firewall4: should enforce "strong host" model
Nobody has claimed this yet.
- Dominant language
- ucode
- Stars
- 27
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
If you have a router with two wan interfaces, and one of them is the egress interface for the default route, then that traffic will pick that interface for egress and NATting for return traffic (pings, redirects to internal hosts, etc).
That is, if I have wan and wan2 and the default route is via wan, but I ping the address of wan2, then the echo replies will come back with the source of wan.
Similarly if I do port-forwarding via redirect rules on wan2, the return traffic will come back with the source address of wan.
Choosing the correct interface for routing and NATting is a firewall function.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named; start by reviewing the 73-comment discussion and the firewall4 routing and NAT handling relevant to dual-WAN traffic. Reproduce the wan/wan2 default-route and redirect cases described here, then verify that replies and return traffic use the correct interface and source address.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100