes 
SVN-Revision: 22242
 2010-07-17 08:50:19 +00:00
Jo-Philipp Wich
91468dcf4f package TPROXY target and module infrastructure 
SVN-Revision: 21883
 2010-06-22 22:39:22 +00:00
Alexandros C. Couloumbis
b6e28298fe include/netfilter.mk fix typo on r21795 
SVN-Revision: 21796
 2010-06-14 14:51:51 +00:00
Alexandros C. Couloumbis
e491939c70 include/netfilter.mk: add 2.6.35 kernel support 
SVN-Revision: 21795
 2010-06-14 14:44:27 +00:00
Nicolas Thill
aa8e2e8685 netfilter: extension fixes (partially closes: #7045) * add missing xt_owner (2.6) * enable ipt_quota (2.4), disabled in [8499] is building fine with recent iptables * add missing ipt_nat_tftp (2.4) * add missing nf_nat_amanda (2.6) 
SVN-Revision: 20693
 2010-04-04 12:35:06 +00:00
Nicolas Thill
1b0a9b51c4 include/netfilter.mk: move ebtables definitions at the end 
SVN-Revision: 20690
 2010-04-04 03:43:13 +00:00
Jo-Philipp Wich
42e453a2e3 properly package xt_comment.ko (#6742) 
SVN-Revision: 19861
 2010-02-26 00:23:39 +00:00
Jo-Philipp Wich
15c4e22d31 netfilter: add support for raw table and NOTRACK target (#5504) 
SVN-Revision: 19721
 2010-02-19 01:36:47 +00:00
Jo-Philipp Wich
e830181f47 iptables: add comment match to the core package 
SVN-Revision: 18706
 2009-12-08 20:52:58 +00:00
Nicolas Thill
72dbf7cdca netfilter: remove IPset leftovers missed from [17844] 
SVN-Revision: 18032
 2009-10-11 14:08:31 +00:00
Hauke Mehrtens
e014faf13f Update ipset to version 3.2 
SVN-Revision: 17764
 2009-09-27 15:03:41 +00:00
Florian Fainelli
0e783dde14 split ebtables packages and modules into ebtables ipv4/6 and watchers (#5001) 
SVN-Revision: 16980
 2009-07-25 19:47:48 +00:00
Florian Fainelli
a06b20f5b3 fix ip6tables installation against ip6t_HL which has been merged in xt_HL since 2.6.29 (#5568) 
SVN-Revision: 16964
 2009-07-24 11:52:30 +00:00
Felix Fietkau
11b33255ed netfilter: move iptable_raw, xt_NOTRACK from conntrack-extra to conntrack 
SVN-Revision: 15854
 2009-05-14 21:46:33 +00:00