port [6229] to kamikaze

SVN-Revision: 6275

diff --git a/package/iptables/files/firewall.init b/package/iptables/files/firewall.init
index a4014f3ee71e4fe3ae584e5a4d4eaa0373cdb8ef..290bae1eacc48c5d1afc24bb9f4a24c5dcfc40fa 100755 (executable)
--- a/package/iptables/files/firewall.init
+++ b/package/iptables/files/firewall.init
@@ -22,7 +22,8 @@ start() {
        iptables -N output_rule
        iptables -N forwarding_rule
        iptables -N forwarding_wan
-       
+
+       iptables -t nat -N NEW
        iptables -t nat -N prerouting_rule
        iptables -t nat -N prerouting_wan
        iptables -t nat -N postrouting_rule
@@ -99,11 +100,15 @@ start() {
        # uses the default -P DROP
        
        ### MASQ
+       iptables -t nat -A PREROUTING -m state --state NEW -j NEW 
        iptables -t nat -A PREROUTING -j prerouting_rule
        [ -z "$WAN" ] || iptables -t nat -A PREROUTING -i "$WAN" -j prerouting_wan
        iptables -t nat -A POSTROUTING -j postrouting_rule
        [ -z "$WAN" ] || iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
-       
+
+       iptables -t nat -A NEW -m limit --limit 50 --limit-burst 100 -j RETURN && \
+               iptables -t nat -A NEW -j DROP
+
        ## USER RULES
        [ -f /etc/firewall.user ] && . /etc/firewall.user
        [ -n "$WAN" -a -e /etc/config/firewall ] && {

diff --git a/target/linux/ar7-2.4/config b/target/linux/ar7-2.4/config
index 1a58465d882ff43fe58f7bf1872a60e4b9ed6e57..0729197d00ae1e1010d1f7fe3225fef66c34a55d 100644 (file)
--- a/target/linux/ar7-2.4/config
+++ b/target/linux/ar7-2.4/config
@@ -352,7 +352,7 @@ CONFIG_IP_NF_MMS=m
 CONFIG_IP_NF_RTSP=m
 CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=y
-CONFIG_IP_NF_MATCH_LIMIT=m
+CONFIG_IP_NF_MATCH_LIMIT=y
 CONFIG_IP_NF_MATCH_QUOTA=m
 CONFIG_IP_NF_SET=m
 CONFIG_IP_NF_SET_MAX=256
@@ -434,7 +434,7 @@ CONFIG_IPV6=m
 #
 CONFIG_IP6_NF_QUEUE=m
 CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_LIMIT=m
+CONFIG_IP6_NF_MATCH_LIMIT=y
 CONFIG_IP6_NF_MATCH_CONDITION=m
 CONFIG_IP6_NF_MATCH_MAC=m
 # CONFIG_IP6_NF_MATCH_RT is not set

diff --git a/target/linux/aruba-2.6/config b/target/linux/aruba-2.6/config
index debebd146fc3f17136d3b3e002c4b854602a4e98..55833fd81402c47ca871e826e4ec517b028ba97d 100644 (file)
--- a/target/linux/aruba-2.6/config
+++ b/target/linux/aruba-2.6/config
@@ -721,7 +721,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/atheros-2.6/config b/target/linux/atheros-2.6/config
index 52c4d7a23d3c32a720d64f2da2a8c6e09debb858..6852dc6b3bfb5fc1eb1a771b01f0a3dc26a6ad46 100644 (file)
--- a/target/linux/atheros-2.6/config
+++ b/target/linux/atheros-2.6/config
@@ -720,7 +720,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/au1000-2.6/config b/target/linux/au1000-2.6/config
index eba8c5eed378597bb76ff8df3d386a4f4cd4ba81..a25ef0477de8442728504b8f151d8881152e12a1 100644 (file)
--- a/target/linux/au1000-2.6/config
+++ b/target/linux/au1000-2.6/config
@@ -367,7 +367,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_POLICY=m

diff --git a/target/linux/brcm-2.4/config b/target/linux/brcm-2.4/config
index 91bd41ac9dbfdd132d4e639c595355063141d540..fd52f4dcac8527958a87d365eb23ac9777c1dc66 100644 (file)
--- a/target/linux/brcm-2.4/config
+++ b/target/linux/brcm-2.4/config
@@ -366,7 +366,7 @@ CONFIG_IP_NF_RTSP=m
 CONFIG_IP_NF_MMS=m
 CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=y
-CONFIG_IP_NF_MATCH_LIMIT=m
+CONFIG_IP_NF_MATCH_LIMIT=y
 CONFIG_IP_NF_MATCH_QUOTA=m
 CONFIG_IP_NF_SET=m
 CONFIG_IP_NF_SET_MAX=256
@@ -468,7 +468,7 @@ CONFIG_IPV6=m
 #
 CONFIG_IP6_NF_QUEUE=m
 CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_LIMIT=m
+CONFIG_IP6_NF_MATCH_LIMIT=y
 CONFIG_IP6_NF_MATCH_CONDITION=m
 CONFIG_IP6_NF_MATCH_MAC=m
 # CONFIG_IP6_NF_MATCH_RT is not set

