add the length check rule, hard coded with ALLOW to get statistic num…

…bers
toralf · Jul 10, 2024 · 4b6a730 · 4b6a730
1 parent abcefa2
commit 4b6a730
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 4 deletions.
diff --git a/ipv4-rules.sh b/ipv4-rules.sh
@@ -22,7 +22,10 @@ function addCommon() {
   $ipt -A INPUT -p tcp ! --syn -m state --state NEW -j $jump
   $ipt -A INPUT -m conntrack --ctstate INVALID -j $jump
 
-  # do not touch established connections
+  for relay in $*; do
+    relay_2_ip_and_port
+    $ipt -A INPUT -p tcp --dst $orip --dport $orport -m length --length 40:60 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT || break
+  done
   $ipt -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 
   # ssh
@@ -252,7 +255,7 @@ start)
   trap bailOut INT QUIT TERM EXIT
   clearRules
   setSysctlValues
-  addCommon
+  addCommon ${*:-${CONFIGURED_RELAYS:-$(getConfiguredRelays)}}
   addHetzner
   additionalServices
   addTor ${*:-${CONFIGURED_RELAYS:-$(getConfiguredRelays)}}

diff --git a/ipv6-rules.sh b/ipv6-rules.sh
@@ -29,7 +29,10 @@ function addCommon() {
   $ipt -A INPUT -p tcp ! --syn -m state --state NEW -j $jump
   $ipt -A INPUT -m conntrack --ctstate INVALID -j $jump
 
-  # do not touch established connections
+  for relay in $*; do
+    relay_2_ip_and_port
+    $ipt -A INPUT -p tcp --dst $orip --dport $orport -m length --length 40:60 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT || break
+  done
   $ipt -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 
   # ssh
@@ -236,7 +239,7 @@ case $action in
 start)
   trap bailOut INT QUIT TERM EXIT
   clearRules
-  addCommon
+  addCommon ${*:-${CONFIGURED_RELAYS6:-$(getConfiguredRelays6)}}
   addHetzner
   additionalServices
   addTor ${*:-${CONFIGURED_RELAYS6:-$(getConfiguredRelays6)}}