Update firewall examples to fix PMTUD issues (#998)

According to RFC2979 Section 3.1.1 incoming ICMP Destination Unreachable / Fragmentation Needed errors MUST NOT be blocked.
This commit is contained in:
ogelpre 2022-11-20 07:44:19 +01:00 committed by GitHub
parent ccd4389e86
commit 12a1d3c0d9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 0 deletions

View File

@ -88,6 +88,9 @@ Edit `/etc/iptables/rules.v4` and put this inside:
# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
# Allow destination unreachable messages, espacally code 4 (fragmentation required) is required or PMTUD breaks
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
# Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7