diff --git a/config/forwardfw/firewall-forward-policy b/config/forwardfw/firewall-forward-policy
new file mode 100755
index 000000000..aec71e29b
--- /dev/null
+++ b/config/forwardfw/firewall-forward-policy
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
+eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
+
+iptables -F POLICY
+
+if [ "$POLICY" == "MODE1" ]; then
+
+ if [ "$FWPOLICY" == "REJECT" ]; then
+ if [ "$DROPFORWARD" == "on" ]; then
+ /sbin/iptables -A POLICY -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
+ fi
+ /sbin/iptables -A POLICY -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
+ fi
+ if [ "$FWPOLICY" == "DROP" ]; then
+ if [ "$DROPFORWARD" == "on" ]; then
+ /sbin/iptables -A POLICY -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
+ fi
+ /sbin/iptables -A POLICY -j DROP -m comment --comment "DROP_OUTPUT"
+ fi
+fi
+
+
diff --git a/config/forwardfw/firewall-lib.pl b/config/forwardfw/firewall-lib.pl
index 24b990c77..44c0079b7 100755
--- a/config/forwardfw/firewall-lib.pl
+++ b/config/forwardfw/firewall-lib.pl
@@ -215,6 +215,8 @@ sub get_std_net_ip
return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
}elsif($val eq 'BLUE'){
return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
+ }elsif($val eq 'RED'){
+ return "0.0.0.0/0 -o red0";
}elsif($val =~ /OpenVPN/i){
return "$ovpnsettings{'DOVPN_SUBNET'}";
}elsif($val =~ /IPsec/i){
diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl
index 960951fc0..953aad0bc 100755
--- a/config/forwardfw/rules.pl
+++ b/config/forwardfw/rules.pl
@@ -88,10 +88,11 @@ if($param eq 'flush'){
&preparerules;
if($MODE eq '0'){
if ($fwdfwsettings{'POLICY'} eq 'MODE1'){
- #system ("iptables -A $CHAIN -j DROP");
+ system ("/usr/sbin/firewall-forward-policy");
}elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
- #system ("iptables -A $CHAIN -j ACCEPT");
+ system ("/usr/sbin/firewall-forward-policy");
}elsif($fwdfwsettings{'POLICY'} eq 'MODE0' || $fwdfwsettings{'POLICY'} eq 'MODE2'){
+ system ("/usr/sbin/firewall-forward-policy");
system ("iptables -A $CHAIN -m state --state NEW -j ACCEPT");
}
}
@@ -113,9 +114,7 @@ sub preparerules
}
sub buildrules
{
-
my $hash=shift;
-
foreach my $key (sort keys %$hash){
if($$hash{$key}[2] eq 'ON'){
#get source ip's
@@ -163,7 +162,7 @@ sub buildrules
if ($DPROT eq ''){$DPROT=' ';}
@DPROT=split(",",$DPROT);
-
+
#get time if defined
if($$hash{$key}[18] eq 'ON'){
if($$hash{$key}[19] ne ''){push (@timeframe,"Mon");}
@@ -178,7 +177,7 @@ sub buildrules
$TIMETILL="--timestop $$hash{$key}[27] ";
$TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL";
}
-
+
if ($MODE eq '1'){
print "NR:$key ";
foreach my $i (0 .. $#{$$hash{$key}}){
@@ -187,7 +186,7 @@ sub buildrules
print "\n";
print"##################################\n";
#print rules to console
-
+
foreach my $DPROT (@DPROT){
$DPORT = &get_port($hash,$key,$DPROT);
if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;}
@@ -206,7 +205,7 @@ sub buildrules
}
print"\n";
}
-
+
}elsif($MODE eq '0'){
foreach my $DPROT (@DPROT){
$DPORT = &get_port($hash,$key,$DPROT);
@@ -302,11 +301,12 @@ sub get_port
if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){
if ($$hash{$key}[10] ne ''){
return "--sport $$hash{$key}[10] ";
- }elsif($$hash{$key}[9] ne ''){
+ }elsif($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){
return "--icmp-type $$hash{$key}[9] ";
+ }elsif($$hash{$key}[9] eq 'All ICMP-Types'){
+ return;
}
}elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
-
if($$hash{$key}[14] eq 'TGT_PORT'){
if ($$hash{$key}[15] ne ''){
return "--dport $$hash{$key}[15] ";
@@ -330,8 +330,6 @@ sub get_port
elsif($prot eq 'ICMP'){
return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot);
}
-
-
}
}
}
diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2
