From 52e15e072cffac09ee7fe389ea49d968e648f1f4 Mon Sep 17 00:00:00 2001 From: Fabian Blaese Date: Sun, 2 Aug 2020 19:55:00 +0200 Subject: [PATCH] fff-firewall: Remove ssh firewall on WAN interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This firewall was introduced as a countermeasure for very slow routers directly connected to the internet without any firewall. Our routers have got quite a bit faster since then. Also, a setup like this is highly uncommon, especially for slower routers. Therefore this firewall rule is removed. Fixes: #138 Signed-off-by: Fabian Bläse Reviewed-by: Adrian Schmutzler Reviewed-by: Robert Langhammer [bump PKG_RELEASE] Signed-off-by: Adrian Schmutzler --- src/packages/fff/fff-firewall/Makefile | 2 +- .../fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh | 6 ------ 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/src/packages/fff/fff-firewall/Makefile b/src/packages/fff/fff-firewall/Makefile index 56543331..30f2de5b 100644 --- a/src/packages/fff/fff-firewall/Makefile +++ b/src/packages/fff/fff-firewall/Makefile @@ -1,7 +1,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=fff-firewall -PKG_RELEASE:=4 +PKG_RELEASE:=5 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME) diff --git a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh index aa04ce93..bb18657f 100644 --- a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh +++ b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh @@ -1,9 +1,3 @@ -# If an router has a direct internet connection simple attack act as DOS attack -if [ -n "$IF_WAN" ]; then - iptables -A INPUT -i $IF_WAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - iptables -A INPUT -i $IF_WAN -j REJECT -fi - # Limit ssh to 6 new connections per 60 seconds /usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name dropbear /usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --rttl --name dropbear -j DROP