webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Make blocking all traffic impossible on HOSTILE

Browse Source 
The current setup can fail and block all traffic on RED if the RETURN
rules could not be created.

This can happen when the kernel fails to load the ipset module, as it is
the case after upgrading to a new kernel. Restarting the firewall will
cause that the system is being cut off the internet.

This design now changes that if those rules cannot be created, the
DROP_HOSTILE feature is just inactive, but it would not disrupt any
traffic.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2022-03-11 14:43:11 +00:00
parent 46b8eb9e7f
commit e77d960bac
2 changed files with 10 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
config/firewall/rules.pl
View File

@@ -701,15 +701,9 @@ sub drop_hostile_networks () {
# Call function to load the network list of hostile networks.
&ipset_restore($HOSTILE_CCODE);
# Setup rules to pass traffic which does not belong to a hostile network.
run("$IPTABLES -A HOSTILE -i $RED_DEV -m set ! --match-set $HOSTILE_CCODE src -j RETURN");
run("$IPTABLES -A HOSTILE -o $RED_DEV -m set ! --match-set $HOSTILE_CCODE dst -j RETURN");
# Setup logging.
run("$IPTABLES -A HOSTILE -m limit --limit 10/second -j LOG --log-prefix \"DROP_HOSTILE \"");
# Drop traffic from/to hostile network.
run("$IPTABLES -A HOSTILE -j DROP -m comment --comment \"DROP_HOSTILE\"");
# Check traffic in incoming/outgoing direction and drop if it matches
run("$IPTABLES -A HOSTILE -i $RED_DEV -m set --match-set $HOSTILE_CCODE src -j HOSTILE_DROP");
run("$IPTABLES -A HOSTILE -o $RED_DEV -m set --match-set $HOSTILE_CCODE dst -j HOSTILE_DROP");
}
sub get_protocols {

11
src/initscripts/system/firewall
View File

@@ -262,10 +262,13 @@ iptables_init() {
# Chains for networks known as being hostile, posing a technical threat to our users
# (i. e. listed at Spamhaus DROP et al.)
iptables -N HOSTILE
iptables -A INPUT -i $IFACE -j HOSTILE
iptables -A FORWARD -i $IFACE -j HOSTILE
iptables -A FORWARD -o $IFACE -j HOSTILE
iptables -A OUTPUT -o $IFACE -j HOSTILE
iptables -A INPUT -j HOSTILE
iptables -A FORWARD -j HOSTILE
iptables -A OUTPUT -j HOSTILE
iptables -N HOSTILE_DROP
iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE"
# Tor (inbound)
iptables -N TOR_INPUT