webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Filter only on RED and exclude any private address space

Browse Source 
Since libloc is built as a tree we cannot simply exclude any address
space in the middle of it. Therefore we create some firewall rules
which simply avoid checking non-globally routable address space.

Fixes: #12499
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2020-10-14 11:32:05 +01:00
parent 642557e23b
commit c69c820025
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
config/firewall/rules.pl
View File

@@ -48,6 +48,13 @@ my @PROTOCOLS_WITH_PORTS = ("tcp", "udp");
my @VALID_TARGETS = ("ACCEPT", "DROP", "REJECT");
my @PRIVATE_NETWORKS = (
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16",
"100.64.0.0/10",
);
my %fwdfwsettings=();
my %fwoptions = ();
my %defaultNetworks=();
@@ -621,6 +628,16 @@ sub locationblock {
return;
}
# Only check the RED interface
if ($defaultNetworks{'RED_DEV'} ne "") {
run("$IPTABLES -A LOCATIONBLOCK ! -i $defaultNetworks{'RED_DEV'} -j RETURN");
}
# Do not check any private address space
foreach my $network (@PRIVATE_NETWORKS) {
run("$IPTABLES -A LOCATIONBLOCK -s $network -j RETURN");
}
# Loop through all supported locations and
# create iptables rules, if blocking for this country
# is enabled.

1
config/rootfiles/core/151/filelists/files
View File

@@ -10,6 +10,7 @@ srv/web/ipfire/cgi-bin/ipinfo.cgi
srv/web/ipfire/cgi-bin/pakfire.cgi
srv/web/ipfire/cgi-bin/vpnmain.cgi
usr/bin/probenic.sh
usr/lib/firewall/rules.pl
usr/local/bin/ipsecctrl
var/ipfire/general-functions.pl
var/ipfire/langs