src/initscripts/system/firewall

   1 #!/bin/sh
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /etc/sysconfig/rc
  23 . ${rc_functions}
  24
  25 eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
  28 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
  29 if [ -z $IFACE ]; then
  30         IFACE="red0"
  31 fi
  32
  33 if [ -f /var/ipfire/red/device ]; then
  34         DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
  35 fi
  36
  37 NAT_MASK="0x0f000000"
  38
  39 IPS_REPEAT_MARK="0x80000000"
  40 IPS_REPEAT_MASK="0x80000000"
  41 IPS_BYPASS_MARK="0x40000000"
  42 IPS_BYPASS_MASK="0x40000000"
  43
  44 IPSET_DB_DIR="/var/lib/location/ipset"
  45
  46 function iptables() {
  47         /sbin/iptables --wait "$@"
  48 }
  49
  50 iptables_init() {
  51         # Flush all rules and delete all custom chains
  52         iptables -F
  53         iptables -t nat -F
  54         iptables -t mangle -F
  55         iptables -t raw -F
  56         iptables -X
  57         iptables -t nat -X
  58         iptables -t mangle -X
  59         iptables -t raw -X
  60
  61         # Set up policies
  62         iptables -P INPUT DROP
  63         iptables -P FORWARD DROP
  64         iptables -P OUTPUT ACCEPT
  65
  66         # Enable TRACE logging to syslog
  67         modprobe nf_log_ipv4
  68         sysctl -q -w net.netfilter.nf_log.2=nf_log_ipv4
  69
  70         # IPS Bypass Chain which stores the BYPASS bit in connection tracking
  71         iptables -N IPSBYPASS
  72         iptables -A IPSBYPASS -j CONNMARK --save-mark --mask "$(( ~IPS_REPEAT_MASK & 0xffffffff ))"
  73
  74         # Jump into bypass chain when the BYPASS bit is set
  75         for chain in INPUT FORWARD OUTPUT; do
  76                 iptables -A "${chain}" -m mark \
  77                         --mark "$(( IPS_REPEAT_MARK | IPS_BYPASS_MARK ))/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j IPSBYPASS
  78         done
  79
  80         # Empty LOG_DROP and LOG_REJECT chains
  81         iptables -N LOG_DROP
  82         iptables -A LOG_DROP   -m limit --limit 10/second -j LOG
  83         iptables -A LOG_DROP   -j DROP
  84         iptables -N LOG_REJECT
  85         iptables -A LOG_REJECT -m limit --limit 10/second -j LOG
  86         iptables -A LOG_REJECT -j REJECT
  87
  88         # This chain will log, then DROPs packets with certain bad combinations
  89         # of flags might indicate a port-scan attempt (xmas, null, etc.)
  90         iptables -N PSCAN
  91         if [ "$DROPPORTSCAN" == "on" ]; then
  92                 iptables -A PSCAN -p tcp  -m limit --limit 10/second -j LOG --log-prefix "DROP_TCP Scan "  -m comment --comment "DROP_TCP PScan"
  93                 iptables -A PSCAN -p udp  -m limit --limit 10/second -j LOG --log-prefix "DROP_UDP Scan "  -m comment --comment "DROP_UDP PScan"
  94                 iptables -A PSCAN -p icmp -m limit --limit 10/second -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
  95                 iptables -A PSCAN -f      -m limit --limit 10/second -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
  96         fi
  97         iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
  98
  99         # New tcp packets without SYN set - could well be an obscure type of port scan
 100         # that's not covered above, may just be a broken Windows machine
 101         iptables -N NEWNOTSYN
 102         if [ "$DROPNEWNOTSYN" == "on" ]; then
 103                 iptables -A NEWNOTSYN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_NEWNOTSYN "
 104         fi
 105         iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 106
 107         # Log and subsequently drop spoofed packets or "martians", arriving from sources
 108         # on interfaces where we don't expect them
 109         iptables -N SPOOFED_MARTIAN
 110         if [ "$DROPSPOOFEDMARTIAN" == "on" ]; then
 111                 iptables -A SPOOFED_MARTIAN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_SPOOFED_MARTIAN "
 112         fi
 113         iptables -A SPOOFED_MARTIAN -j DROP -m comment --comment "DROP_SPOOFED_MARTIAN"
 114
 115         # Chain to contain all the rules relating to bad TCP flags
 116         iptables -N BADTCP
 117
 118         # Don't check loopback
 119         iptables -A BADTCP -i lo -j RETURN
 120
 121         # Disallow packets frequently used by port-scanners
 122         # NMAP FIN/URG/PSH (XMAS scan)
 123         iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN
 124         # SYN/RST/ACK/FIN/URG
 125         iptables -A BADTCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j PSCAN
 126         # ALL/ALL
 127         iptables -A BADTCP -p tcp --tcp-flags ALL ALL -j PSCAN
 128         # FIN Stealth
 129         iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
 130         # SYN/RST (also catches xmas variants that set SYN+RST+...)
