Michael Tremer
529ac19c46
tor: Only start tor when it has been enabled.
2013-08-21 17:22:54 +02:00
Michael Tremer
3765eb6179
tor: Only start tor when it has been enabled.
2013-08-19 13:23:51 +02:00
Timo Eissler
8ec8462ce3
xinetd: New package.
2013-08-18 16:20:59 +02:00
Michael Tremer
8c60701a4f
forwardctrl: Remove unused and possibly dangerous flush option.
...
Also remove unused header files.
2013-08-12 14:42:16 +02:00
Michael Tremer
987b75bcd4
firewall: Add TOR chains.
2013-08-09 14:49:35 +02:00
Alexander Marx
e1efb8199d
Forward Firewall: deleted postrouting block in firewall (not used anywhere)
2013-08-09 14:15:33 +02:00
Michael Tremer
bb12dd7b69
iptables: Cleanup creating SNAT/DNAT chains.
2013-08-09 14:15:33 +02:00
Michael Tremer
47cd046aed
iptables: Remove OPENSSL{PHYSICAL,VIRTUAL} chains which are unused.
2013-08-09 14:15:33 +02:00
Michael Tremer
d5f1422d81
iptables: Jump into the firewall rulesets after everything else has been done.
2013-08-09 14:15:33 +02:00
Michael Tremer
51ab1de143
iptables: Create OVPNNAT chain after CUSTOM* chains.
2013-08-09 14:15:32 +02:00
Michael Tremer
815eaff433
iptables: Create guardian's chains after the CUSTOM* chains.
2013-08-09 14:15:32 +02:00
Michael Tremer
1e55533052
iptables: Cleanup creating the OVPNBLOCK chain.
...
This should happen after the CUSTOM* chains.
2013-08-09 14:15:32 +02:00
Michael Tremer
3b9a23ce07
iptables: Block all loopback packets on non-loopback interfaces.
2013-08-09 14:15:32 +02:00
Michael Tremer
afc611d448
iptables: Create LOOPBACK chain.
...
This chain accepts all communication on the loopback
interface without running it through the entire connection
tracking first.
Packets on lo can never be blocked and must always be
accepted. The firewall has to trust itself anyway.
2013-08-09 14:15:32 +02:00
Michael Tremer
c0359d6dfb
iptables: Only jump into BADTCP for TCP packets.
...
This saves us from evaluating lots of rules for non-TCP
packets.
2013-08-09 14:15:32 +02:00
Michael Tremer
b85d2a9819
iptables: Replace state module by conntrack module.
...
The state module is deprecated in recent releases of iptables
and should not be used any more.
Additionally, this patch adds an extra chain for all
connection tracking rules, so we can keep the entire ruleset
more small and clean.
2013-08-09 14:15:32 +02:00
Alexander Marx
c12392c0ef
Forward Firewall: removed NAT table and txt file.
2013-08-09 14:15:29 +02:00
Alexander Marx
ff4770c79b
Forward Firewall: changed /etc/init.d/firewall. deleted stop routine and rearranged iptables_init and restart routine
...
Now it should be possible to use /etc/init.d/firewall restart without errors
2013-08-09 14:15:29 +02:00
Alexander Marx
e41b651b4a
Forward Firewall: changed order of LOG and DROP rules for INPUT Chain
2013-08-09 14:15:28 +02:00
Alexander Marx
ed9ab82c61
Forward Firewall 0.9.9.7: reordered INPUT POLICY.
2013-08-09 14:15:28 +02:00
Alexander Marx
690b0bd761
Forward Firewall: added OVPNBLOCK and fixed rules.pl to correctly get ip address of red iface
2013-08-09 14:15:28 +02:00
Michael Tremer
d2c4a3cab9
openvpnctrl: Cleanup flushChain functions.
2013-08-09 14:15:28 +02:00
Michael Tremer
2181b55552
openvpnctl: Flush BLOCK and SNAT chain when needed.
2013-08-09 14:15:28 +02:00
Michael Tremer
c31f18b6a9
openvpnctrl: Block all transfer subnets.
2013-08-09 14:15:27 +02:00
Michael Tremer
7c50b04834
openvpnctrl: Remove unneeded code.
2013-08-09 14:15:27 +02:00
Alexander Marx
e1eef9d53e
Forward Firewall: BUGFIX: When creating DMZ Rules with MANUAL IP as source and afterwards editing the rule, the rule was copied and not just edited.
...
