webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-27 19:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Implement generating SYNPROXY rules

Browse Source 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2024-04-18 21:11:43 +00:00
parent ad03130f24
commit 175ba983f4
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
config/firewall/rules.pl
View File

@@ -297,6 +297,9 @@ sub buildrules {
$NAT_MODE = uc($$hash{$key}[31]); $NAT_MODE = uc($$hash{$key}[31]);
} }
# Enable SYN flood protection?
my $SYN_FLOOD_PROTECTION = 0;
# Set up time constraints. # Set up time constraints.
my @time_options = (); my @time_options = ();
if ($$hash{$key}[18] eq 'ON') { if ($$hash{$key}[18] eq 'ON') {
@@ -370,6 +373,11 @@ sub buildrules {
} }
} }
# DoS Protection
if (($elements ge 38) && ($$hash{$key}[37] eq "ON")) {
$SYN_FLOOD_PROTECTION = 1;
}
# Check which protocols are used in this rule and so that we can # Check which protocols are used in this rule and so that we can
# later group rules by protocols. # later group rules by protocols.
my @protocols = &get_protocols($hash, $key); my @protocols = &get_protocols($hash, $key);
@@ -608,6 +616,10 @@ sub buildrules {
} }
run("$IPTABLES -A $chain @options @source_intf_options @destination_intf_options -j $target"); run("$IPTABLES -A $chain @options @source_intf_options @destination_intf_options -j $target");
if ($SYN_FLOOD_PROTECTION && ($protocol eq "tcp")) {
run("$IPTABLES -t raw -A SYN_FLOOD_PROTECT @options -j CT --notrack");
}
# Handle forwarding rules and add corresponding rules for firewall access. # Handle forwarding rules and add corresponding rules for firewall access.
if ($chain eq $CHAIN_FORWARD) { if ($chain eq $CHAIN_FORWARD) {
# If the firewall is part of the destination subnet and access to the destination network # If the firewall is part of the destination subnet and access to the destination network

4
src/initscripts/system/firewall
View File

@@ -407,6 +407,10 @@ iptables_init() {
iptables -t nat -N REDNAT iptables -t nat -N REDNAT
iptables -t nat -A POSTROUTING -j REDNAT iptables -t nat -A POSTROUTING -j REDNAT
# SYN Flood Protection
iptables -t raw -N SYN_FLOOD_PROTECT
iptables -t raw -A PREROUTING -p tcp --syn -j SYN_FLOOD_PROTECT
# Populate IPsec chains # Populate IPsec chains
/usr/lib/firewall/ipsec-policy /usr/lib/firewall/ipsec-policy