index 5d5195fba..d57390443 100644
--- a/config/rootfiles/common/apache2
+++ b/config/rootfiles/common/apache2
@@ -1390,7 +1390,7 @@ srv/web/ipfire/cgi-bin/credits.cgi
srv/web/ipfire/cgi-bin/dns.cgi
srv/web/ipfire/cgi-bin/ddns.cgi
srv/web/ipfire/cgi-bin/dhcp.cgi
-srv/web/ipfire/cgi-bin/dmzholes.cgi
+#srv/web/ipfire/cgi-bin/dmzholes.cgi
srv/web/ipfire/cgi-bin/extrahd.cgi
srv/web/ipfire/cgi-bin/fireinfo.cgi
srv/web/ipfire/cgi-bin/forwardfw.cgi
diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2
index 1e91b3743..4755f07f0 100644
--- a/config/rootfiles/common/stage2
+++ b/config/rootfiles/common/stage2
@@ -109,6 +109,7 @@ usr/local/bin/update-lang-cache
#usr/local/src
#usr/sbin
usr/sbin/ovpn-ccd-convert
+usr/sbin/firewall-forward-policy
#usr/share
#usr/share/doc
#usr/share/doc/licenses
diff --git a/html/cgi-bin/dmzholes.cgi b/html/cgi-bin/dmzholes.cgi
deleted file mode 100644
index 5c16f004c..000000000
--- a/html/cgi-bin/dmzholes.cgi
+++ /dev/null
@@ -1,446 +0,0 @@
-#!/usr/bin/perl
-###############################################################################
-# #
-# IPFire.org - A linux based firewall #
-# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
-# #
-# This program is free software: you can redistribute it and/or modify #
-# it under the terms of the GNU General Public License as published by #
-# the Free Software Foundation, either version 3 of the License, or #
-# (at your option) any later version. #
-# #
-# This program is distributed in the hope that it will be useful, #
-# but WITHOUT ANY WARRANTY; without even the implied warranty of #
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
-# GNU General Public License for more details. #
-# #
-# You should have received a copy of the GNU General Public License #
-# along with this program. If not, see . #
-# #
-###############################################################################
-
-use strict;
-
-# enable only the following on debugging purpose
-#use warnings;
-#use CGI::Carp 'fatalsToBrowser';
-
-require '/var/ipfire/general-functions.pl';
-require "${General::swroot}/lang.pl";
-require "${General::swroot}/header.pl";
-
-#workaround to suppress a warning when a variable is used only once
-my @dummy = ( ${Header::table2colour}, ${Header::colouryellow} );
-undef (@dummy);
-
-my %cgiparams=();
-my %checked=();
-my %selected=();
-my %netsettings=();
-my $errormessage = '';
-my $filename = "${General::swroot}/dmzholes/config";
-
-&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
-
-&Header::showhttpheaders();
-
-$cgiparams{'ENABLED'} = 'off';
-$cgiparams{'REMARK'} = '';
-$cgiparams{'ACTION'} = '';
-$cgiparams{'SRC_IP'} = '';
-$cgiparams{'DEST_IP'} ='';
-$cgiparams{'DEST_PORT'} = '';
-&Header::getcgihash(\%cgiparams);
-
-open(FILE, $filename) or die 'Unable to open config file.';
-my @current = ;
-close(FILE);
-
-if ($cgiparams{'ACTION'} eq $Lang::tr{'add'})
-{
- unless($cgiparams{'PROTOCOL'} =~ /^(tcp|udp)$/) { $errormessage = $Lang::tr{'invalid input'}; }
- unless(&General::validipormask($cgiparams{'SRC_IP'})) { $errormessage = $Lang::tr{'source ip bad'}; }
- unless($errormessage){$errormessage = &General::validportrange($cgiparams{'DEST_PORT'},'dst');}
- unless(&General::validipormask($cgiparams{'DEST_IP'})) { $errormessage = $Lang::tr{'destination ip bad'}; }
- unless ($errormessage) {
- $errormessage = &validNet($cgiparams{'SRC_NET'},$cgiparams{'DEST_NET'}); }
- # Darren Critchley - Remove commas from remarks
- $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
-
- unless ($errormessage)
- {
- if($cgiparams{'EDITING'} eq 'no') {
- open(FILE,">>$filename") or die 'Unable to open config file.';
- flock FILE, 2;
- print FILE "$cgiparams{'PROTOCOL'},"; # [0]