 131         iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
 132         # SYN/FIN (QueSO or nmap OS probe)
 133         iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
 134         # Null
 135         iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
 136         # NEW TCP without SYN
 137         iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 138
 139         iptables -A INPUT   -p tcp -j BADTCP
 140         iptables -A FORWARD -p tcp -j BADTCP
 141
 142         # Connection tracking chains
 143         iptables -N CTINVALID
 144         if [ "$LOGDROPCTINVALID" == "on" ]; then
 145                 iptables -A CTINVALID  -m limit --limit 10/second -j LOG  --log-prefix "DROP_CTINVALID "
 146         fi
 147         iptables -A CTINVALID  -j DROP -m comment --comment "DROP_CTINVALID"
 148
 149         iptables -N CONNTRACK
 150         iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
 151         iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID
 152         iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 153
 154         # Restore any connection marks
 155         iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
 156
 157         # Fix for braindead ISPs
 158         iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 159
 160         # CUSTOM chains, can be used by the users themselves
 161         iptables -N CUSTOMINPUT
 162         iptables -A INPUT -j CUSTOMINPUT
 163         iptables -N CUSTOMFORWARD
 164         iptables -A FORWARD -j CUSTOMFORWARD
 165         iptables -N CUSTOMOUTPUT
 166         iptables -A OUTPUT -j CUSTOMOUTPUT
 167         iptables -t nat -N CUSTOMPREROUTING
 168         iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
 169         iptables -t nat -N CUSTOMPOSTROUTING
 170         iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
 171
 172         # Log and drop any traffic from and to networks known as being hostile, posing
 173         # a technical threat to our users (i. e. listed at Spamhaus DROP et al.)
 174         iptables -N HOSTILE
 175         if [ "$DROPHOSTILE" == "on" ]; then
 176                 # Call ipset and load the list which contains the hostile networks.
 177                 ipset restore < $IPSET_DB_DIR/CC_XD.ipset4
 178
 179                 iptables -A HOSTILE -m limit --limit 10/second -j LOG  --log-prefix "DROP_HOSTILE "
 180                 iptables -A INPUT   -i $IFACE -m set --match-set CC_XD src -j HOSTILE
 181                 iptables -A FORWARD -i $IFACE -m set --match-set CC_XD src -j HOSTILE
 182                 iptables -A FORWARD -o $IFACE -m set --match-set CC_XD dst -j HOSTILE
 183                 iptables -A OUTPUT  -o $IFACE -m set --match-set CC_XD src -j HOSTILE
 184         fi
 185         iptables -A HOSTILE -j DROP -m comment --comment "DROP_HOSTILE"
 186
 187         # IPS (Guardian) chains
 188         iptables -N GUARDIAN
 189         iptables -A INPUT -j GUARDIAN
 190         iptables -A FORWARD -j GUARDIAN
 191
 192         # Block non-established IPsec networks
 193         iptables -N IPSECBLOCK
 194         iptables -A FORWARD -m policy --dir out --pol none -j IPSECBLOCK
 195         iptables -A OUTPUT  -m policy --dir out --pol none -j IPSECBLOCK
 196
 197         # Block OpenVPN transfer networks
 198         iptables -N OVPNBLOCK
 199         iptables -A INPUT   -i tun+ -j OVPNBLOCK
 200         iptables -A FORWARD -i tun+ -j OVPNBLOCK
 201         iptables -A FORWARD -o tun+ -j OVPNBLOCK
 202
 203         # IPS (Suricata) chains
 204         iptables -N IPS_INPUT
 205         iptables -N IPS_FORWARD
 206         iptables -N IPS_OUTPUT
 207
 208         for chain in INPUT FORWARD OUTPUT; do
 209                 iptables -A "${chain}" -m mark --mark "0x0/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j "IPS_${chain}"
 210         done
 211
 212         # OpenVPN transfer network translation
 213         iptables -t nat -N OVPNNAT
 214         iptables -t nat -A POSTROUTING -j OVPNNAT
 215
 216         # IPTV chains for IGMPPROXY
 217         iptables -N IPTVINPUT
 218         iptables -A INPUT -j IPTVINPUT
 219         iptables -N IPTVFORWARD
 220         iptables -A FORWARD -j IPTVFORWARD
 221
 222         # Allow to ping the firewall.
