him411/nss-packages-qosmio
1
0
Fork 0
mirror of https://github.com/qosmio/nss-packages.git synced 2025-12-17 00:33:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

qca-nss-ecm：Fixed the problem that the route does not respond after startup.

Browse Source
This commit is contained in:
zxlhhyccc 2024-03-13 22:50:51 +08:00 committed by GitHub
parent c7c8de990f
commit 399136a5ee
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 30 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
qca-nss-ecm/files/qca-nss-ecm.firewall
View File

@ -1,14 +1,33 @@
#!/bin/sh #!/bin/sh
if grep -q "fw3" /etc/init.d/firewall; then FW_SCRIPT="/etc/init.d/firewall"
iptables -nvL | grep -q "Chain RATE-LIMIT" && iptables -F RATE-LIMIT
iptables -nvL | grep -q "Chain RATE-LIMIT" || iptables -N RATE-LIMIT if grep -q "fw3" "$FW_SCRIPT"; then
iptables -A RATE-LIMIT --match limit --limit 1000/sec --limit-burst 1000 -j RETURN if ! iptables -nvL | grep -q "Chain RATE-LIMIT"; then
iptables -A RATE-LIMIT -j DROP iptables -N RATE-LIMIT
iptables -I zone_wan_forward 5 --match conntrack --ctstate NEW -j RATE-LIMIT fi
elif grep -q "fw4" /etc/init.d/firewall; then
nft add chain inet fw4 RATE-LIMIT iptables -F RATE-LIMIT
nft add rule inet fw4 RATE-LIMIT limit rate 1000/second burst 1000 packets counter return iptables -A RATE-LIMIT --match limit --limit 1000/sec --limit-burst 1000 -j RETURN
nft add rule inet fw4 RATE-LIMIT counter drop iptables -A RATE-LIMIT -j DROP
nft insert rule inet fw4 forward_wan ct state new counter jump RATE-LIMIT iptables -I zone_wan_forward 5 --match conntrack --ctstate NEW -j RATE-LIMIT
[ -n "$(command -v ip6tables)" ] && {
if ! ip6tables -nvL | grep -q "Chain RATE-LIMIT"; then
ip6tables -N RATE-LIMIT
fi
ip6tables -F RATE-LIMIT
ip6tables -A RATE-LIMIT --match limit --limit 1000/sec --limit-burst 1000 -j RETURN
ip6tables -A RATE-LIMIT -j DROP
ip6tables -I zone_wan_forward 5 --match conntrack --ctstate NEW -j RATE-LIMIT
}
elif grep -q "fw4" "$FW_SCRIPT"; then
if ! nft list chain inet fw4 RATE-LIMIT > /dev/null 2>&1; then
nft add chain inet fw4 RATE-LIMIT
fi
nft add rule inet fw4 RATE-LIMIT limit rate 1000/second burst 1000 packets counter return
nft add rule inet fw4 RATE-LIMIT counter drop
nft insert rule inet fw4 forward_wan ct state new counter jump RATE-LIMIT
fi fi