- print FILE "$cgiparams{'SRC_IP'},"; # [1]
- print FILE "$cgiparams{'DEST_IP'},"; # [2]
- print FILE "$cgiparams{'DEST_PORT'},"; # [3]
- print FILE "$cgiparams{'ENABLED'},"; # [4]
- print FILE "$cgiparams{'SRC_NET'},"; # [5]
- print FILE "$cgiparams{'DEST_NET'},"; # [6]
- print FILE "$cgiparams{'REMARK'}\n"; # [7]
- } else {
- open(FILE,">$filename") or die 'Unable to open config file.';
- flock FILE, 2;
- my $id = 0;
- foreach my $line (@current)
- {
- $id++;
- if ($cgiparams{'EDITING'} eq $id) {
- print FILE "$cgiparams{'PROTOCOL'},"; # [0]
- print FILE "$cgiparams{'SRC_IP'},"; # [1]
- print FILE "$cgiparams{'DEST_IP'},"; # [2]
- print FILE "$cgiparams{'DEST_PORT'},"; # [3]
- print FILE "$cgiparams{'ENABLED'},"; # [4]
- print FILE "$cgiparams{'SRC_NET'},"; # [5]
- print FILE "$cgiparams{'DEST_NET'},"; # [6]
- print FILE "$cgiparams{'REMARK'}\n"; # [7]
- } else { print FILE "$line"; }
- }
- }
- close(FILE);
- undef %cgiparams;
- &General::log($Lang::tr{'dmz pinhole rule added'});
- system('/usr/local/bin/setdmzholes');
- }
-}
-if ($cgiparams{'ACTION'} eq $Lang::tr{'remove'})
-{
- my $id = 0;
- open(FILE, ">$filename") or die 'Unable to open config file.';
- flock FILE, 2;
- foreach my $line (@current)
- {
- $id++;
- unless ($cgiparams{'ID'} eq $id) { print FILE "$line"; }
- }
- close(FILE);
- system('/usr/local/bin/setdmzholes');
- &General::log($Lang::tr{'dmz pinhole rule removed'});
-}
-if ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'})
-{
- my $id = 0;
- open(FILE, ">$filename") or die 'Unable to open config file.';
- flock FILE, 2;
- foreach my $line (@current)
- {
- $id++;
- unless ($cgiparams{'ID'} eq $id) { print FILE "$line"; }
- else
- {
- chomp($line);
- my @temp = split(/\,/,$line);
- print FILE "$temp[0],$temp[1],$temp[2],$temp[3],$cgiparams{'ENABLE'},$temp[5],$temp[6],$temp[7]\n";
- }
- }
- close(FILE);
- system('/usr/local/bin/setdmzholes');
-}
-if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'})
-{
- my $id = 0;
- foreach my $line (@current)
- {
- $id++;
- if ($cgiparams{'ID'} eq $id)
- {
- chomp($line);
- my @temp = split(/\,/,$line);
- $cgiparams{'PROTOCOL'} = $temp[0];
- $cgiparams{'SRC_IP'} = $temp[1];
- $cgiparams{'DEST_IP'} = $temp[2];
- $cgiparams{'DEST_PORT'} = $temp[3];
- $cgiparams{'ENABLED'} = $temp[4];
- $cgiparams{'SRC_NET'} = $temp[5];
- $cgiparams{'DEST_NET'} = $temp[6];
- $cgiparams{'REMARK'} = $temp[7];
- }
- }
-}
-
-if ($cgiparams{'ACTION'} eq '')
-{
- $cgiparams{'PROTOCOL'} = 'tcp';
- $cgiparams{'ENABLED'} = 'on';
- $cgiparams{'SRC_NET'} = 'orange';
- $cgiparams{'DEST_NET'} = 'blue';
-}
-
-$selected{'PROTOCOL'}{'udp'} = '';
-$selected{'PROTOCOL'}{'tcp'} = '';
-$selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = "selected='selected'";
-
-$selected{'SRC_NET'}{'orange'} = '';
-$selected{'SRC_NET'}{'blue'} = '';
-$selected{'SRC_NET'}{$cgiparams{'SRC_NET'}} = "selected='selected'";
-
-$selected{'DEST_NET'}{'blue'} = '';
-$selected{'DEST_NET'}{'green'} = '';
-$selected{'DEST_NET'}{$cgiparams{'DEST_NET'}} = "selected='selected'";
-
-$checked{'ENABLED'}{'off'} = '';
-$checked{'ENABLED'}{'on'} = '';
-$checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'";
-
-&Header::openpage($Lang::tr{'dmz pinhole configuration'}, 1, '');
-
-&Header::openbigbox('100%', 'left', '', $errormessage);
-
-if ($errormessage) {
- &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
- print "$errormessage\n";
- print " \n";
- &Header::closebox();
-}
-
-print "\n";
-
-&Header::openbox('100%', 'left', $Lang::tr{'current rules'});
-print <
-
-
$Lang::tr{'proto'}
-
$Lang::tr{'net'}
-
$Lang::tr{'source'}
-
-
$Lang::tr{'net'}
-
$Lang::tr{'destination'}
-
$Lang::tr{'remark'}
-
-
$Lang::tr{'action'}
-END
-;
-
-# Achim Weber: if i add a new rule, this rule is not displayed?!?
