webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-11 19:55:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'ms/firewall-block-green' into next

Browse Source
This commit is contained in:
Michael Tremer
2014-05-22 23:11:43 +02:00
parent 9d707db06e c0e0848f99
commit fded6faa72
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config/firewall/firewall-policy
View File

@@ -57,6 +57,9 @@ HAVE_OPENVPN="true"
# INPUT
# Allow access from GREEN
iptables -A POLICYIN -i "${GREEN_DEV}" -j ACCEPT
# IPsec INPUT
case "${HAVE_IPSEC},${POLICY}" in
true,MODE1) ;;

13
src/initscripts/init.d/firewall
View File

@@ -120,10 +120,10 @@ iptables_init() {
iptables -N IPTVFORWARD
iptables -A FORWARD -j IPTVFORWARD
# filtering from GUI
iptables -N GUIINPUT
iptables -A INPUT -j GUIINPUT
iptables -A GUIINPUT -p icmp --icmp-type 8 -j ACCEPT
# Allow to ping the firewall.
iptables -N ICMPINPUT
iptables -A INPUT -j ICMPINPUT
iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
# Accept everything on loopback
iptables -N LOOPBACK
@@ -179,7 +179,10 @@ iptables_init() {
iptables -t nat -A POSTROUTING -j IPSECNAT
# localhost and ethernet.
iptables -A INPUT -i $GREEN_DEV -m conntrack --ctstate NEW -j ACCEPT ! -p icmp
# Always allow accessing the web GUI from GREEN.
iptables -N GUIINPUT
iptables -A INPUT -j GUIINPUT
iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
# WIRELESS chains
iptables -N WIRELESSINPUT