webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-22 17:02:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Load ipset list before creating rules for DROP_HOSTILE.

Browse Source 
Otherwise there is no ipset list use-able and the feature will not work.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Stefan Schantl
2022-02-18 06:03:51 +01:00
committed by Peter Müller
parent bae9b5dcca
commit 83085ae97c
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/initscripts/system/firewall
View File

@@ -22,6 +22,8 @@ IPS_REPEAT_MASK="0x80000000"
IPS_BYPASS_MARK="0x40000000"
IPS_BYPASS_MASK="0x40000000"
IPSET_DB_DIR="/var/lib/location/ipset"
function iptables() {
/sbin/iptables --wait "$@"
}
@@ -146,6 +148,9 @@ iptables_init() {
# a technical threat to our users (i. e. listed at Spamhaus DROP et al.)
iptables -N HOSTILE
if [ "$DROPHOSTILE" == "on" ]; then
# Call ipset and load the list which contains the hostile networks.
ipset restore < $IPSET_DB_DIR/CC_XD.ipset4
iptables -A HOSTILE -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
iptables -A INPUT -i $IFACE -m set --match-set CC_XD src -j HOSTILE
iptables -A FORWARD -i $IFACE -m set --match-set CC_XD src -j HOSTILE