webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-10 19:15:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Use seperate firewall chains for passing traffic to the IPS

Browse Source 
Create and use seperate iptables chain called IPS_INPUT, IPS_FORWARD and IPS_OUTPUT
to be more flexible which kind of traffic should be passed to suricata.

Reference #12062

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Stefan Schantl
2019-04-25 19:31:46 +02:00
committed by Arne Fitzenreiter
parent 31568a1982
commit 686c4b9f25
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/initscripts/system/firewall
View File

@@ -186,10 +186,12 @@ iptables_init() {
iptables -A FORWARD -j GUARDIAN
# IPS (suricata) chains
iptables -N IPS
iptables -A INPUT -j IPS
iptables -A FORWARD -j IPS
iptables -A OUTPUT -j IPS
iptables -N IPS_INPUT
iptables -N IPS_FORWARD
iptables -N IPS_OUTPUT
iptables -A INPUT -j IPS_INPUT
iptables -A FORWARD -j IPS_FORWARD
iptables -A OUTPUT -j IPS_OUTPUT
# Block non-established IPsec networks
iptables -N IPSECBLOCK