webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-05-11 09:48:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Revert "firewall: always allow outgoing DNS traffic to root servers"

Browse Source 
This reverts commit 70cd5c42f0.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This commit is contained in:
Arne Fitzenreiter
2019-10-18 16:13:49 +02:00
parent a2c2c4c74c
commit be967dc920
2 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config/rootfiles/core/137/filelists/files
View File

@@ -1,6 +1,8 @@
etc/system-release etc/system-release
etc/issue etc/issue
srv/web/ipfire/cgi-bin/credits.cgi srv/web/ipfire/cgi-bin/credits.cgi
usr/lib/firewall/rules.pl
usr/sbin/firewall-policy
var/ipfire/langs var/ipfire/langs
etc/logrotate.conf etc/logrotate.conf
etc/rc.d/init.d/firewall etc/rc.d/init.d/firewall
@@ -17,3 +19,4 @@ usr/local/bin/xt_geoip_update
var/ipfire/backup/bin/backup.pl var/ipfire/backup/bin/backup.pl
var/ipfire/qos/bin/makeqosscripts.pl var/ipfire/qos/bin/makeqosscripts.pl
var/ipfire/suricata/ruleset-sources var/ipfire/suricata/ruleset-sources
srv/web/ipfire/cgi-bin/ovpnmain.cgi

12
src/initscripts/system/firewall
View File

@@ -6,7 +6,6 @@
eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
ROOTHINTS="/etc/unbound/root.hints"
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
if [ -f /var/ipfire/red/device ]; then if [ -f /var/ipfire/red/device ]; then
@@ -309,17 +308,6 @@ iptables_init() {
iptables -N TOR_OUTPUT iptables -N TOR_OUTPUT
iptables -A OUTPUT -j TOR_OUTPUT iptables -A OUTPUT -j TOR_OUTPUT
# Allow outgoing DNS traffic (TCP and UDP) to DNS root servers
local rootserverips="$( awk '/\s+A\s+/ { print $4 }' ${ROOTHINTS} )"
ipset -N root-servers iphash
for ip in "${rootserverips[@]}"; do
ipset add root-servers $ip
done
iptables -A OUTPUT -m set --match-set root-servers dst -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -m set --match-set root-servers dst -p udp --dport 53 -j ACCEPT
# Jump into the actual firewall ruleset. # Jump into the actual firewall ruleset.
iptables -N INPUTFW iptables -N INPUTFW
iptables -A INPUT -j INPUTFW iptables -A INPUT -j INPUTFW