| Message ID | 1508358088-3833-1-git-send-email-dev@kresin.me |
|---|---|
| State | Changes Requested |
| Delegated to: | Mathias Kresin |
| Headers | show |
| Series | [LEDE-DEV] base-files: remove bridge firewalling defaults | expand |
On 2017-10-18 22:21, Mathias Kresin wrote: > Since Linux kernel 3.18-rc1, the settings are moved to br_netfilter. If > the kmod is installed and loaded one would most like expect that > {ip,ip6,arp}tables see bridged traffic. Unfortunately that is pulled in by kmod-ebtables. Not sure the dependency can be changed (and/or packages split up), or if we need to keep these. For ebtables, filtering via {ip,ip6,arp}tables is not necessary. - Felix
diff --git a/package/base-files/Makefile b/package/base-files/Makefile index 216e457..e6c53e9 100644 --- a/package/base-files/Makefile +++ b/package/base-files/Makefile @@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk include $(INCLUDE_DIR)/version.mk PKG_NAME:=base-files -PKG_RELEASE:=176 +PKG_RELEASE:=177 PKG_FLAGS:=nonshared PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/ diff --git a/package/base-files/files/etc/sysctl.conf b/package/base-files/files/etc/sysctl.conf index ddc7a9b..992385a 100644 --- a/package/base-files/files/etc/sysctl.conf +++ b/package/base-files/files/etc/sysctl.conf @@ -24,8 +24,3 @@ net.netfilter.nf_conntrack_max=16384 net.netfilter.nf_conntrack_tcp_timeout_established=7440 net.netfilter.nf_conntrack_udp_timeout=60 net.netfilter.nf_conntrack_udp_timeout_stream=180 - -# disable bridge firewalling by default -net.bridge.bridge-nf-call-arptables=0 -net.bridge.bridge-nf-call-ip6tables=0 -net.bridge.bridge-nf-call-iptables=0
Since Linux kernel 3.18-rc1, the settings are moved to br_netfilter. If the kmod is installed and loaded one would most like expect that {ip,ip6,arp}tables see bridged traffic. Fixes the following error messages reported in FS#1073 when running sysctl -p: sysctl: error: 'net.bridge.bridge-nf-call-arptables' is an unknown key sysctl: error: 'net.bridge.bridge-nf-call-ip6tables' is an unknown key sysctl: error: 'net.bridge.bridge-nf-call-iptables' is an unknown key Signed-off-by: Mathias Kresin <dev@kresin.me> --- package/base-files/Makefile | 2 +- package/base-files/files/etc/sysctl.conf | 5 ----- 2 files changed, 1 insertion(+), 6 deletions(-)