diff options
author | netblue30 <netblue30@yahoo.com> | 2016-02-10 20:18:27 -0500 |
---|---|---|
committer | netblue30 <netblue30@yahoo.com> | 2016-02-10 20:18:27 -0500 |
commit | e0d9eca92d2ef959e95a8326cc835b6c7653f462 (patch) | |
tree | 2f77206925e5e9a4da2b4175f55c620d81f326e0 /src | |
parent | whitelisting ~/.pki in Firefox, Crome/Cromium, Opera (diff) | |
download | firejail-e0d9eca92d2ef959e95a8326cc835b6c7653f462.tar.gz firejail-e0d9eca92d2ef959e95a8326cc835b6c7653f462.tar.zst firejail-e0d9eca92d2ef959e95a8326cc835b6c7653f462.zip |
STUN/WebRTC disabled in default netfilter configuration
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/netfilter.c | 7 | ||||
-rw-r--r-- | src/man/firejail.txt | 12 |
2 files changed, 18 insertions, 1 deletions
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c index a1c1b9c16..2ed09434a 100644 --- a/src/firejail/netfilter.c +++ b/src/firejail/netfilter.c | |||
@@ -30,12 +30,17 @@ static char *client_filter = | |||
30 | ":FORWARD DROP [0:0]\n" | 30 | ":FORWARD DROP [0:0]\n" |
31 | ":OUTPUT ACCEPT [0:0]\n" | 31 | ":OUTPUT ACCEPT [0:0]\n" |
32 | "-A INPUT -i lo -j ACCEPT\n" | 32 | "-A INPUT -i lo -j ACCEPT\n" |
33 | "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" | ||
33 | "# echo replay is handled by -m state RELATED/ESTABLISHED below\n" | 34 | "# echo replay is handled by -m state RELATED/ESTABLISHED below\n" |
34 | "#-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT\n" | 35 | "#-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT\n" |
35 | "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n" | ||
36 | "-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT\n" | 36 | "-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT\n" |
37 | "-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT\n" | 37 | "-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT\n" |
38 | "-A INPUT -p icmp --icmp-type echo-request -j ACCEPT \n" | 38 | "-A INPUT -p icmp --icmp-type echo-request -j ACCEPT \n" |
39 | "# disable STUN\n" | ||
40 | "-A OUTPUT -p udp --dport 3478 -j DROP\n" | ||
41 | "-A OUTPUT -p udp --dport 3479 -j DROP\n" | ||
42 | "-A OUTPUT -p tcp --dport 3478 -j DROP\n" | ||
43 | "-A OUTPUT -p tcp --dport 3479 -j DROP\n" | ||
39 | "COMMIT\n"; | 44 | "COMMIT\n"; |
40 | 45 | ||
41 | void check_netfilter_file(const char *fname) { | 46 | void check_netfilter_file(const char *fname) { |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index bab596e96..784f1583e 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -679,12 +679,24 @@ The default filter is as follows: | |||
679 | .br | 679 | .br |
680 | \-A INPUT \-m state \-\-state RELATED,ESTABLISHED \-j ACCEPT | 680 | \-A INPUT \-m state \-\-state RELATED,ESTABLISHED \-j ACCEPT |
681 | .br | 681 | .br |
682 | # allow ping | ||
683 | .br | ||
682 | \-A INPUT \-p icmp \-\-icmp-type destination-unreachable \-j ACCEPT | 684 | \-A INPUT \-p icmp \-\-icmp-type destination-unreachable \-j ACCEPT |
683 | .br | 685 | .br |
684 | \-A INPUT \-p icmp \-\-icmp-type time-exceeded \-j ACCEPT | 686 | \-A INPUT \-p icmp \-\-icmp-type time-exceeded \-j ACCEPT |
685 | .br | 687 | .br |
686 | \-A INPUT \-p icmp \-\-icmp-type echo-request \-j ACCEPT | 688 | \-A INPUT \-p icmp \-\-icmp-type echo-request \-j ACCEPT |
687 | .br | 689 | .br |
690 | # drop STUN (WebRTC) requests | ||
691 | .br | ||
692 | -A OUTPUT -p udp --dport 3478 -j DROP | ||
693 | .br | ||
694 | -A OUTPUT -p udp --dport 3479 -j DROP | ||
695 | .br | ||
696 | -A OUTPUT -p tcp --dport 3478 -j DROP | ||
697 | .br | ||
698 | -A OUTPUT -p tcp --dport 3479 -j DROP | ||
699 | .br | ||
688 | COMMIT | 700 | COMMIT |
689 | .br | 701 | .br |
690 | 702 | ||