Skip to content
This repository has been archived by the owner on May 21, 2024. It is now read-only.

Commit

Permalink
unblock v6 network segment but isolate local node address
Browse files Browse the repository at this point in the history
As $addr6 contains a /64 all outgoing v6 traffic to the network was blocked. Now we cut off all netmask values and replace them with /128 for the v6 local node address.
  • Loading branch information
kerlerm committed Nov 22, 2018
1 parent b4d6949 commit 4697024
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions files/etc/uci-defaults/50_freifunk-setup
Original file line number Diff line number Diff line change
Expand Up @@ -142,8 +142,9 @@ initial_local_node_setup()
ebtables -A OUTPUT --logical-out br-freifunk -o bat0 -p IPv4 --ip-source $addr4 -j DROP
# Isolate local-node IPv6 address
ebtables -A FORWARD --logical-out br-freifunk -o bat0 -p IPv6 --ip6-dst $addr6 -j DROP
ebtables -A OUTPUT --logical-out br-freifunk -o bat0 -p IPv6 --ip6-dst $addr6 -j DROP
# WARNING - wrong setting here can cause Autoupdater to be blocked - WARNING
ebtables -A FORWARD --logical-out br-freifunk -o bat0 -p IPv6 --ip6-dst ${addr6%/*}/128 -j DROP
ebtables -A FORWARD --logical-out br-freifunk -o bat0 -p IPv6 --ip6-dst ${addr6%/*}/128 -j DROP
EOF
}

Expand Down

0 comments on commit 4697024

Please sign in to comment.