webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Deleted no longer used 'if' clauses (ALG) from firewall init

Browse Source 
In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25
all ALGs were removed from UI.

But they remained - somehow - in the initscript (firewall).

I tried to remove the remnants - hopefully in the correct way.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Matthias Fischer
2021-05-30 16:21:20 +02:00
committed by Michael Tremer
parent 0e734ef7a8
commit ceb5733c59
1 changed files with 1 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
src/initscripts/system/firewall
View File

@@ -98,74 +98,11 @@ iptables_init() {
iptables -t raw -N CONNTRACK
iptables -t raw -A PREROUTING -j CONNTRACK
# Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
# Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
# GRE (always enabled)
modprobe nf_conntrack_proto_gre
# SIP
if [ "${CONNTRACK_SIP}" = "on" ]; then
modprobe nf_nat_sip
iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-m helper --helper sip -j ACCEPT
for proto in udp tcp; do
iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
done
fi
# H.323
if [ "${CONNTRACK_H323}" = "on" ]; then
modprobe nf_nat_h323
iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-m helper --helper h323 -j ACCEPT
# Gatekeeper RAS
iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
# Q.931
iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
fi
# FTP
if [ "${CONNTRACK_FTP}" = "on" ]; then
modprobe nf_nat_ftp
iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
fi
# PPTP
if [ "${CONNTRACK_PPTP}" = "on" ]; then
modprobe nf_nat_pptp
iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-m helper --helper pptp -j ACCEPT
iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
fi
# TFTP
if [ "${CONNTRACK_TFTP}" = "on" ]; then
modprobe nf_nat_tftp
iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-m helper --helper tftp -j ACCEPT
iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
fi
# IRC
if [ "${CONNTRACK_IRC}" = "on" ]; then
modprobe nf_nat_irc
iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-m helper --helper irc -j ACCEPT
iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
fi
# Amanda
if [ "${CONNTRACK_AMANDA}" = "on" ]; then
modprobe nf_nat_amanda
iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-m helper --helper amanda -j ACCEPT
iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
fi
# Fix for braindead ISPs
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu