Michael Tremer
bb3834231e
firewall: Sort order in which chains are initialized.
...
This has been some real trouble because multiple rules could
not be properly inserted into the rule chains in the kernel
because the chains did not exist, yet.
2014-03-01 15:02:42 +01:00
Michael Tremer
55a5bcae74
firewall: Call firewallctrl with full path.
2014-02-26 20:03:32 +01:00
Michael Tremer
66f6b279b0
Reload all firewall rules when /etc/init.d/firewall reload is executed.
2014-02-25 12:23:09 +01:00
Michael Tremer
c2f7250b23
firewall: Remove even more redundant rules.
2014-02-21 11:35:05 +01:00
Michael Tremer
29201ca84b
firewall: Remove redundant rule.
2014-02-20 13:01:36 +01:00
Michael Tremer
0f5c5ce72d
firewall: Load init script functions.
2014-02-14 16:10:21 +01:00
Michael Tremer
cdb725da87
firewall: Load conntrack modules in firewall script.
2014-02-14 12:54:08 +01:00
Michael Tremer
7d7740a467
firewall: Initialize basic ruleset before entering runlevel 3.
2014-02-14 12:48:11 +01:00
Michael Tremer
159c55c5c8
firewall: Call firewall.local start at the very end.
2014-02-14 12:40:11 +01:00
Michael Tremer
c581b670ef
firewall: Use --wait for every iptables call.
2014-02-14 12:35:40 +01:00
Alexander Marx
c0f99754df
Firewall: now it is possible to connect from one ipfire to a green network of another openvpn connected ipfire
...
Please take care to put this into the docu! One can create DROP rules if
the remote ipfire should NOT be able to connect to the others internal
networks. Therefor you have to take the green interface IP as SOURCE!
2013-12-23 11:05:04 +01:00
Alexander Marx
fac3861429
Firewall: Bugfix: in /etc/init.d/firewall the REDNAT chain was affected BEFORE NAT_SOURCE. Outgoing SNAT rules where not working though
2013-12-16 12:29:02 +01:00
Michael Tremer
ab4876ad42
firewall: Don't require to enable the RW server for N2N networks.
...
The firewall rules for OpenVPN have not been applied for N2N
connections when the road warrior server was disabled.
2013-11-08 13:38:09 +01:00
Alexander Marx
8039a71099
Firewall: renamed forwardfwctrl to firewallctrl
2013-10-24 09:42:42 +02:00
Michael Tremer
987b75bcd4
firewall: Add TOR chains.
2013-08-09 14:49:35 +02:00
Alexander Marx
e1efb8199d
Forward Firewall: deleted postrouting block in firewall (not used anywhere)
2013-08-09 14:15:33 +02:00
Michael Tremer
bb12dd7b69
iptables: Cleanup creating SNAT/DNAT chains.
2013-08-09 14:15:33 +02:00
Michael Tremer
47cd046aed
iptables: Remove OPENSSL{PHYSICAL,VIRTUAL} chains which are unused.
2013-08-09 14:15:33 +02:00
Michael Tremer
d5f1422d81
iptables: Jump into the firewall rulesets after everything else has been done.
2013-08-09 14:15:33 +02:00
Michael Tremer
51ab1de143
iptables: Create OVPNNAT chain after CUSTOM* chains.
2013-08-09 14:15:32 +02:00
Michael Tremer
815eaff433
iptables: Create guardian's chains after the CUSTOM* chains.
2013-08-09 14:15:32 +02:00
Michael Tremer
1e55533052
iptables: Cleanup creating the OVPNBLOCK chain.
...
This should happen after the CUSTOM* chains.
2013-08-09 14:15:32 +02:00
Michael Tremer
3b9a23ce07
iptables: Block all loopback packets on non-loopback interfaces.
2013-08-09 14:15:32 +02:00
Michael Tremer
afc611d448
iptables: Create LOOPBACK chain.
...
This chain accepts all communication on the loopback
interface without running it through the entire connection
tracking first.
Packets on lo can never be blocked and must always be
accepted. The firewall has to trust itself anyway.
2013-08-09 14:15:32 +02:00
Michael Tremer
c0359d6dfb
iptables: Only jump into BADTCP for TCP packets.
...
This saves us from evaluating lots of rules for non-TCP
packets.
2013-08-09 14:15:32 +02:00
Michael Tremer
b85d2a9819
iptables: Replace state module by conntrack module.
...
The state module is deprecated in recent releases of iptables
and should not be used any more.
Additionally, this patch adds an extra chain for all
connection tracking rules, so we can keep the entire ruleset
more small and clean.
