Changeset 4660f56 for postlfs/security

Timestamp:

08/24/2023 02:26:54 PM (9 months ago)

Author:

Pierre Labastie <pierre.labastie@…>

Branches:

12.0, 12.1, ken/TL2024, ken/tuningfonts, lazarus, plabs/newcss, python3.11, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, xry111/llvm18

Children:

5a0c70cb

Parents:

746aa49

Message:

Drop multicast and broadcast packets in iptables

The reason is that our own box can output those kind of packets
rather frequently, and those packets immediately appear as
incoming. Since any non expected packet is logged, this clutters
the log. Dropping them in the "personal firewall" case is what is
wanted, but it has to be done before logging.

File:

• postlfs/security/iptables.xml (modified) (1 diff)

postlfs/security/iptables.xml

@@ -286 +286 @@
 iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
+# Drop any incoming MULTICAST or BROADCAST packet before logging:
+# The box outputs several of them when using netbios or mDNS, and those
+# appear immediately as incoming, which clutters the log.
+iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
+
 # Log everything else.
 iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "