!dest_port with src_mac ipset
Open
Nobody has claimed this yet.
- Dominant language
- ucode
- Stars
- 27
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
I have the following in my firewall4 config:
config ipset
option family 'ipv6'
list match 'src_mac'
list entry 'fc:aa:14:6c:51:ab'
config ipset
option family 'ipv6'
list match 'src_mac'
list entry ...
...
option maxelem '100'
option counters '1'
option comment 'Hosts that can freely use the Internet'
option name 'FFA-to-Internet_v6'
config rule
option ipset 'FFA-to-Internet_v6'
option src 'lan'
option dest 'wan'
option dest_port '!25'
option target 'ACCEPT'
option family 'any'
list proto 'all'
That does not exclude port 25 from the ports that the hosts in the ipset are allowed to use. It's effectively ignored.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the shown firewall4 configuration with the IPv6 src_mac ipset and the !25 destination-port rule. Inspect the generated firewall behavior for traffic to port 25 and compare it with other ports; the issue is done when port 25 is excluded while the listed hosts retain access to the other permitted ports.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100