iptables: Jump into the firewall rulesets after everything else has been done.

[people/teissler/ipfire-2.x.git] / src / initscripts / init.d / firewall

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 33afbef7f7df631171eca3da771ec9d5ba7a46fb..5423f1390c7c7681be8c7ca237fe2b519c1749f0 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -83,21 +83,19 @@ iptables_init() {
        # CUSTOM chains, can be used by the users themselves
        /sbin/iptables -N CUSTOMINPUT
        /sbin/iptables -A INPUT -j CUSTOMINPUT
-       /sbin/iptables -N GUARDIAN
-       /sbin/iptables -A INPUT -j GUARDIAN
-       /sbin/iptables -A FORWARD -j GUARDIAN
        /sbin/iptables -N CUSTOMFORWARD
        /sbin/iptables -A FORWARD -j CUSTOMFORWARD
        /sbin/iptables -N CUSTOMOUTPUT
        /sbin/iptables -A OUTPUT -j CUSTOMOUTPUT
-       /sbin/iptables -N OUTGOINGFW
-       /sbin/iptables -A OUTPUT -j OUTGOINGFW
        /sbin/iptables -t nat -N CUSTOMPREROUTING
-       /sbin/iptables -t nat -N OVPNNAT
        /sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
        /sbin/iptables -t nat -N CUSTOMPOSTROUTING
        /sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
-       /sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
+
+       # Guardian (IPS) chains
+       /sbin/iptables -N GUARDIAN
+       /sbin/iptables -A INPUT -j GUARDIAN
+       /sbin/iptables -A FORWARD -j GUARDIAN
 
        # Block OpenVPN transfer networks
        /sbin/iptables -N OVPNBLOCK
@@ -105,6 +103,10 @@ iptables_init() {
                /sbin/iptables -A ${i} -j OVPNBLOCK
        done
 
+       # OpenVPN transfer network translation
+       /sbin/iptables -t nat -N OVPNNAT
+       /sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
+
        # IPTV chains for IGMPPROXY
        /sbin/iptables -N IPTVINPUT
        /sbin/iptables -A INPUT -j IPTVINPUT
@@ -147,10 +149,6 @@ iptables_init() {
        /sbin/iptables -t nat -N IPSECNAT
        /sbin/iptables -t nat -A POSTROUTING -j IPSECNAT
 
-       # Input Firewall
-       /sbin/iptables -N INPUTFW
-       /sbin/iptables -A INPUT -m conntrack --ctstate NEW -j INPUTFW
-
        # localhost and ethernet.
        /sbin/iptables -A INPUT   -i $GREEN_DEV  -m conntrack --ctstate NEW -j ACCEPT ! -p icmp
        
@@ -164,10 +162,16 @@ iptables_init() {
        /sbin/iptables -N WIRELESSFORWARD
        /sbin/iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
        
-       # Forward Firewall
+       # Jump into the actual firewall ruleset.
+       /sbin/iptables -N INPUTFW
+       /sbin/iptables -A INPUT -j INPUTFW
+
+       /sbin/iptables -N OUTGOINGFW
+       /sbin/iptables -A OUTPUT -j OUTGOINGFW
+
        /sbin/iptables -N FORWARDFW
        /sbin/iptables -A FORWARD -j FORWARDFW
-               
+
        # OPenSSL
        /sbin/iptables -N OPENSSLPHYSICAL
        /sbin/iptables -A INPUT -j OPENSSLPHYSICAL