changed: FRAG_LOG option to FRAG_DROP to allow disabling fragment dro…

arno-iptables-firewall / aif

GNU General Public License v2.0

149 stars 24 forks source link

Closed arnova closed 5 years ago

arnova commented 5 years ago

…pping (eg. for broken nftables)

arnova commented 5 years ago

@abelbeck : This is the "light" version of the previous PR. You ok with this?

abelbeck commented 5 years ago

@arnova I like the new "light" version, but I would be happy with any of the following options, you decide ...

As above, but reverse logic and default to off:


- if [ "$FRAG_DROP" != "0" ]; then
+ if [ "$FRAG_DROP" = "1" ]; then

FRAG_DROP=0


3. Remove ` -f ` fragment support all-together.

arnova commented 5 years ago

Let's do what we have here for now. In case upstream nftables isn't fixed in time we could always reverse the logic to workaround it.