diff --git a/target/linux/brcm-2.6/config b/target/linux/brcm-2.6/config
index 7e5e4a092284e54e21af0b460fdd1f38fc23549a..e392959186f686628cc12ee5571d70e5726b2b51 100644 (file)
--- a/target/linux/brcm-2.6/config
+++ b/target/linux/brcm-2.6/config
@@ -377,7 +377,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_POLICY=m

diff --git a/target/linux/brcm47xx-2.6/config b/target/linux/brcm47xx-2.6/config
index e55b2af326548c45faad9b35703d363d6e790331..6c682551aa1e14aa28759bfcab9d8c8962cf0ce8 100644 (file)
--- a/target/linux/brcm47xx-2.6/config
+++ b/target/linux/brcm47xx-2.6/config
@@ -708,7 +708,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/brcm63xx-2.6/config b/target/linux/brcm63xx-2.6/config
index a23233d56520ff9b379ee74e863ca57e33033ece..eaadc3a84973536d916d998da571d7a74ac9aef9 100644 (file)
--- a/target/linux/brcm63xx-2.6/config
+++ b/target/linux/brcm63xx-2.6/config
@@ -422,7 +422,7 @@ CONFIG_NETFILTER_XT_MATCH_DCCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_POLICY=m

diff --git a/target/linux/generic-2.6/config-template b/target/linux/generic-2.6/config-template
index 58097ae76722df3a8bf0f3443d7dea4eb5b8845c..b1326347faed81d7c8002f062f1317b6f1c6fd43 100644 (file)
--- a/target/linux/generic-2.6/config-template
+++ b/target/linux/generic-2.6/config-template
@@ -575,7 +575,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/ixp4xx-2.6/config b/target/linux/ixp4xx-2.6/config
index e28bf9114ebee526152a7a3edc0ef6c81bd28126..802539042267da52ab2ca7ec5b64c482b2068df1 100644 (file)
--- a/target/linux/ixp4xx-2.6/config
+++ b/target/linux/ixp4xx-2.6/config
@@ -336,7 +336,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_PORTSCAN=m

diff --git a/target/linux/magicbox-2.6/config b/target/linux/magicbox-2.6/config
index b99a265a45843227056317b9fa274386ea1f61c0..17829ac1316355c86a2d62df57953baf63e51ca9 100644 (file)
--- a/target/linux/magicbox-2.6/config
+++ b/target/linux/magicbox-2.6/config
@@ -682,7 +682,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/pxa-2.6/config b/target/linux/pxa-2.6/config
index ba94adcd654b7660a0861e2d2499a2ffaa3d0196..86c05d0a19e2756e0bb3c28c7b2197f54d50a8f3 100644 (file)
--- a/target/linux/pxa-2.6/config
+++ b/target/linux/pxa-2.6/config
@@ -308,7 +308,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/rb532-2.6/config b/target/linux/rb532-2.6/config
index dd2bac26e557622ca77007d2a1775cb819eddb8c..092419e927149f1d92c6f7f53b5c1886c28ce657 100644 (file)
--- a/target/linux/rb532-2.6/config
+++ b/target/linux/rb532-2.6/config
@@ -648,7 +648,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/rdc-2.6/config b/target/linux/rdc-2.6/config
index 04b8d703c6f32cca4c59006eadbd807303ef98a5..c27522c9394d7f22766d80d4d724c76704880b4d 100644 (file)
--- a/target/linux/rdc-2.6/config
+++ b/target/linux/rdc-2.6/config
@@ -379,7 +379,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_POLICY=m

diff --git a/target/linux/sibyte-2.6/config b/target/linux/sibyte-2.6/config
index 89f7289d6f38e9f35623eb5be5e4353204c70a53..6eb45fab971891bcdc3e5189795e81ac785d27bf 100644 (file)
--- a/target/linux/sibyte-2.6/config
+++ b/target/linux/sibyte-2.6/config
@@ -345,7 +345,7 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 # CONFIG_NETFILTER_XT_MATCH_DCCP is not set
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_POLICY=m

diff --git a/target/linux/uml-2.6/config b/target/linux/uml-2.6/config
index fd1eb57b3b7a4db5e36a02b3786ff95934b21e31..bfffff47afda224c9abdfbfc622fa16ab2b24dd4 100644 (file)
--- a/target/linux/uml-2.6/config
+++ b/target/linux/uml-2.6/config
@@ -634,7 +634,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y

diff --git a/target/linux/x86-2.6/config b/target/linux/x86-2.6/config
index 2d7cd564df9cde8594597015c16d2e51e77577dd..154275dd687224cc180d3337511d702036e0bbbb 100644 (file)
--- a/target/linux/x86-2.6/config
+++ b/target/linux/x86-2.6/config
@@ -831,7 +831,7 @@ CONFIG_NETFILTER_XT_MATCH_DSCP=m
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y