1 files changed, 53 insertions, 4 deletions
diff --git a/data/vyos-firewall-init.conf b/data/vyos-firewall-init.conf
index 11a5bc7bf..7e258e6f1 100644
--- a/data/vyos-firewall-init.conf
+++ b/data/vyos-firewall-init.conf
@@ -19,8 +19,17 @@ table raw {
         type filter hook forward priority -300; policy accept;
     }
 
+    chain vyos_global_rpfilter {
+        return
+    }
+
+    chain vyos_rpfilter {
+        type filter hook prerouting priority -300; policy accept;
+        counter jump vyos_global_rpfilter
+    }
+
     chain PREROUTING {
-        type filter hook prerouting priority -200; policy accept;
+        type filter hook prerouting priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
         counter jump VYOS_CT_TIMEOUT
         counter jump VYOS_CT_PREROUTING_HOOK
@@ -29,7 +38,7 @@ table raw {
     }
 
     chain OUTPUT {
-        type filter hook output priority -200; policy accept;
+        type filter hook output priority -300; policy accept;
         counter jump VYOS_CT_IGNORE
         counter jump VYOS_CT_TIMEOUT
         counter jump VYOS_CT_OUTPUT_HOOK
@@ -73,7 +82,7 @@ table raw {
     }
 
     chain FW_CONNTRACK {
-        accept
+        return
     }
 }
 
@@ -82,8 +91,19 @@ table ip6 raw {
         type filter hook forward priority -300; policy accept;
     }
 
+    chain vyos_global_rpfilter {
+        return
+    }
+
+    chain vyos_rpfilter {
+        type filter hook prerouting priority -300; policy accept;
+        counter jump vyos_global_rpfilter
+    }
+
     chain PREROUTING {
         type filter hook prerouting priority -300; policy accept;
+        counter jump VYOS_CT_IGNORE
+        counter jump VYOS_CT_TIMEOUT
         counter jump VYOS_CT_PREROUTING_HOOK
         counter jump FW_CONNTRACK
         notrack
@@ -91,11 +111,40 @@ table ip6 raw {
 
     chain OUTPUT {
         type filter hook output priority -300; policy accept;
+        counter jump VYOS_CT_IGNORE
+        counter jump VYOS_CT_TIMEOUT
         counter jump VYOS_CT_OUTPUT_HOOK
         counter jump FW_CONNTRACK
         notrack
     }
 
+    ct helper rpc_tcp {
+        type "rpc" protocol tcp;
+    }
+
+    ct helper rpc_udp {
+        type "rpc" protocol udp;
+    }
+
+    ct helper tns_tcp {
+        type "tns" protocol tcp;
+    }
+
+    chain VYOS_CT_HELPER {
+        ct helper set "rpc_tcp" tcp dport {111} return
+        ct helper set "rpc_udp" udp dport {111} return
+        ct helper set "tns_tcp" tcp dport {1521,1525,1536} return
+        return
+    }
+
+    chain VYOS_CT_IGNORE {
+        return
+    }
+
+    chain VYOS_CT_TIMEOUT {
+        return
+    }
+
     chain VYOS_CT_PREROUTING_HOOK {
         return
     }
@@ -105,6 +154,6 @@ table ip6 raw {
     }
 
     chain FW_CONNTRACK {
-        accept
+        return
     }
 }