Tobias Brunner
ccac9c3047
New versions of Bind limit the maximum UDP message size to 1232 bytes, which is the same that newer versions of libunbound propose as maximum via EDNS in requests, so increasing the limit on the server wouldn't help. Instead we allow DNS via TCP so the client can switch after receiving the truncated UDP response.
33 lines
862 B
Plaintext
33 lines
862 B
Plaintext
*filter
|
|
|
|
# default policy is DROP
|
|
-P INPUT DROP
|
|
-P OUTPUT DROP
|
|
-P FORWARD DROP
|
|
|
|
# allow esp
|
|
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
|
|
# allow IKE
|
|
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
|
|
# allow MobIKE
|
|
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
|
|
# allow ssh
|
|
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
|
|
# allow DNSSEC fetch from winnetou
|
|
-A INPUT -i eth0 -p udp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
|
|
-A OUTPUT -o eth0 -p udp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
|
|
|
|
# allow DNSSEC fetch from winnetou via TCP
|
|
-A INPUT -i eth0 -p tcp --sport 53 -s PH_IP_WINNETOU -j ACCEPT
|
|
-A OUTPUT -o eth0 -p tcp --dport 53 -d PH_IP_WINNETOU -j ACCEPT
|
|
|
|
COMMIT
|