firewall: rules.pl: Refactored entire script.

[people/pmueller/ipfire-2.x.git] / src / initscripts / init.d / firewall

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 2c280f2ba07ce3c9574fc7c6a0f8389c87548d0a..dd678893738ff22b4ecba6ab886910ef01aeb598 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -106,9 +106,10 @@ iptables_init() {
 
        # Block OpenVPN transfer networks
        iptables -N OVPNBLOCK
-       for i in INPUT FORWARD; do
-               iptables -A ${i} -j OVPNBLOCK
-       done
+       iptables -A INPUT   -i tun+ -j OVPNBLOCK
+       iptables -A OUTPUT  -o tun+ -j OVPNBLOCK
+       iptables -A FORWARD -i tun+ -j OVPNBLOCK
+       iptables -A FORWARD -o tun+ -j OVPNBLOCK
 
        # OpenVPN transfer network translation
        iptables -t nat -N OVPNNAT
@@ -196,8 +197,6 @@ iptables_init() {
        iptables -t nat -N REDNAT
        iptables -t nat -A POSTROUTING -j REDNAT
 
-       iptables_red
-
        # Custom prerouting chains (for transparent proxy)
        iptables -t nat -N SQUID
        iptables -t nat -A PREROUTING -j SQUID
@@ -226,10 +225,11 @@ iptables_init() {
        iptables -N POLICYOUT
        iptables -A OUTPUT -j POLICYOUT
 
+       # Initialize firewall policies.
        /usr/sbin/firewall-policy
 
-       # read new firewall
-       /usr/local/bin/firewallctrl
+       # Install firewall rules for the red interface.
+       iptables_red
 }
 
 iptables_red() {
@@ -283,7 +283,7 @@ iptables_red() {
        fi
 
        # Reload all rules.
-       firewallctrl
+       /usr/local/bin/firewallctrl
 }
 
 # See how we were called.