webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-13 12:32:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Introduce DROP_HOSTILE

Browse Source 
Similar to the Location block, this chain logs and drops all traffic
from and to networks known to pose technical threats to IPFire users.

Doing so in a dedicated chain makes sense for transparency reasons, as
we won't interfer with other firewall rules or the Location block, so it
is always clear why a packet from or to such a network has been dropped.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
This commit is contained in:
Peter Müller
2021-12-18 14:48:46 +01:00
parent e83ae0d434
commit 97154d057b
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/initscripts/system/firewall
View File

@@ -139,6 +139,20 @@ iptables_init() {
iptables -t nat -N CUSTOMPOSTROUTING
iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
# Log and drop any traffic from and to networks known as being hostile, posing
# a technical threat to our users (i. e. listed at Spamhaus DROP et al.)
if [ "$DROPHOSTILE" == "on" ]; then
iptables -N DROP_HOSTILE
iptables -A DROP_HOSTILE -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
iptables -A INPUT -i $IFACE -m geoip --src-cc XD -j DROP_HOSTILE
iptables -A FORWARD -i $IFACE -m geoip --src-cc XD -j DROP_HOSTILE
iptables -A FORWARD -o $IFACE -m geoip --dst-cc XD -j DROP_HOSTILE
iptables -A OUTPUT -o $IFACE -m geoip --src-cc XD -j DROP_HOSTILE
iptables -A DROP_HOSTILE -j DROP -m comment --comment "DROP_HOSTILE"
fi
# P2PBLOCK
iptables -N P2PBLOCK
iptables -A INPUT -j P2PBLOCK