apparently this is a known bug only for icmp - make target match all protocols but...

Signed-off-by: Stephen Gran <steve@lobefin.net>

diff --git a/modules/ferm/files/ferm.conf b/modules/ferm/files/ferm.conf
index 166d51702eda404dd10ec08abad0678a2f1769b7..d25d1b4f5c2c24730fe081162b8b67dbf1867a0b 100644 (file)
--- a/modules/ferm/files/ferm.conf
+++ b/modules/ferm/files/ferm.conf
@@ -11,7 +11,7 @@ domain (ip ip6) {
                mod state state (ESTABLISHED RELATED) ACCEPT;
                interface lo ACCEPT;
                proto icmp ACCEPT;
-               proto (tcp udp) mod state state (INVALID) DROP;
+               proto mod state state (INVALID) DROP;
        }
 }