From 69407cb0136fb6a04b21a00aa6768c45fed00060 Mon Sep 17 00:00:00 2001 From: Nikolay Amiantov Date: Wed, 29 Aug 2018 21:50:53 +0300 Subject: [PATCH] firewall service: respect marks in rpfilter (#39054) This allows one to add rules which change a packet's routing table: iptables -t raw -I PREROUTING 1 -m set --match-set myset src -j MARK --set-mark 2 ip rule add fwmark 2 table 1 priority 1000 ip route add default dev wg0 table 1 to the beginning of raw table PREROUTING chain, and still have rpfilter. --- nixos/modules/services/networking/firewall.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 36f1dd8d247..86463f276c6 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -123,7 +123,7 @@ let # Perform a reverse-path test to refuse spoofers # For now, we just drop, as the raw table doesn't have a log-refuse yet ip46tables -t raw -N nixos-fw-rpfilter 2> /dev/null || true - ip46tables -t raw -A nixos-fw-rpfilter -m rpfilter ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN + ip46tables -t raw -A nixos-fw-rpfilter -m rpfilter --validmark ${optionalString (cfg.checkReversePath == "loose") "--loose"} -j RETURN # Allows this host to act as a DHCP4 client without first having to use APIPA iptables -t raw -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN