webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'temp-c165-development' into next

Browse Source
This commit is contained in:
Peter Müller
2022-02-18 22:47:07 +00:00
parent d016745573 8269c8319c
commit b5aec71462
6 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config/rootfiles/oldcore/164/update.sh
View File

@@ -107,6 +107,9 @@ fi
if [ "$(grep "^DROPSPOOFEDMARTIAN" /var/ipfire/optionsfw/settings)" == "" ]; then
echo "DROPSPOOFEDMARTIAN=on" >> /var/ipfire/optionsfw/settings
fi
if [ "$(grep "^LOGDROPCTINVALID" /var/ipfire/optionsfw/settings)" == "" ]; then
echo "LOGDROPCTINVALID=on" >> /var/ipfire/optionsfw/settings
fi
# Apply sysctl changes
/etc/init.d/sysctl start

12
html/cgi-bin/optionsfw.cgi
View File

@@ -2,7 +2,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
# Copyright (C) 2014-2021 IPFire Team <info@ipfire.org> #
# Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -116,6 +116,9 @@ $checked{'DROPSPOOFEDMARTIAN'}{$settings{'DROPSPOOFEDMARTIAN'}} = "checked='chec
$checked{'DROPHOSTILE'}{'off'} = '';
$checked{'DROPHOSTILE'}{'on'} = '';
$checked{'DROPHOSTILE'}{$settings{'DROPHOSTILE'}} = "checked='checked'";
$checked{'LOGDROPCTINVALID'}{'off'} = '';
$checked{'LOGDROPCTINVALID'}{'on'} = '';
$checked{'LOGDROPCTINVALID'}{$settings{'LOGDROPCTINVALID'}} = "checked='checked'";
$checked{'DROPPROXY'}{'off'} = '';
$checked{'DROPPROXY'}{'on'} = '';
$checked{'DROPPROXY'}{$settings{'DROPPROXY'}} = "checked='checked'";
@@ -211,6 +214,13 @@ END
<input type='radio' name='DROPNEWNOTSYN' value='off' $checked{'DROPNEWNOTSYN'}{'off'} /> $Lang::tr{'off'}
</td>
</tr>
<tr>
<td align='left' width='60%'>$Lang::tr{'log dropped conntrack invalids'}</td>
<td align='left'>
$Lang::tr{'on'} <input type='radio' name='LOGDROPCTINVALID' value='on' $checked{'LOGDROPCTINVALID'}{'on'} />/
<input type='radio' name='LOGDROPCTINVALID' value='off' $checked{'LOGDROPCTINVALID'}{'off'} /> $Lang::tr{'off'}
</td>
</tr>
<tr>
<td align='left' width='60%'>$Lang::tr{'drop input'}</td>
<td align='left'>

1
langs/de/cgi-bin/de.pl
View File

@@ -1603,6 +1603,7 @@
'locationblock enable feature' => 'Location-basierte Filterung aktivieren:',
'locationblock flag' => 'Flagge',
'log' => 'Protokoll',
'log dropped conntrack invalids' => 'Verworfene, von der Verbindungsverfolgung als INVALID eingestufte Pakete protokollieren',
'log enabled' => 'Protokoll aktiviert',
'log level' => 'Protokollierungsniveau',
'log lines per page' => 'Zeilen pro Seite',

1
langs/en/cgi-bin/en.pl
View File

@@ -1651,6 +1651,7 @@
'locationblock enable feature' => 'Enable Location based blocking:',
'locationblock flag' => 'Flag',
'log' => 'Log',
'log dropped conntrack invalids' => 'Log dropped packets classified as INVALID by connection tracking',
'log enabled' => 'Log Enabled',
'log level' => 'Log Level',
'log lines per page' => 'Lines per page',

1
lfs/configroot
View File

@@ -131,6 +131,7 @@ $(TARGET) :
echo "DROPWIRELESSFORWARD=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPSPOOFEDMARTIAN=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPHOSTILE=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "LOGDROPCTINVALID=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "POLICY=MODE2" >> $(CONFIG_ROOT)/firewall/settings
echo "POLICY1=MODE2" >> $(CONFIG_ROOT)/firewall/settings
echo "USE_ISP_NAMESERVERS=on" >> $(CONFIG_ROOT)/dns/settings

8
src/initscripts/system/firewall
View File

@@ -121,9 +121,15 @@ iptables_init() {
iptables -A FORWARD -p tcp -j BADTCP
# Connection tracking chains
iptables -N CTINVALID
if [ "$LOGDROPCTINVALID" == "on" ]; then
iptables -A CTINVALID -m limit --limit 10/second -j LOG --log-prefix "DROP_CTINVALID "
fi
iptables -A CTINVALID -j DROP -m comment --comment "DROP_CTINVALID"
iptables -N CONNTRACK
iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP
iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID
iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
# Restore any connection marks