[RFC] iptables: Add default net filters #2322
Conversation
Ray-future
force-pushed
the
iptables
branch
3 times, most recently
from
e612d46
to
73bd263
Compare
|
you should never force load conntrack modules by using nat table or conntrack match. this hurts. unless it's completely optional. |
|
Care to elaborate why it hurts so much? |
|
first. conntrack degrades network performance. may result in higher delays and low throughput second: as every outgoung packet would be tracked, and conntrack table has limited size - as soon you start something that makes lot of outgoing connections (transmission comes first in my mind), you may get "conntrack table full" errors and packets will be dropped. increasing conntrack table size is of course an option, but there is no one-value-fits-all configrations. it needs RAM and if not well tuned, lowmem devices will misbehave soon or later. |
|
@stefansaraev Nevertheless I'm very happy about your feedback about the rule sets. I get that there are hundreds of philosophies what to use and what not as filters. I will drop conntrack. |
Default: Only allow private subnets Don't overwrite rules from docker or connman Option to turn on/off through LE Settings addon
Default: Only allow private subnets
Don't overwrite rules from docker or connman wifi tether
An example how to turn on/off through LE Settings addon is available here:
Ray-future/service.libreelec.settings@d3e19e7
I can PR that too if we decide to this get's accepted. Filters are disabled by default and need to be enabled through LE settings addon.
Docker is restarted when the rules are reloaded or flushed otherwise it would break network connectivity in docker. Same for wifi tethering.
I have been using these rules in my community builds for a few months (enabled by default) without hearing any complaints about broken networks. I've just reworked the scripts a little bit the last few days so it will require some testing before it can be merged.