BUGFIX: When using SNAT (outbound) the rule does not seem to work. The NAT_SOURCE chain was on wron position in POSTROUTING
2013-08-09 14:13:12 +02:00
Alexander Marx
c400fe4c84
Forward Firewall: fixed wrong log Entries INPUT_DROP when connected via Web or ssh
2013-08-09 14:13:12 +02:00
Alexander Marx
3e79f33fc2
Forward Firewall: reordered some rules to get rid of INPUT_DROP messages in log when connected to webinterface
2013-08-09 14:13:11 +02:00
Alexander Marx
dc82656bf9
Forward Firewall: 0.9.9.4a - Bugfix typo in firewallscript, DMZ Link on startpage now leads to firewall instead of dmzpinholes
2013-08-09 14:13:10 +02:00
Alexander Marx
aff15defbc
Forward Firewall: rules for collectd now in firewall-policy instead of /etc/init.d/firewall
2013-08-09 14:13:10 +02:00
Alexander Marx
53f4c74d9b
Forward Firewall: some changes in firewall script to make collectd work
2013-08-09 14:13:10 +02:00
Alexander Marx
ed31c098f5
Forward Firewall: added drop rules to firewall's stop script so that collectd is working
2013-08-09 14:13:10 +02:00
Alexander Marx
94ea1f0346
Forward Firewall: fixed firewall hits statistik and extended it to show input,output,forward,newnotsyn and portscan seperately.
2013-08-09 14:13:10 +02:00
Alexander Marx
218b3341b6
Forward Firewall: cleanup of initscript. Fixes double log entries when INPUT is set to REJECT
2013-08-09 14:11:57 +02:00
Alexander Marx
93b75f31ad
Forward Firewall: clean up some files
...
Fix iptables loop wirelessctrl
Fix firewall chain order
Fix policies (added comment for statistic)
2013-08-09 14:11:56 +02:00
Alexander Marx
9efd8d1c7e
Forward Firewall: delete old portforwarding from system and fix for wlan-firewall part 1 (loop)
2013-08-09 14:11:56 +02:00
Alexander Marx
ef6f983b17
Forward Firewall: put rule OUTGOING ACCEPT Related, established into /etc/init.d/firewall
...
deleted ACCEPT OUTGOINGFW related,established from POLICYOUT
2013-08-09 14:11:55 +02:00
Alexander Marx
dc33c23b1f
Forward Firewall: Updated strongswan patch provided my Michael. (Changes _updown script from FORWARD ACCEPT to RETURN)
2013-08-09 14:11:52 +02:00
Alexander Marx
a9b3ae26a3
Forward Firewall: /etc/init.d/firewall now creates POLICYIN
2013-08-09 14:11:09 +02:00
Alexander Marx
fd4d137dbe
Forward Firewall: deleted outgoingfwmac, is now useless
2013-08-09 14:10:16 +02:00
Alexander Marx
443a6e8a5f
Forward Firewall: deleted creation of OVPNFORWARD and the accept rule.
2013-08-09 14:09:17 +02:00
Alexander Marx
b324de14db
Forward Firewall: fix wlan clients now working with forwardfw
2013-08-09 14:08:23 +02:00
Alexander Marx
5d7faa4518
Forward Firewall: First part of adding OUTGOING to th efirewall
2013-08-09 14:08:20 +02:00
Alexander Marx
12dcfbbdbe
Forward Firewall: Portfw now working and firewall closed correctly
2013-08-09 14:08:19 +02:00
Alexander Marx
d6bdebd47d
Forward Firewall: fixed icmp-types and deleted dmzholes chain
2013-08-09 14:08:17 +02:00
Alexander Marx
0b14d3d9b1
Forward Firewall: fixed portforward rules. Now possible even if firewall in mode1
2013-08-09 14:08:16 +02:00
Alexander Marx
6adcf1569c
Forward Firewall: set standard rules for blue in mode 2
2013-08-09 14:08:16 +02:00
Alexander Marx
210ee67b53
Forward Firewall: deleted mode0, added default Mode2 and fixed /etc/init.d/firewall to reload the rules correctly on reload. Also made it possible to create broadcastrules (To drop broadcastpackets)
2013-08-09 14:08:15 +02:00
Alexander Marx
e44fa0792b
Forward Firewall: BUGFIX: When editing a rule and changing position, no other changes where saved.
...
added the DMZHOLES Rule to init.d/firewall (but chnaged DMZHOLES to FORWARDFW
2013-08-09 14:08:10 +02:00
Alexander Marx
8dc23ff4fc
Forward Firewall: adapted initscripts/firewall and wirelessctrl.c
...
Now the Wirelesschains should work with new firewall.
2013-08-09 14:08:09 +02:00
