3c3
< # Compiled firewall script generated by Shorewall 5.1.1 - Tue Jan 31 09:29:30 CET 2017
---
> # Compiled firewall script generated by Shorewall 5.1.2.1 - Mon Mar 6 15:04:51 CET 2017
2254c2254
<     SHOREWALL_VERSION="5.1.1"
---
>     SHOREWALL_VERSION="5.1.2.1"
2327c2327
< # Generated by Shorewall 5.1.1 - Tue Jan 31 09:29:30 CET 2017
---
> # Generated by Shorewall 5.1.2.1 - Mon Mar 6 15:04:51 CET 2017
2386,2387d2385
< :Drop - [0:0]
< :Reject - [0:0]
2404d2401
< :logflags - [0:0]
2413d2409
< :smurflog - [0:0]
2430c2426,2427
< -A INPUT -j Reject
---
> -A INPUT -j Broadcast
> -A INPUT -m addrtype --dst-type MULTICAST -j DROP
2438c2435,2436
< -A FORWARD -j Reject
---
> -A FORWARD -j Broadcast
> -A FORWARD -m addrtype --dst-type MULTICAST -j DROP
2447c2445,2446
< -A OUTPUT -j Reject
---
> -A OUTPUT -j Broadcast
> -A OUTPUT -m addrtype --dst-type MULTICAST -j DROP
2451d2449
< -A Broadcast -m addrtype --dst-type MULTICAST -j DROP
2453,2476d2450
< -A Drop
< -A Drop -p 1 --icmp-type 3/4 -j ACCEPT -m comment --comment "Needed ICMP types"
< -A Drop -p 1 --icmp-type 11 -j ACCEPT -m comment --comment "Needed ICMP types"
< -A Drop -j Broadcast
< -A Drop -m conntrack --ctstate INVALID -j DROP
< -A Drop -p 17 -m multiport --dports 135,445 -j DROP -m comment --comment "SMB"
< -A Drop -p 17 --dport 137:139 -j DROP -m comment --comment "SMB"
< -A Drop -p 17 --dport 1024:65535 --sport 137 -j DROP -m comment --comment "SMB"
< -A Drop -p 6 -m multiport --dports 135,139,445 -j DROP -m comment --comment "SMB"
< -A Drop -p 17 --dport 1900 -j DROP -m comment --comment "UPnP"
< -A Drop -p 6 ! --syn -j DROP
< -A Drop -p 17 --sport 53 -j DROP -m comment --comment "Late DNS Replies"
< -A Reject
< -A Reject -p 1 --icmp-type 3/4 -j ACCEPT -m comment --comment "Needed ICMP types"
< -A Reject -p 1 --icmp-type 11 -j ACCEPT -m comment --comment "Needed ICMP types"
< -A Reject -j Broadcast
< -A Reject -m conntrack --ctstate INVALID -j DROP
< -A Reject -p 17 -m multiport --dports 135,445 -g reject -m comment --comment "SMB"
< -A Reject -p 17 --dport 137:139 -g reject -m comment --comment "SMB"
< -A Reject -p 17 --dport 1024:65535 --sport 137 -g reject -m comment --comment "SMB"
< -A Reject -p 6 -m multiport --dports 135,139,445 -g reject -m comment --comment "SMB"
< -A Reject -p 17 --dport 1900 -j DROP -m comment --comment "UPnP"
< -A Reject -p 6 ! --syn -j DROP
< -A Reject -p 17 --sport 53 -j DROP -m comment --comment "Late DNS Replies"
2486c2460,2461
< -A dmz-fw -j Reject
---
> -A dmz-fw -j Broadcast
> -A dmz-fw -m addrtype --dst-type MULTICAST -j DROP
2506c2481,2482
< -A dmz-loc -j Reject
---
> -A dmz-loc -j Broadcast
> -A dmz-loc -m addrtype --dst-type MULTICAST -j DROP
2529c2505,2506
< -A dmz-net -j Reject
---
> -A dmz-net -j Broadcast
> -A dmz-net -m addrtype --dst-type MULTICAST -j DROP
2537c2514,2515
< -A dmz-vpn1 -j Reject
---
> -A dmz-vpn1 -j Broadcast
> -A dmz-vpn1 -m addrtype --dst-type MULTICAST -j DROP
2561c2539,2540
< -A fw-dmz -j Reject
---
> -A fw-dmz -j Broadcast
> -A fw-dmz -m addrtype --dst-type MULTICAST -j DROP
2575c2554,2555
< -A fw-loc -j Reject
---
> -A fw-loc -j Broadcast
> -A fw-loc -m addrtype --dst-type MULTICAST -j DROP
2583c2563,2564
< -A fw-vpn1 -j Reject
---
> -A fw-vpn1 -j Broadcast
