Fix excess responses on noisy WAN network #6
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I could live with defaulting WAN-to-WAN forward to drop. The global inter-zone forward policy should stay at reject though. |
|
OK, the global policy applies on new interfaces, but im fine with endangering unsuspecting. |
|
Test case: connect wan to (10mbps) hub/repeater and watch spoofed traffic killing all communication there. |
|
Sorry, wrong commit headings. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes: openwrt/openwrt#13340
In principle there is nothing forwarded from WAN unless some forward rule is present or it tries NAT traversal on recent new connection attempt. Past fixing excessive load generated in reported case also nat traversal will not need to retry socket connection, retransmitted SYN is likely to come when permitting rule/transient state is completely established.
Signed-Off-By:
Andris PE <neandris..gmail.com>