clearlinux/hyperstart
2
0
Fork 0
mirror of https://github.com/clearlinux/hyperstart.git synced 2026-09-04 12:41:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable icmp by default

Browse Source
This commit is contained in:
Pengfei Ni
2016-05-29 09:19:06 +00:00
parent c4f9764556
commit 071a0c2b30
1 changed files with 48 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/portmapping.c
+48 -6
View File
@@ -78,7 +78,10 @@ int hyper_setup_portmapping(struct hyper_pod *pod)
// iptables -t nat -N hyperstart-PREROUTING
// iptables -t filter -I INPUT -j hyperstart-INPUT
// iptables -t nat -I PREROUTING -j hyperstart-PREROUTING
// iptables -t filter -A hyperstart-INPUT -j DROP
// iptables -t filter -A hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
// iptables -t filter -A hyperstart-INPUT -p icmp -j ACCEPT
// iptables -t filter -A hyperstart-INPUT -i lo -j ACCEPT
// iptables -t filter -A hyperstart-INPUT -j DROP
// iptables -t nat -A hyperstart-PREROUTING -j RETURN
const struct ipt_rule rules[] = {
{
@@ -105,6 +108,24 @@ int hyper_setup_portmapping(struct hyper_pod *pod)
.chain = "PREROUTING",
.rule = "-j hyperstart-PREROUTING",
},
{
.table = "filter",
.op = "-A",
.chain = "hyperstart-INPUT",
.rule = "-m state --state RELATED,ESTABLISHED -j ACCEPT",
},
{
.table = "filter",
.op = "-A",
.chain = "hyperstart-INPUT",
.rule = "-p icmp -j ACCEPT",
},
{
.table = "filter",
.op = "-A",
.chain = "hyperstart-INPUT",
.rule = "-i lo -j ACCEPT",
},
{
.table = "filter",
.op = "-A",
@@ -135,9 +156,12 @@ void hyper_cleanup_portmapping(struct hyper_pod *pod)
return;
}
// iptables -t filter -D hyperstart-INPUT -j DROP
// iptables -t nat -D hyperstart-PREROUTING -j RETURN
// iptables -t filter -D hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
// iptables -t filter -D hyperstart-INPUT -p icmp -j ACCEPT
// iptables -t filter -D hyperstart-INPUT -i lo -j ACCEPT
// iptables -t filter -D hyperstart-INPUT -j DROP
// iptables -t filter -D INPUT -j hyperstart-DNPUT
// iptables -t nat -D hyperstart-PREROUTING -j RETURN
// iptables -t nat -D PREROUTING -j hyperstart-PREROUTING
// iptables -t filter -F hyperstart-INPUT
// iptables -t nat -F hyperstart-PREROUTING
@@ -145,10 +169,22 @@ void hyper_cleanup_portmapping(struct hyper_pod *pod)
// iptables -t nat -X hyperstart-PREROUTING
const struct ipt_rule rules[] = {
{
.table = "nat",
.table = "filter",
.op = "-D",
.chain = "hyperstart-PREROUTING",
.rule = "-j RETURN",
.chain = "hyperstart-INPUT",
.rule = "-m state --state RELATED,ESTABLISHED -j ACCEPT",
},
{
.table = "filter",
.op = "-D",
.chain = "hyperstart-INPUT",
.rule = "-p icmp -j ACCEPT",
},
{
.table = "filter",
.op = "-D",
.chain = "hyperstart-INPUT",
.rule = "-i lo -j ACCEPT",
},
{
.table = "filter",
@@ -156,6 +192,12 @@ void hyper_cleanup_portmapping(struct hyper_pod *pod)
.chain = "hyperstart-INPUT",
.rule = "-j DROP",
},
{
.table = "nat",
.op = "-D",
.chain = "hyperstart-PREROUTING",
.rule = "-j RETURN",
},
{
.table = "nat",
.op = "-D",