-# we re-read always config.
-# If something has happeened re-read config
-#if($cgiparams{'ACTION'} ne '')
-#{
- open(FILE, $filename) or die 'Unable to open config file.';
- @current = ;
- close(FILE);
-#}
-my $id = 0;
-foreach my $line (@current)
-{
- my $protocol='';
- my $gif='';
- my $toggle='';
- my $gdesc='';
- $id++;
- chomp($line);
- my @temp = split(/\,/,$line);
- if ($temp[0] eq 'udp') { $protocol = 'UDP'; } else { $protocol = 'TCP' }
-
- my $srcnetcolor = ($temp[5] eq 'blue')? ${Header::colourblue} : ${Header::colourorange};
- my $destnetcolor = ($temp[6] eq 'blue')? ${Header::colourblue} : ${Header::colourgreen};
-
- if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'} && $cgiparams{'ID'} eq $id) {
- print "
\n"; }
- elsif ($id % 2) {
- print "
\n"; }
- else {
- print "
\n"; }
- if ($temp[4] eq 'on') { $gif='on.gif'; $toggle='off'; $gdesc=$Lang::tr{'click to disable'};}
- else { $gif = 'off.gif'; $toggle='on'; $gdesc=$Lang::tr{'click to enable'}; }
-
- # Darren Critchley - Get Port Service Name if we can - code borrowed from firewalllog.dat
- my $dstprt =$temp[3];
- $_=$temp[3];
- if (/^\d+$/) {
- my $servi = uc(getservbyport($temp[3], lc($temp[0])));
- if ($servi ne '' && $temp[3] < 1024) {
- $dstprt = "$dstprt($servi)"; }
- }
- # Darren Critchley - If the line is too long, wrap the port numbers
- my $dstaddr = "$temp[2] : $dstprt";
- if (length($dstaddr) > 26) {
- $dstaddr = "$temp[2] : $dstprt";
- }
-print <$protocol
-
-
$temp[1]
-
-
-
$dstaddr
-
$temp[7]
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-END
- ;
-}
-print "\n";
-
-# If the fixed lease file contains entries, print Key to action icons
-if ( ! -z "$filename") {
-print <
-
END
}
@@ -1355,7 +1315,6 @@ END
}
sub saverule
{
-
my $hash=shift;
my $config=shift;
&General::readhasharray("$config", $hash);
@@ -1456,7 +1415,7 @@ sub get_name
foreach my $network (sort keys %defaultNetworks)
{
return "$network" if ($val eq $defaultNetworks{$network}{'NAME'});
- }
+ }
}
sub validremark
{
@@ -1468,13 +1427,13 @@ sub validremark
if (length ($remark) < 1 || length ($remark) > 255) {
return 0;}
# Only valid characters are a-z, A-Z, 0-9 and -
- if ($remark !~ /^[a-zäöüA-ZÖÄÜ0-9-\s]*$/) {
+ if ($remark !~ /^[a-zäöüA-ZÖÄÜ0-9-.:\/\s]*$/) {
return 0;}
# First character can only be a letter or a digit
if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÖÄÜ0-9]*$/) {
return 0;}
# Last character can only be a letter or a digit
- if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÖÄÜ0-9]*$/) {
+ if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÖÄÜ0-9.]*$/) {
return 0;}
return 1;
}
@@ -1494,7 +1453,7 @@ sub gettgtport
my $key=shift;
my $service;
my $prot;
-
+
if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
if($hash{$key}[14] eq 'cust_srv'){
&General::readhasharray("$configsrv", \%customservice);
@@ -1506,7 +1465,7 @@ sub gettgtport
}
}
}elsif($hash{$key}[14] eq 'cust_srvgrp'){
-
+
$service=$hash{$key}[15];
}elsif($hash{$key}[14] eq 'TGT_PORT'){
$service=$hash{$key}[15];
@@ -1515,7 +1474,7 @@ sub gettgtport
}elsif($hash{$key}[11] eq 'ON' && $hash{$key}[12] eq 'ICMP'){
print" : ($hash{$key}[12]) $hash{$key}[13]";
}
-
+
if ($prot ne '' || $service ne ''){
print" :";
if ($prot ne ''){
@@ -1535,7 +1494,7 @@ sub viewtablenew
my $config=shift;
my $title=shift;
my $title1=shift;
-
+
if ( ! -z "$config"){
&Header::openbox('100%', 'left',$title);
my $count=0;
@@ -1549,7 +1508,7 @@ sub viewtablenew
print"$title1 ";
print"
