firmware/src/packages/fff/fff-layer3/files/usr/lib/firewall.d/10-no-forward-wan

# Ensure nothing is forwarded onto WAN interface
if [ -n "$IF_WAN" ]; then
	iptables -A FORWARD -o $IF_WAN -j REJECT --reject-with icmp-net-unreachable
	ip6tables -A FORWARD -o $IF_WAN -j REJECT --reject-with no-route
fi
fff-gateway: Add firewall rules to ensure nothing is forwarded onto WAN Signed-off-by: Fabian Bläse <fabian@blaese.de> Reviewed-by: Christian Dresel <fff@chrisi01.de> Reviewed-by: Robert Langhammer <rlanghammer@web.de> 2019-09-10 22:09:01 +02:00			`# Ensure nothing is forwarded onto WAN interface`
firewall.d: Check for unset IF_WAN In some cases (mostly for one-port devices) IF_WAN was used although not set, resulting in not obviously iptables error messages like - Bad argument `conntrack' - Bad argument `REJECT' Thus, check whether IF_WAN is set to something before using it. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> Reviewed-by: Robert Langhammer <rlanghammer@web.de> 2019-10-09 18:27:05 +02:00			`if [ -n "$IF_WAN" ]; then`
			`iptables -A FORWARD -o $IF_WAN -j REJECT --reject-with icmp-net-unreachable`
			`ip6tables -A FORWARD -o $IF_WAN -j REJECT --reject-with no-route`
			`fi`