Skip to content

Commit

Permalink
firewall: config: remove restictions on DHCPv6 allow rule
Browse files Browse the repository at this point in the history
Remove restrictions on source and destination addresses, which aren't
specified on RFC8415, and for some reason in openwrt are configured
to allow both link-local and ULA addresses.
As cleared out in issue openwrt#5066 there are some ISPs that use Gloabal
Unicast addresses, so fix this rule to allow them.

Fixes: openwrt#5066

Signed-off-by: Tiago Gaspar <tiagogaspar8@gmail.com>
[rebase onto firewall3, clarify subject, bump PKG_RELEASE]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  • Loading branch information
tiagogaspar8 authored and jow- committed May 4, 2022
1 parent 1daaef3 commit 65258f5
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 4 deletions.
2 changes: 1 addition & 1 deletion package/network/config/firewall/Makefile
Expand Up @@ -9,7 +9,7 @@
include $(TOPDIR)/rules.mk

PKG_NAME:=firewall
PKG_RELEASE:=2
PKG_RELEASE:=3

PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall3.git
Expand Down
4 changes: 1 addition & 3 deletions package/network/config/firewall/files/firewall.config
Expand Up @@ -54,13 +54,11 @@ config rule
option target ACCEPT

# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
# see https://github.com/openwrt/openwrt/issues/5066
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option src_ip fc00::/6
option dest_ip fc00::/6
option dest_port 546
option family ipv6
option target ACCEPT
Expand Down

0 comments on commit 65258f5

Please sign in to comment.