 223         iptables -N ICMPINPUT
 224         iptables -A INPUT -j ICMPINPUT
 225         iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
 226
 227         # Accept everything on loopback
 228         iptables -N LOOPBACK
 229         iptables -A LOOPBACK -i lo -j ACCEPT
 230         iptables -A LOOPBACK -o lo -j ACCEPT
 231
 232         # Filter all packets with loopback addresses on non-loopback interfaces (spoofed)
 233         iptables -A LOOPBACK -s 127.0.0.0/8 -j SPOOFED_MARTIAN
 234         iptables -A LOOPBACK -d 127.0.0.0/8 -j SPOOFED_MARTIAN
 235
 236         for i in INPUT FORWARD OUTPUT; do
 237                 iptables -A ${i} -j LOOPBACK
 238         done
 239
 240         # Captive portal
 241         iptables -N CAPTIVE_PORTAL
 242         iptables -N CAPTIVE_PORTAL_CLIENTS
 243         for i in INPUT FORWARD; do
 244                 iptables -A ${i} -j CAPTIVE_PORTAL
 245         done
 246
 247         # Accept everything connected
 248         for i in INPUT FORWARD OUTPUT; do
 249                 iptables -A ${i} -j CONNTRACK
 250         done
 251
 252         # Allow DHCP
 253         iptables -N DHCPINPUT
 254         iptables -A DHCPINPUT -p udp --sport 68 --dport 67 -j ACCEPT
 255         iptables -A DHCPINPUT -p tcp --sport 68 --dport 67 -j ACCEPT
 256
 257         iptables -N DHCPOUTPUT
 258         iptables -A DHCPOUTPUT -p udp --sport 67 --dport 68 -j ACCEPT
 259         iptables -A DHCPOUTPUT -p tcp --sport 67 --dport 68 -j ACCEPT
 260
 261         # Allow DHCP on GREEN
 262         iptables -N DHCPGREENINPUT
 263         iptables -N DHCPGREENOUTPUT
 264         if [ -n "${GREEN_DEV}" ]; then
 265                 iptables -A INPUT  -i "${GREEN_DEV}" -j DHCPGREENINPUT
 266                 iptables -A OUTPUT -o "${GREEN_DEV}" -j DHCPGREENOUTPUT
 267         fi
 268
 269         # Allow DHCP on BLUE to be turned on/off
 270         iptables -N DHCPBLUEINPUT
 271         iptables -N DHCPBLUEOUTPUT
 272         if [ -n "${BLUE_DEV}" ]; then
 273                 iptables -A INPUT  -i "${BLUE_DEV}" -j DHCPBLUEINPUT
 274                 iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
 275         fi
 276
 277         # Tor (inbound)
 278         iptables -N TOR_INPUT
 279         iptables -A INPUT -j TOR_INPUT
 280
 281         # Location Block
 282         iptables -N LOCATIONBLOCK
 283         iptables -A INPUT -j LOCATIONBLOCK
 284         iptables -A FORWARD -j LOCATIONBLOCK
 285
 286         # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
 287         iptables -N IPSECINPUT
 288         iptables -N IPSECFORWARD
 289         iptables -N IPSECOUTPUT
 290         iptables -A INPUT -j IPSECINPUT
 291         iptables -A FORWARD -j IPSECFORWARD
 292         iptables -A OUTPUT -j IPSECOUTPUT
 293         iptables -t nat -N IPSECNAT
 294         iptables -t nat -A POSTROUTING -j IPSECNAT
 295
 296         # localhost and ethernet.
 297         # Always allow accessing the web GUI from GREEN.
