diff options
| -rw-r--r-- | extensions/libipt_icmp.c | 5 | ||||
| -rw-r--r-- | extensions/libipt_icmp.txlate | 3 |
2 files changed, 8 insertions, 0 deletions
diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c index e76257c5..e5e23661 100644 --- a/extensions/libipt_icmp.c +++ b/extensions/libipt_icmp.c @@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl, if (!type_xlate_print(xl, info->type, info->code[0], info->code[1])) return 0; + } else { + /* '-m icmp --icmp-type any' is a noop by itself, + * but it eats a (mandatory) previous '-p icmp' so + * emit it here */ + xt_xlate_add(xl, "ip protocol icmp"); } return 1; } diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate index 434f8cc4..a2aec8e2 100644 --- a/extensions/libipt_icmp.txlate +++ b/extensions/libipt_icmp.txlate @@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT nft add rule ip filter INPUT icmp type != destination-unreachable counter accept + +iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT +nft add rule ip filter INPUT ip protocol icmp counter accept |