fff-firewall: Remove ssh firewall on WAN interface

This firewall was introduced as a countermeasure for very slow routers
directly connected to the internet without any firewall.

Our routers have got quite a bit faster since then. Also, a setup like
this is highly uncommon, especially for slower routers.

Therefore this firewall rule is removed.

Fixes: #138
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
[bump PKG_RELEASE]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit is contained in:
Fabian Bläse 2020-08-02 19:55:00 +02:00 committed by Adrian Schmutzler
parent c91e2d03ec
commit 52e15e072c
2 changed files with 1 additions and 7 deletions

View File

@ -1,7 +1,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=fff-firewall
PKG_RELEASE:=4
PKG_RELEASE:=5
PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)

View File

@ -1,9 +1,3 @@
# If an router has a direct internet connection simple attack act as DOS attack
if [ -n "$IF_WAN" ]; then
iptables -A INPUT -i $IF_WAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IF_WAN -j REJECT
fi
# Limit ssh to 6 new connections per 60 seconds
/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name dropbear
/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --rttl --name dropbear -j DROP