From 071a0c2b301d577194d846a59a7695c196df06dc Mon Sep 17 00:00:00 2001
From: Pengfei Ni <feiskyer@gmail.com>
Date: Fri, 20 May 2016 16:20:45 +0800
Subject: [PATCH] Enable icmp by default

---
 src/portmapping.c | 54 +++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/src/portmapping.c b/src/portmapping.c
index 777854e..9b11505 100644
--- a/src/portmapping.c
+++ b/src/portmapping.c
@@ -78,7 +78,10 @@ int hyper_setup_portmapping(struct hyper_pod *pod)
 	// iptables -t nat -N hyperstart-PREROUTING
 	// iptables -t filter -I INPUT -j hyperstart-INPUT
 	// iptables -t nat -I PREROUTING -j hyperstart-PREROUTING
-	// iptables -t filter -A hyperstart-INPUT -j DROP 
+	// iptables -t filter -A hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+	// iptables -t filter -A hyperstart-INPUT -p icmp -j ACCEPT
+	// iptables -t filter -A hyperstart-INPUT -i lo -j ACCEPT
+	// iptables -t filter -A hyperstart-INPUT -j DROP
 	// iptables -t nat -A hyperstart-PREROUTING -j RETURN
 	const struct ipt_rule rules[] = {
 		{
@@ -105,6 +108,24 @@ int hyper_setup_portmapping(struct hyper_pod *pod)
 			.chain = "PREROUTING",
 			.rule = "-j hyperstart-PREROUTING",
 		},
+		{
+			.table = "filter",
+			.op = "-A",
+			.chain = "hyperstart-INPUT",
+			.rule = "-m state --state RELATED,ESTABLISHED -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-A",
+			.chain = "hyperstart-INPUT",
+			.rule = "-p icmp -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-A",
+			.chain = "hyperstart-INPUT",
+			.rule = "-i lo -j ACCEPT",
+		},
 		{
 			.table = "filter",
 			.op = "-A",
@@ -135,9 +156,12 @@ void hyper_cleanup_portmapping(struct hyper_pod *pod)
 		return;
 	}
 
-	// iptables -t filter -D hyperstart-INPUT -j DROP 
-	// iptables -t nat -D hyperstart-PREROUTING -j RETURN
+	// iptables -t filter -D hyperstart-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+	// iptables -t filter -D hyperstart-INPUT -p icmp -j ACCEPT
+	// iptables -t filter -D hyperstart-INPUT -i lo -j ACCEPT
+	// iptables -t filter -D hyperstart-INPUT -j DROP
 	// iptables -t filter -D INPUT -j hyperstart-DNPUT
+	// iptables -t nat -D hyperstart-PREROUTING -j RETURN
 	// iptables -t nat -D PREROUTING -j hyperstart-PREROUTING
 	// iptables -t filter -F hyperstart-INPUT
 	// iptables -t nat -F hyperstart-PREROUTING
@@ -145,10 +169,22 @@ void hyper_cleanup_portmapping(struct hyper_pod *pod)
 	// iptables -t nat -X hyperstart-PREROUTING
 	const struct ipt_rule rules[] = {
 		{
-			.table = "nat",
+			.table = "filter",
 			.op = "-D",
-			.chain = "hyperstart-PREROUTING",
-			.rule = "-j RETURN",
+			.chain = "hyperstart-INPUT",
+			.rule = "-m state --state RELATED,ESTABLISHED -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-D",
+			.chain = "hyperstart-INPUT",
+			.rule = "-p icmp -j ACCEPT",
+		},
+		{
+			.table = "filter",
+			.op = "-D",
+			.chain = "hyperstart-INPUT",
+			.rule = "-i lo -j ACCEPT",
 		},
 		{
 			.table = "filter",
@@ -156,6 +192,12 @@ void hyper_cleanup_portmapping(struct hyper_pod *pod)
 			.chain = "hyperstart-INPUT",
 			.rule = "-j DROP",
 		},
+		{
+			.table = "nat",
+			.op = "-D",
+			.chain = "hyperstart-PREROUTING",
+			.rule = "-j RETURN",
+		},
 		{
 			.table = "nat",
 			.op = "-D",