 298         iptables -N GUIINPUT
 299         iptables -A INPUT -j GUIINPUT
 300         if [ -n "${GREEN_DEV}" ]; then
 301                 iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
 302         fi
 303
 304         # WIRELESS chains
 305         iptables -N WIRELESSINPUT
 306         iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
 307         iptables -N WIRELESSFORWARD
 308         iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
 309
 310         # OpenVPN
 311         iptables -N OVPNINPUT
 312         iptables -A INPUT -j OVPNINPUT
 313
 314         # Tor (outbound)
 315         iptables -N TOR_OUTPUT
 316         iptables -A OUTPUT -j TOR_OUTPUT
 317
 318         # Jump into the actual firewall ruleset.
 319         iptables -N INPUTFW
 320         iptables -A INPUT -j INPUTFW
 321
 322         iptables -N OUTGOINGFW
 323         iptables -A OUTPUT -j OUTGOINGFW
 324
 325         iptables -N FORWARDFW
 326         iptables -A FORWARD -j FORWARDFW
 327
 328         # SNAT rules
 329         iptables -t nat -N NAT_SOURCE
 330         iptables -t nat -A POSTROUTING -j NAT_SOURCE
 331
 332         # Captive Portal
 333         iptables -t nat -N CAPTIVE_PORTAL
 334         iptables -t nat -A PREROUTING -j CAPTIVE_PORTAL
 335
 336         # Custom prerouting chains (for transparent proxy)
 337         iptables -t nat -N SQUID
 338         iptables -t nat -A PREROUTING -j SQUID
 339
 340         # DNAT rules
 341         iptables -t nat -N NAT_DESTINATION
 342         iptables -t nat -A PREROUTING -j NAT_DESTINATION
 343         iptables -t nat -A OUTPUT -j NAT_DESTINATION
 344
 345         iptables -t mangle -N NAT_DESTINATION
 346         iptables -t mangle -A PREROUTING -j NAT_DESTINATION
 347
 348         iptables -t nat -N NAT_DESTINATION_FIX
 349         iptables -t nat -A POSTROUTING -j NAT_DESTINATION_FIX
 350
 351         if [ -n "${GREEN_ADDRESS}" ]; then
 352                 iptables -t nat -A NAT_DESTINATION_FIX \
 353                         -m mark --mark "0x01000000/${NAT_MASK}" -j SNAT --to-source "${GREEN_ADDRESS}"
 354         fi
 355
 356         if [ -n "${BLUE_ADDRESS}" ]; then
 357                 iptables -t nat -A NAT_DESTINATION_FIX \
 358                         -m mark --mark "0x02000000/${NAT_MASK}" -j SNAT --to-source "${BLUE_ADDRESS}"
 359         fi
 360
 361         if [ -n "${ORANGE_ADDRESS}" ]; then
 362                 iptables -t nat -A NAT_DESTINATION_FIX \
 363                         -m mark --mark "0x04000000/${NAT_MASK}" -j SNAT --to-source "${ORANGE_ADDRESS}"
 364         fi
 365
 366         # RED chain, used for the red interface
 367         iptables -N REDINPUT
 368         iptables -A INPUT -j REDINPUT
 369         iptables -N REDFORWARD
 370         iptables -A FORWARD -j REDFORWARD
 371         iptables -t nat -N REDNAT
 372         iptables -t nat -A POSTROUTING -j REDNAT
 373
 374         # Populate IPsec chains
 375         /usr/lib/firewall/ipsec-policy
 376
 377         # Apply OpenVPN firewall rules
 378         /usr/local/bin/openvpnctrl --firewall-rules
 379
 380         # run wirelessctrl
 381         /usr/local/bin/wirelessctrl
 382
 383         # run captivectrl
 384         /usr/local/bin/captivectrl
 385
 386         # POLICY CHAIN
 387         iptables -N POLICYIN
 388         iptables -A INPUT -j POLICYIN
 389         iptables -N POLICYFWD
 390         iptables -A FORWARD -j POLICYFWD
 391         iptables -N POLICYOUT
 392         iptables -A OUTPUT -j POLICYOUT
 393
 394         # Initialize firewall policies.
 395         /usr/sbin/firewall-policy
 396
 397         # Install firewall rules for the red interface.
