From: Alin Nastac <alin.nas...@gmail.com>
Locally-generated packets are passing through OUTPUT chain, not
PREROUTING.
Signed-off-by: Alin Nastac <alin.nas...@gmail.com>
---
zones.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/zones.c b/zones.c
index 505ab20..8c3daef 100644
--- a/zones.c
+++ b/zones.c
@@ -557,22 +557,24 @@ print_interface_rule(struct fw3_ipt_handle *handle,
struct fw3_state *state,
}
else if (handle->table == FW3_TABLE_RAW)
{
+ bool loopback_dev = (dev != NULL && !dev->any && !dev->invert
&& strcmp(dev->name, "lo") == 0);
+
if (has(zone->flags, handle->family, FW3_FLAG_HELPER))
{
- r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub,
NULL);
+ r = fw3_ipt_rule_create(handle, NULL, loopback_dev ?
NULL : dev, NULL, sub, NULL);
fw3_ipt_rule_comment(r, "%s CT helper assignment",
zone->name);
fw3_ipt_rule_target(r, "zone_%s_helper", zone->name);
fw3_ipt_rule_extra(r, zone->extra_src);
- fw3_ipt_rule_replace(r, "PREROUTING");
+ fw3_ipt_rule_replace(r, loopback_dev ? "OUTPUT" :
"PREROUTING");
}
if (has(zone->flags, handle->family, FW3_FLAG_NOTRACK))
{
- r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub,
NULL);
+ r = fw3_ipt_rule_create(handle, NULL, loopback_dev ?
NULL : dev, NULL, sub, NULL);
fw3_ipt_rule_comment(r, "%s CT bypass", zone->name);
fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
fw3_ipt_rule_extra(r, zone->extra_src);
- fw3_ipt_rule_replace(r, "PREROUTING");
+ fw3_ipt_rule_replace(r, loopback_dev ? "OUTPUT" :
"PREROUTING");
}
}
}
--
2.7.4
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
