webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 11:43:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Use --wait for all iptables commands.

Browse Source
This commit is contained in:
Michael Tremer
2014-02-14 13:04:18 +01:00
parent cdb725da87
commit a211fee393
2 changed files with 39 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
config/firewall/firewall-policy
View File

@@ -23,6 +23,10 @@ eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
eval $(/usr/local/bin/readhash /var/ipfire/firewall/settings) eval $(/usr/local/bin/readhash /var/ipfire/firewall/settings)
eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
function iptables() {
/sbin/iptables --wait "$@"
}
iptables -F POLICYFWD iptables -F POLICYFWD
iptables -F POLICYOUT iptables -F POLICYOUT
iptables -F POLICYIN iptables -F POLICYIN
@@ -52,15 +56,15 @@ esac
case "${FWPOLICY2}" in case "${FWPOLICY2}" in
REJECT) REJECT)
if [ "${DROPINPUT}" = "on" ]; then if [ "${DROPINPUT}" = "on" ]; then
/sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT" iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
fi fi
/sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT" iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
;; ;;
*) # DROP *) # DROP
if [ "${DROPINPUT}" = "on" ]; then if [ "${DROPINPUT}" = "on" ]; then
/sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT" iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
fi fi
/sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT" iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT"
;; ;;
esac esac
@@ -70,15 +74,15 @@ case "${POLICY}" in
case "${FWPOLICY}" in case "${FWPOLICY}" in
REJECT) REJECT)
if [ "${DROPFORWARD}" = "on" ]; then if [ "${DROPFORWARD}" = "on" ]; then
/sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD" iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
fi fi
/sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD" iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD"
;; ;;
*) # DROP *) # DROP
if [ "${DROPFORWARD}" = "on" ]; then if [ "${DROPFORWARD}" = "on" ]; then
/sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD" iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
fi fi
/sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD" iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
;; ;;
esac esac
;; ;;
@@ -86,14 +90,14 @@ case "${POLICY}" in
*) *)
if [ -n "${IFACE}" ]; then if [ -n "${IFACE}" ]; then
if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then
/sbin/iptables -A POLICYFWD -i "${BLUE_DEV}" ! -o "${IFACE}" -j DROP iptables -A POLICYFWD -i "${BLUE_DEV}" ! -o "${IFACE}" -j DROP
fi fi
if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then
/sbin/iptables -A POLICYFWD -i "${ORANGE_DEV}" ! -o "${IFACE}" -j DROP iptables -A POLICYFWD -i "${ORANGE_DEV}" ! -o "${IFACE}" -j DROP
fi fi
fi fi
/sbin/iptables -A POLICYFWD -j ACCEPT iptables -A POLICYFWD -j ACCEPT
/sbin/iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP
;; ;;
esac esac
@@ -103,21 +107,21 @@ case "${POLICY1}" in
case "${FWPOLICY1}" in case "${FWPOLICY1}" in
REJECT) REJECT)
if [ "${DROPOUTGOING}" = "on" ]; then if [ "${DROPOUTGOING}" = "on" ]; then
/sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT" iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
fi fi
/sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT" iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
;; ;;
*) # DROP *) # DROP
if [ "${DROPOUTGOING}" == "on" ]; then if [ "${DROPOUTGOING}" == "on" ]; then
/sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT" iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
fi fi
/sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT" iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
;; ;;
esac esac
;; ;;
*) *)
/sbin/iptables -A POLICYOUT -j ACCEPT iptables -A POLICYOUT -j ACCEPT
/sbin/iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP
;; ;;
esac esac

34
config/firewall/rules.pl
View File

@@ -60,7 +60,7 @@ my $blue = '';
my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT); my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT);
my $CHAIN = "FORWARDFW"; my $CHAIN = "FORWARDFW";
my $conexists = 'off'; my $conexists = 'off';
my $command = 'iptables -A'; my $command = 'iptables --wait -A';
my $dnat =''; my $dnat ='';
my $snat =''; my $snat ='';
@@ -111,7 +111,7 @@ if($param eq 'flush'){
system ("/usr/sbin/firewall-policy"); system ("/usr/sbin/firewall-policy");
}elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){ }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
&p2pblock; &p2pblock;
system ("iptables -A $CHAIN -m conntrack --ctstate NEW -j ACCEPT"); system ("iptables --wait -A $CHAIN -m conntrack --ctstate NEW -j ACCEPT");
system ("/usr/sbin/firewall-policy"); system ("/usr/sbin/firewall-policy");
system ("/etc/sysconfig/firewall.local reload"); system ("/etc/sysconfig/firewall.local reload");
} }
@@ -119,11 +119,11 @@ if($param eq 'flush'){
} }
sub flush sub flush
{ {
system ("iptables -F FORWARDFW"); system ("iptables --wait -F FORWARDFW");
system ("iptables -F INPUTFW"); system ("iptables --wait -F INPUTFW");
system ("iptables -F OUTGOINGFW"); system ("iptables --wait -F OUTGOINGFW");
system ("iptables -t nat -F NAT_DESTINATION"); system ("iptables --wait -t nat -F NAT_DESTINATION");
system ("iptables -t nat -F NAT_SOURCE"); system ("iptables --wait -t nat -F NAT_SOURCE");
} }
sub preparerules sub preparerules
{ {
@@ -150,9 +150,9 @@ sub buildrules
my $icmptype; my $icmptype;
foreach my $key (sort {$a <=> $b} keys %$hash){ foreach my $key (sort {$a <=> $b} keys %$hash){
next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' ); next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' );
$command="iptables -A"; $command="iptables --wait -A";
if ($$hash{$key}[28] eq 'ON'){ if ($$hash{$key}[28] eq 'ON'){
$command='iptables -t nat -A'; $command='iptables --wait -t nat -A';
$natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]); $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]);
if($$hash{$key}[31] eq 'dnat'){ if($$hash{$key}[31] eq 'dnat'){
$nat='DNAT'; $nat='DNAT';
@@ -303,7 +303,7 @@ sub buildrules
} }
} }
} }
print "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; print "iptables --wait -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
next; next;
#PROCESS SNAT RULE #PROCESS SNAT RULE
}elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){ }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
@@ -318,14 +318,14 @@ sub buildrules
if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){ if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
} }
print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; print "iptables --wait -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
} }
#PROCESS Prot ICMP and type = All ICMP-Types #PROCESS Prot ICMP and type = All ICMP-Types
if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){ if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){ if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
} }
print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; print "iptables --wait -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
} }
} }
} }
@@ -387,7 +387,7 @@ sub buildrules
} }
} }
} }
system "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; system "iptables --wait -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
next; next;
#PROCESS SNAT RULE #PROCESS SNAT RULE
}elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){ }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
@@ -402,14 +402,14 @@ sub buildrules
if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){ if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
} }
system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; system "iptables --wait -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
} }
#PROCESS Prot ICMP and type = All ICMP-Types #PROCESS Prot ICMP and type = All ICMP-Types
if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){ if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){ if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
} }
system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; system "iptables --wait -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
} }
} }
} }
@@ -504,11 +504,11 @@ sub p2pblock
} }
if ($MODE eq 1){ if ($MODE eq 1){
if($P2PSTRING){ if($P2PSTRING){
print"/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO\n"; print"/sbin/iptables --wait -A FORWARDFW $CMD $P2PSTRING -j $DO\n";
} }
}else{ }else{
if($P2PSTRING){ if($P2PSTRING){
system("/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO"); system("/sbin/iptables --wait -A FORWARDFW $CMD $P2PSTRING -j $DO");
} }
} }
} }