From: Stephen Gran <steve@lobefin.net>
Date: Sat, 20 Feb 2010 20:48:14 +0000 (+0000)
Subject: apparently this is a known bug only for icmp - make target match all protocols but... 
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=95dcdb4730b139b8d35e701a869b27eaebe68bd4;p=mirror%2Fdsa-puppet.git

apparently this is a known bug only for icmp - make target match all protocols but only after icmp accept

Signed-off-by: Stephen Gran <steve@lobefin.net>
---

diff --git a/modules/ferm/files/ferm.conf b/modules/ferm/files/ferm.conf
index 166d51702..d25d1b4f5 100644
--- a/modules/ferm/files/ferm.conf
+++ b/modules/ferm/files/ferm.conf
@@ -11,7 +11,7 @@ domain (ip ip6) {
                mod state state (ESTABLISHED RELATED) ACCEPT;
                interface lo ACCEPT;
                proto icmp ACCEPT;
-               proto (tcp udp) mod state state (INVALID) DROP;
+               proto mod state state (INVALID) DROP;
        }
 }