2013-08-09 14:15:32 +02:00
Alexander Marx
c12392c0ef
Forward Firewall: removed NAT table and txt file.
2013-08-09 14:15:29 +02:00
Alexander Marx
ff4770c79b
Forward Firewall: changed /etc/init.d/firewall. deleted stop routine and rearranged iptables_init and restart routine
...
Now it should be possible to use /etc/init.d/firewall restart without errors
2013-08-09 14:15:29 +02:00
Alexander Marx
e41b651b4a
Forward Firewall: changed order of LOG and DROP rules for INPUT Chain
2013-08-09 14:15:28 +02:00
Alexander Marx
ed9ab82c61
Forward Firewall 0.9.9.7: reordered INPUT POLICY.
2013-08-09 14:15:28 +02:00
Alexander Marx
690b0bd761
Forward Firewall: added OVPNBLOCK and fixed rules.pl to correctly get ip address of red iface
2013-08-09 14:15:28 +02:00
Alexander Marx
e1eef9d53e
Forward Firewall: BUGFIX: When creating DMZ Rules with MANUAL IP as source and afterwards editing the rule, the rule was copied and not just edited.
...
BUGFIX: When using SNAT (outbound) the rule does not seem to work. The NAT_SOURCE chain was on wron position in POSTROUTING
2013-08-09 14:13:12 +02:00
Alexander Marx
c400fe4c84
Forward Firewall: fixed wrong log Entries INPUT_DROP when connected via Web or ssh
2013-08-09 14:13:12 +02:00
Alexander Marx
3e79f33fc2
Forward Firewall: reordered some rules to get rid of INPUT_DROP messages in log when connected to webinterface
2013-08-09 14:13:11 +02:00
Alexander Marx
dc82656bf9
Forward Firewall: 0.9.9.4a - Bugfix typo in firewallscript, DMZ Link on startpage now leads to firewall instead of dmzpinholes
2013-08-09 14:13:10 +02:00
Alexander Marx
aff15defbc
Forward Firewall: rules for collectd now in firewall-policy instead of /etc/init.d/firewall
2013-08-09 14:13:10 +02:00
Alexander Marx
53f4c74d9b
Forward Firewall: some changes in firewall script to make collectd work
2013-08-09 14:13:10 +02:00
Alexander Marx
ed31c098f5
Forward Firewall: added drop rules to firewall's stop script so that collectd is working
2013-08-09 14:13:10 +02:00
Alexander Marx
94ea1f0346
Forward Firewall: fixed firewall hits statistik and extended it to show input,output,forward,newnotsyn and portscan seperately.
2013-08-09 14:13:10 +02:00
Alexander Marx
218b3341b6
Forward Firewall: cleanup of initscript. Fixes double log entries when INPUT is set to REJECT
2013-08-09 14:11:57 +02:00
Alexander Marx
93b75f31ad
Forward Firewall: clean up some files
...
Fix iptables loop wirelessctrl
Fix firewall chain order
Fix policies (added comment for statistic)
2013-08-09 14:11:56 +02:00
Alexander Marx
9efd8d1c7e
Forward Firewall: delete old portforwarding from system and fix for wlan-firewall part 1 (loop)
2013-08-09 14:11:56 +02:00
Alexander Marx
ef6f983b17
Forward Firewall: put rule OUTGOING ACCEPT Related, established into /etc/init.d/firewall
...
deleted ACCEPT OUTGOINGFW related,established from POLICYOUT
2013-08-09 14:11:55 +02:00
Alexander Marx
a9b3ae26a3
Forward Firewall: /etc/init.d/firewall now creates POLICYIN
2013-08-09 14:11:09 +02:00
Alexander Marx
fd4d137dbe
Forward Firewall: deleted outgoingfwmac, is now useless
2013-08-09 14:10:16 +02:00
Alexander Marx
b324de14db
Forward Firewall: fix wlan clients now working with forwardfw
2013-08-09 14:08:23 +02:00
Alexander Marx
5d7faa4518
Forward Firewall: First part of adding OUTGOING to th efirewall
2013-08-09 14:08:20 +02:00
Alexander Marx
12dcfbbdbe
Forward Firewall: Portfw now working and firewall closed correctly
2013-08-09 14:08:19 +02:00
Alexander Marx
d6bdebd47d
Forward Firewall: fixed icmp-types and deleted dmzholes chain
2013-08-09 14:08:17 +02:00
Alexander Marx
0b14d3d9b1
Forward Firewall: fixed portforward rules. Now possible even if firewall in mode1
2013-08-09 14:08:16 +02:00