> -A fw-vpn1 -m addrtype --dst-type MULTICAST -j DROP
2606c2587,2588
< -A loc-dmz -j Reject
---
> -A loc-dmz -j Broadcast
> -A loc-dmz -m addrtype --dst-type MULTICAST -j DROP
2617c2599,2600
< -A loc-fw -j Reject
---
> -A loc-fw -j Broadcast
> -A loc-fw -m addrtype --dst-type MULTICAST -j DROP
2637c2620,2621
< -A loc-net -j Reject
---
> -A loc-net -j Broadcast
> -A loc-net -m addrtype --dst-type MULTICAST -j DROP
2646,2647d2629
< -A logflags -m hashlimit --hashlimit-upto 30/min --hashlimit-name lograte --hashlimit-mode dstip --hashlimit-htable-expire 60000 -j LOG --log-ip-options --log-level 6 --log-prefix "logflags DROP "
< -A logflags -j DROP
2687c2669,2670
< -A net-dmz -j Drop
---
> -A net-dmz -j Broadcast
> -A net-dmz -m addrtype --dst-type MULTICAST -j DROP
2704c2687,2688
< -A net-fw -j Drop
---
> -A net-fw -j Broadcast
> -A net-fw -m addrtype --dst-type MULTICAST -j DROP
2721c2705,2706
< -A net-loc -j Drop
---
> -A net-loc -j Broadcast
> -A net-loc -m addrtype --dst-type MULTICAST -j DROP
2727c2712,2713
< -A net-vpn1 -j Drop
---
> -A net-vpn1 -j Broadcast
> -A net-vpn1 -m addrtype --dst-type MULTICAST -j DROP
2746,2747d2731
< -A smurflog -m hashlimit --hashlimit-upto 30/min --hashlimit-name lograte --hashlimit-mode dstip --hashlimit-htable-expire 60000 -j LOG --log-level 6 --log-prefix "smurfs DROP "
< -A smurflog -j DROP
2749,2757c2733,2741
< -A smurfs -m addrtype --src-type BROADCAST -g smurflog
< -A smurfs -s 224.0.0.0/4 -g smurflog
< -A tcpflags -p tcp --tcp-flags ALL FIN,URG,PSH -g logflags
< -A tcpflags -p tcp --tcp-flags ALL NONE -g logflags
< -A tcpflags -p tcp --tcp-flags SYN,RST SYN,RST -g logflags
< -A tcpflags -p tcp --tcp-flags FIN,RST FIN,RST -g logflags
< -A tcpflags -p tcp --tcp-flags SYN,FIN SYN,FIN -g logflags
< -A tcpflags -p tcp --tcp-flags ACK,PSH,FIN PSH,FIN -g logflags
< -A tcpflags -p tcp --syn --sport 0 -g logflags
---
> -A smurfs -m addrtype --src-type BROADCAST -j DROP
> -A smurfs -s 224.0.0.0/4 -j DROP
> -A tcpflags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
> -A tcpflags -p tcp --tcp-flags ALL NONE -j DROP
> -A tcpflags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
> -A tcpflags -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
> -A tcpflags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
> -A tcpflags -p tcp --tcp-flags ACK,PSH,FIN PSH,FIN -j DROP
> -A tcpflags -p tcp --syn --sport 0 -j DROP
2765c2749,2750
< -A vpn1-dmz -j Reject
---
> -A vpn1-dmz -j Broadcast
> -A vpn1-dmz -m addrtype --dst-type MULTICAST -j DROP
2774c2759,2760
< -A vpn1-fw -j Reject
---
> -A vpn1-fw -j Broadcast
> -A vpn1-fw -m addrtype --dst-type MULTICAST -j DROP
2780c2766,2767
< -A vpn1-net -j Reject
---
> -A vpn1-net -j Broadcast
> -A vpn1-net -m addrtype --dst-type MULTICAST -j DROP
3171c3158
< # Generated by Shorewall 5.1.1 - Tue Jan 31 09:29:30 CET 2017
---
> # Generated by Shorewall 5.1.2.1 - Mon Mar 6 15:04:51 CET 2017
3293c3280
<     echo "compiled Tue Jan 31 09:29:30 CET 2017 by Shorewall version 5.1.1"
---
>     echo "compiled Mon Mar 6 15:04:51 CET 2017 by Shorewall version 5.1.2.1"
3416,3417c3403,3404
< g_sha1sum1=sha-lh-fba08892d6d2629a9700
< g_sha1sum2=sha-rh-e0b6cefbd7959628c71d
---
> g_sha1sum1=sha-lh-8bf712d871590046c00a
> g_sha1sum2=sha-rh-36d299f1b33c98781157