From 7f74c1be33abd8013a9164c0b62e0b90c6dd1428 Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 9 Aug 2001 05:21:22 +0000 Subject: only allow dest port 1025-65535 for DNS replies (#40833, #44038) --- sysconfig/network-scripts/ifup | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'sysconfig/network-scripts/ifup') diff --git a/sysconfig/network-scripts/ifup b/sysconfig/network-scripts/ifup index 093b093c..db3c6205 100755 --- a/sysconfig/network-scripts/ifup +++ b/sysconfig/network-scripts/ifup @@ -169,7 +169,7 @@ if [ -n "${DYNCONFIG}" ]; then # what DNS server they're using until they are done. FWHACK= if [ -n "$FWACTIVE" -a "$FIREWALL_MODS" != "no" ]; then - ipchains -I input -s 0/0 53 -p udp -j ACCEPT + ipchains -I input -s 0/0 53 -d 0/0 1025:65535 -p udp -j ACCEPT FWHACK=1 fi @@ -179,11 +179,11 @@ if [ -n "${DYNCONFIG}" ]; then echo $" done." else echo $" failed." - [ -n "$FWHACK" ] && ipchains -D input -s 0/0 53 -p udp -j ACCEPT + [ -n "$FWHACK" ] && ipchains -D input -s 0/0 53 -d 0/0 1025:65535 -p udp -j ACCEPT exit 1 fi - [ -n "$FWHACK" ] && ipchains -D input -s 0/0 53 -p udp -j ACCEPT + [ -n "$FWHACK" ] && ipchains -D input -s 0/0 53 -d 0/0 1025:65535 -p udp -j ACCEPT else if [ -z "${IPADDR}" ]; then # enable device without IP, useful for e.g. PPPoE -- cgit