liminix

commit a9ea01428e6e696072c708f2c09a531587fd51b5
parent 92b0bec038f4ea55ba64deec7202f9f6ea038ef2
Author: Daniel Barlow <dan@telent.net>
Date:   Thu,  8 Feb 2024 17:20:39 +0000

firewall: don't drop in conntrack rule

as there are other rules following that might want to accept

Diffstat:
M
examples/demo-firewall.nix
 | 
3
+--

1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/examples/demo-firewall.nix b/examples/demo-firewall.nix
@@ -199,11 +199,10 @@ in {
     hook = "input";
     rules = [
       "iifname lo accept"
-      "ct state vmap { established : accept, related : accept, invalid : drop }"
       "iifname int jump input-ip4-lan"
       "iifname ppp0 jump input-ip4-wan"
       "oifname \"int\" iifname \"ppp0\" jump incoming-allowed-ip4"
-      "log prefix \"denied input-ip4 \""
+      "ct state vmap established,related accept"
     ];
   };