blob: 5d77a0813bb114234554677ccf849a6d2ffcf11e [file] [log] [blame]
# Set up default firewall rules.
# IPv4 only rules.
iptables_icmp_setup() {
${BINPATH}/iptables -A INPUT -p icmp -j ACCEPT -w
iptables_mdns_setup() {
${BINPATH}/iptables -A INPUT -p udp --destination --dport 5353 -j ACCEPT -w
# IPv6 only rules.
ip6tables_icmp_setup() {
${BINPATH}/ip6tables -A INPUT -p ipv6-icmp -j ACCEPT -w
# Allow all outbound ICMPv6 traffic. This is important for things like
# neighbor discovery and address negotiation.
${BINPATH}/ip6tables -A OUTPUT -p ipv6-icmp -j ACCEPT -w
ip6tables_mdns_setup() {
${BINPATH}/ip6tables -A INPUT -p udp --destination FF02::FB --dport 5353 -j ACCEPT -w
# Install all IPv4 and IPv6 rules.
for iptables in ip{,6}tables; do
[ -x ${iptables_bin} ] || continue
# Set default policy to DROP.
${iptables_bin} -P INPUT DROP -w
${iptables_bin} -P FORWARD DROP -w
${iptables_bin} -P OUTPUT DROP -w
# Accept everything on the loopback.
${iptables_bin} -I INPUT -i lo -j ACCEPT -w
${iptables_bin} -I OUTPUT -o lo -j ACCEPT -w
# Accept return traffic inbound.
${iptables_bin} -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -w
# Accept icmp echo (NB: icmp echo ratelimiting is done by the kernel).
# Accept new and return traffic outbound.
${iptables_bin} -I OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT -w
# Accept inbound mDNS traffic.
# Accept DHCP traffic (communicating as either client or server).
${iptables_bin} -I INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT -w
${iptables_bin} -I OUTPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT -w
# Set completion property.
setprop firewall.init 1