webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-24 09:52:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Fixes bug12981 - add if loop to log or not log dropped hostile traffic

Browse Source 
- This v3 version now has two if loops allowing logging of incoming drop hostile or
   outgoing drop hostile or both or neither.
- Dependent on the choice in optionsfw.cgi this loop will either log or not log the
   dropped hostile traffic.

Fixes: bug12981
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Adolf Belka
2024-01-21 12:45:49 +01:00
committed by Michael Tremer
parent f23555a1c6
commit 37c5b4b62e
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/initscripts/system/firewall
View File

@@ -179,9 +179,18 @@ iptables_init() {
iptables -A FORWARD -j HOSTILE
iptables -A OUTPUT -j HOSTILE
iptables -N HOSTILE_DROP
iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE"
iptables -N HOSTILE_DROP_IN
if [ "$LOGDROPHOSTILEIN" == "on" ]; then
iptables -A HOSTILE_DROP_IN -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
fi
iptables -A HOSTILE_DROP_IN -j DROP -m comment --comment "DROP_HOSTILE"
iptables -N HOSTILE_DROP_OUT
if [ "$LOGDROPHOSTILEOUT" == "on" ]; then
iptables -A HOSTILE_DROP_OUT -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
fi
iptables -A HOSTILE_DROP_OUT -j DROP -m comment --comment "DROP_HOSTILE"
# IP Address Blocklist chains
iptables -N BLOCKLISTIN