 398         iptables_red_up
 399
 400         # If red has not been brought up yet, we will
 401         # add the blocking rules for MASQUERADE
 402         if [ ! -e "/var/ipfire/red/active" ]; then
 403                 iptables_red_down
 404         fi
 405 }
 406
 407 iptables_red_up() {
 408         iptables -F REDINPUT
 409         iptables -F REDFORWARD
 410         iptables -t nat -F REDNAT
 411
 412         # Prohibit spoofing our own IP address on RED
 413         if [ -f /var/ipfire/red/active ]; then
 414                 REDIP="$( cat /var/ipfire/red/local-ipaddress )";
 415
 416                 if [ "$IFACE" != "" ]; then
 417                         iptables -A REDINPUT -s $REDIP -i $IFACE -j SPOOFED_MARTIAN
 418                 elif [ "$DEVICE" != "" ]; then
 419                         iptables -A REDINPUT -s $REDIP -i $DEVICE -j SPOOFED_MARTIAN
 420                 fi
 421         fi
 422
 423         # PPPoE / PPTP Device
 424         if [ "$IFACE" != "" ]; then
 425                 # PPPoE / PPTP
 426                 if [ "$DEVICE" != "" ]; then
 427                         iptables -A REDINPUT -i $DEVICE -j ACCEPT
 428                 fi
 429                 if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
 430                         if [ "$RED_DEV" != "" ]; then
 431                                 iptables -A REDINPUT -i $RED_DEV -j ACCEPT
 432                         fi
 433                 fi
 434         fi
 435
 436         # PPTP over DHCP
 437         if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
 438                 iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 439                 iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 440         fi
 441
 442         if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
 443                 # DHCP
 444                 if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
 445                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 446                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 447                 fi
 448                 if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
 449                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 450                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 451                 fi
 452
 453                 # Outgoing masquerading (don't masqerade IPsec)
 454                 iptables -t nat -A REDNAT -m policy --pol ipsec --dir=out -o "${IFACE}" -j RETURN
 455
 456                 if [ "${IFACE}" = "${GREEN_DEV}" ]; then
 457                         iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN
 458                 fi
 459
 460                 local NO_MASQ_NETWORKS
 461
 462                 if [ "${MASQUERADE_GREEN}" = "off" ]; then
 463                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${GREEN_NETADDRESS}/${GREEN_NETMASK}"
 464                 fi
 465
 466                 if [ "${MASQUERADE_BLUE}" = "off" ]; then
 467                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${BLUE_NETADDRESS}/${BLUE_NETMASK}"
 468                 fi
 469
 470                 if [ "${MASQUERADE_ORANGE}" = "off" ]; then
 471                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${ORANGE_NETADDRESS}/${ORANGE_NETMASK}"
 472                 fi
 473
 474                 local network
 475                 for network in ${NO_MASQ_NETWORKS}; do
 476                         iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN
 477                 done
 478
 479                 # Masquerade everything else
 480                 iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
 481         fi
 482
 483         # Reload all rules.
 484         /usr/local/bin/firewallctrl
 485 }
 486
 487 iptables_red_down() {
 488         # Prohibit packets to reach the masquerading rule
 489         # while the WAN interface is down - this is required to
 490         # circumvent udp related NAT issues
 491         # http://forum.ipfire.org/index.php?topic=11127.0
 492         if [ -n "${IFACE}" ]; then
 493                 iptables -F REDFORWARD
 494                 iptables -A REDFORWARD -o "${IFACE}" -j DROP
 495         fi
 496
 497         # Reload all rules.
 498         /usr/local/bin/firewallctrl
 499 }
 500
 501 # See how we were called.
 502 case "$1" in
 503   start)
 504         boot_mesg "Setting up firewall"
 505         iptables_init
 506         evaluate_retval
 507         ;;
 508   reload|up)
 509         boot_mesg "Reloading firewall"
 510         iptables_red_up
 511         evaluate_retval
 512         ;;
 513   down)
 514         boot_mesg "Disabling firewall access to RED"
 515         iptables_red_down
 516         evaluate_retval
 517         ;;
 518   restart)
 519         $0 start
 520         ;;
 521   *)
 522         echo "Usage: $0 {start|reload|restart}"
 523         exit 1
 524         ;;
 525 esac
 526
 527 exit 0