firewall: Make blocking all traffic impossible on HOSTILE

[ipfire-2.x.git] / src / initscripts / system / firewall

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 2c4d3163b6839304140c65c333b245be1bd24d18..2a70feac2a091d59857885d7c6d0ce2e423ef668 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -262,10 +262,13 @@ iptables_init() {
        # Chains for networks known as being hostile, posing a technical threat to our users
        # (i. e. listed at Spamhaus DROP et al.)
        iptables -N HOSTILE
-       iptables -A INPUT -i $IFACE -j HOSTILE
-       iptables -A FORWARD -i $IFACE -j HOSTILE
-       iptables -A FORWARD -o $IFACE -j HOSTILE
-       iptables -A OUTPUT -o $IFACE -j HOSTILE
+       iptables -A INPUT -j HOSTILE
+       iptables -A FORWARD -j HOSTILE
+       iptables -A OUTPUT -j HOSTILE
+
+       iptables -N HOSTILE_DROP
+       iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
+       iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE"
 
        # Tor (inbound)
        iptables -N TOR_INPUT