dan/liminix
1
0
Fork 5
Code

improve explanaton of reverse path filtering rule

Browse Source 
thanks RoS for the references :-)
This commit is contained in:
Daniel Barlow 2025-02-10 23:48:29 +00:00
parent 7e2b0068e6
commit a726c09ae4
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/firewall/default-rules.nix
View File

@ -18,10 +18,16 @@ in
(drop "ip6 saddr 2001:db8::/32") # documentation addresses (drop "ip6 saddr 2001:db8::/32") # documentation addresses
(drop "ip6 daddr 2001:db8::/32") (drop "ip6 daddr 2001:db8::/32")
# I think this means "check FIB for (saddr, iif) to see if we # Reverse path filtering: drop packet if it's not coming from
# could route a packet to that address using that interface", # the same interface that we'd use to send a reply. Works by
# and if we can't then it was an inapproppriate source address # doing a lookup in the FIB to find how we'd route a packet _to_
# for packets received _from_ said interface # saddr through iif, and then checking the output interface
# returned by the lookup. if oif is 0, that means no route was
# found for that address with that interface, so the packet can
# be dropped
#
# https://wiki.nftables.org/wiki-nftables/index.php/Matching_routing_information#fib
# https://thr3ads.net/netfilter-buglog/2018/01/2843000-Bug-1220-New-Reverse-path-filtering-using-fib-needs-better-documentation
(drop "fib saddr . iif oif eq 0") (drop "fib saddr . iif oif eq 0")
(drop "icmpv6 type router-renumbering") (drop "icmpv6 type router-renumbering")