Skip to content

Commit

Permalink
Disable BOGON processing for IPv4 and IPv6
Browse files Browse the repository at this point in the history
BOGONs are having issues in both IPv4 and IPv6 on router and non-router
hosts, so disable all BOGON processing for the time being.

Relates to #1
  • Loading branch information
jonathanio committed Oct 4, 2023
1 parent aff9981 commit c58f859
Showing 1 changed file with 13 additions and 3 deletions.
16 changes: 13 additions & 3 deletions templates/parts/firewall-raw-check-bogons.rsc.t
Original file line number Diff line number Diff line change
Expand Up @@ -13,74 +13,84 @@
add chain="$runId:check:bogons" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all networks for temporary bypassing of RAW rules (when enabled)"
add chain="$runId:check:bogons" \
in-interface-list="external" \
src-address-list="!$runId:bogons:block" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets from non-bogus network addresses via external interfaces"
add chain="$runId:check:bogons" \
in-interface-list="internal" \
src-address-list="$runId:bogons:allow" \
dst-address-list="$runId:bogons:allow" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets between accepted bogon network addresses (i.e. known local private networks)"
add chain="$runId:check:bogons" \
in-interface-list="internal" \
src-address-list="$runId:bogons:allow" \
dst-address-list="$runId:bogons:casting" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets between accepted bogon network addresses and casting (broadcast, multicast) addresses"
add chain="$runId:check:bogons" \
in-interface-list="internal" \
src-address-list="$runId:bogons:allow" \
dst-address-list="!$runId:bogons:block" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets from local private networks to non-bogus network addresses"
add chain="$runId:check:bogons" \
src-address-list="$runId:bogons:block" \
action=drop \
disabled=yes \
comment="DROP all other packets to bogus network addresses"
add chain="$runId:check:bogons" \
dst-address-list="$runId:bogons:block" \
action=drop \
disabled=yes \
comment="DROP all other packets from bogus network addresses"
/ipv6 firewall raw
add chain="$runId:check:bogons" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets during testing or emergencies"
comment="RETURN (Provisionally ACCEPT) all networks for temporary bypassing of RAW rules (when enabled)"
add chain="$runId:check:bogons" \
in-interface-list="external" \
src-address-list="!$runId:bogons:block" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets from non-bogus network addresses via external interfaces"
add chain="$runId:check:bogons" \
in-interface-list="internal" \
src-address-list="$runId:bogons:allow" \
dst-address-list="$runId:bogons:allow" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets between accepted bogon network addresses (i.e. known local private networks, broadcasts)"
add chain="$runId:check:bogons" \
in-interface-list="internal" \
src-address-list="$runId:bogons:allow" \
dst-address-list="$runId:bogons:casting" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets between accepted bogon network addresses and casting (broadcast, multicast) addresses"
add chain="$runId:check:bogons" \
in-interface-list="internal" \
src-address-list="$runId:bogons:allow" \
dst-address-list="!$runId:bogons:block" \
action=return \
disabled=yes \
comment="RETURN (Provisionally ACCEPT) all packets from local private networks to non-bogus network addresses"
add chain="$runId:check:bogons" \
src-address-list="$runId:bogons:block" \
action=drop \
disabled=yes \
comment="DROP all other packets to bogus network addresses"
add chain="$runId:check:bogons" \
dst-address-list="$runId:bogons:block" \
action=drop \
disabled=yes \
comment="DROP all other packets from bogus network addresses"

0 comments on commit c58f859

Please sign in to comment.