webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-19 15:32:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Forward Firewall: put rule OUTGOING ACCEPT Related, established into /etc/init.d/firewall

Browse Source 
deleted ACCEPT OUTGOINGFW related,established from POLICYOUT
This commit is contained in:
Alexander Marx
2013-03-07 10:01:24 +01:00
committed by Michael Tremer
parent a0f267b92c
commit ef6f983b17
2 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
config/forwardfw/firewall-policy
View File

@@ -7,6 +7,7 @@ iptables -F POLICYFWD
iptables -F POLICYOUT
iptables -F POLICYIN
#FORWARDFW
if [ "$POLICY" == "MODE1" ]; then
if [ "$FWPOLICY" == "REJECT" ]; then
if [ "$DROPFORWARD" == "on" ]; then
@@ -21,20 +22,20 @@ if [ "$POLICY" == "MODE1" ]; then
/sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
fi
fi
#OUTGOINGFW
if [ "$POLICY1" == "MODE1" ]; then
/sbin/iptables -I OUTGOINGFW 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
if [ "$FWPOLICY1" == "REJECT" ]; then
if [ "$DROPOUTGOING" == "on" ]; then
/sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
fi
/sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_OUTPUT"
if [ "$FWPOLICY1" == "REJECT" ]; then
if [ "$DROPOUTGOING" == "on" ]; then
/sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
fi
if [ "$FWPOLICY1" == "DROP" ]; then
if [ "$DROPOUTGOING" == "on" ]; then
/sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
fi
/sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
/sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_OUTPUT"
fi
if [ "$FWPOLICY1" == "DROP" ]; then
if [ "$DROPOUTGOING" == "on" ]; then
/sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
fi
/sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
fi
fi
#INPUT
if [ "$FWPOLICY2" == "REJECT" ]; then

6
src/initscripts/init.d/firewall
View File

@@ -149,10 +149,10 @@ case "$1" in
/sbin/iptables -N CUSTOMFORWARD
/sbin/iptables -A FORWARD -j CUSTOMFORWARD
/sbin/iptables -N CUSTOMOUTPUT
/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -j CUSTOMOUTPUT
/sbin/iptables -N OUTGOINGFW
/sbin/iptables -A OUTPUT -j OUTGOINGFW
/sbin/iptables -A OUTGOINGFW -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -t nat -N CUSTOMPREROUTING
/sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
/sbin/iptables -t nat -N CUSTOMPOSTROUTING
@@ -173,6 +173,10 @@ case "$1" in
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Accept everything on lo
iptables -A INPUT -i lo -m state --state NEW -j ACCEPT
iptables -A OUTPUT -o lo -m state --state NEW -j ACCEPT
# trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
/sbin/iptables -N IPSECINPUT
/sbin/iptables -N IPSECFORWARD