]>
Commit | Line | Data |
---|---|---|
5d7faa45 | 1 | #!/bin/sh |
dc21519f AM |
2 | ############################################################################### |
3 | # # | |
4 | # IPFire.org - A linux based firewall # | |
a85a7a60 | 5 | # Copyright (C) 2007-2019 IPFire Team <info@ipfire.org> # |
dc21519f AM |
6 | # # |
7 | # This program is free software: you can redistribute it and/or modify # | |
8 | # it under the terms of the GNU General Public License as published by # | |
9 | # the Free Software Foundation, either version 3 of the License, or # | |
10 | # (at your option) any later version. # | |
11 | # # | |
12 | # This program is distributed in the hope that it will be useful, # | |
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # | |
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # | |
15 | # GNU General Public License for more details. # | |
16 | # # | |
17 | # You should have received a copy of the GNU General Public License # | |
18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # | |
19 | # # | |
20 | ############################################################################### | |
dc21519f | 21 | |
52c5ec83 | 22 | eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) |
6d8eb5de | 23 | eval $(/usr/local/bin/readhash /var/ipfire/firewall/settings) |
5d7faa45 AM |
24 | eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) |
25 | ||
a211fee3 MT |
26 | function iptables() { |
27 | /sbin/iptables --wait "$@" | |
28 | } | |
29 | ||
5d7faa45 AM |
30 | iptables -F POLICYFWD |
31 | iptables -F POLICYOUT | |
d47bb8a1 | 32 | iptables -F POLICYIN |
53f4c74d AM |
33 | |
34 | if [ -f "/var/ipfire/red/iface" ]; then | |
52c5ec83 | 35 | IFACE="$(</var/ipfire/red/iface)" |
53f4c74d | 36 | fi |
5d7faa45 | 37 | |
52c5ec83 MT |
38 | # Figure out what devices are configured. |
39 | HAVE_BLUE="false" | |
40 | HAVE_ORANGE="false" | |
41 | ||
42 | case "${CONFIG_TYPE}" in | |
43 | 2) | |
bcf1a624 | 44 | HAVE_ORANGE="true" |
52c5ec83 MT |
45 | ;; |
46 | 3) | |
bcf1a624 | 47 | HAVE_BLUE="true" |
52c5ec83 MT |
48 | ;; |
49 | 4) | |
50 | HAVE_BLUE="true" | |
51 | HAVE_ORANGE="true" | |
52 | ;; | |
53 | esac | |
54 | ||
d7050fc0 | 55 | HAVE_IPSEC="true" |
2513ae73 MT |
56 | HAVE_OPENVPN="true" |
57 | ||
52c5ec83 | 58 | # INPUT |
0e53d8a9 | 59 | |
9f60aa96 MT |
60 | # Drop syslog from anywhere but localhost |
61 | # sysklogd cannot bind to specific interface and therefore we need to | |
62 | # block access by adding firewall rules | |
63 | case "${FWPOLICY}" in | |
64 | REJECT) | |
65 | iptables -A POLICYIN -p udp --dport 514 -j REJECT --reject-with icmp-host-unreachable | |
66 | ;; | |
67 | *) | |
68 | iptables -A POLICYIN -p udp --dport 514 -j DROP | |
69 | ;; | |
70 | esac | |
71 | ||
c0e0848f | 72 | # Allow access from GREEN |
475ae4b3 MT |
73 | if [ -n "${GREEN_DEV}" ]; then |
74 | iptables -A POLICYIN -i "${GREEN_DEV}" -j ACCEPT | |
75 | fi | |
c0e0848f | 76 | |
645378fb MT |
77 | # Allow access from BLUE |
78 | if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then | |
79 | iptables -A POLICYIN -i "${BLUE_DEV}" -j ACCEPT | |
80 | fi | |
81 | ||
d7050fc0 MT |
82 | # IPsec INPUT |
83 | case "${HAVE_IPSEC},${POLICY}" in | |
84 | true,MODE1) ;; | |
85 | true,*) | |
86 | iptables -A POLICYIN -m policy --pol ipsec --dir in -j ACCEPT | |
87 | ;; | |
88 | esac | |
89 | ||
0e53d8a9 MT |
90 | # OpenVPN INPUT |
91 | # Allow direct access to the internal IP addresses of the firewall | |
92 | # from remote subnets if forward policy is allowed. | |
93 | case "${HAVE_OPENVPN},${POLICY}" in | |
94 | true,MODE1) ;; | |
95 | true,*) | |
96 | iptables -A POLICYIN -i tun+ -j ACCEPT | |
97 | ;; | |
98 | esac | |
99 | ||
52c5ec83 MT |
100 | case "${FWPOLICY2}" in |
101 | REJECT) | |
102 | if [ "${DROPINPUT}" = "on" ]; then | |
a85a7a60 | 103 | iptables -A POLICYIN -m limit --limit 10/second -j LOG --log-prefix "REJECT_INPUT " |
5d7faa45 | 104 | fi |
a211fee3 | 105 | iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT" |
52c5ec83 MT |
106 | ;; |
107 | *) # DROP | |
108 | if [ "${DROPINPUT}" = "on" ]; then | |
a85a7a60 | 109 | iptables -A POLICYIN -m limit --limit 10/second -j LOG --log-prefix "DROP_INPUT " |
5d7faa45 | 110 | fi |
a211fee3 | 111 | iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT" |
52c5ec83 MT |
112 | ;; |
113 | esac | |
93b75f31 | 114 | |
52c5ec83 MT |
115 | # FORWARD |
116 | case "${POLICY}" in | |
117 | MODE1) | |
118 | case "${FWPOLICY}" in | |
119 | REJECT) | |
120 | if [ "${DROPFORWARD}" = "on" ]; then | |
a85a7a60 | 121 | iptables -A POLICYFWD -m limit --limit 10/second -j LOG --log-prefix "REJECT_FORWARD " |
52c5ec83 | 122 | fi |
a211fee3 | 123 | iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD" |
52c5ec83 MT |
124 | ;; |
125 | *) # DROP | |
126 | if [ "${DROPFORWARD}" = "on" ]; then | |
a85a7a60 | 127 | iptables -A POLICYFWD -m limit --limit 10/second -j LOG --log-prefix "DROP_FORWARD " |
52c5ec83 | 128 | fi |
a211fee3 | 129 | iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD" |
52c5ec83 MT |
130 | ;; |
131 | esac | |
132 | ;; | |
133 | ||
134 | *) | |
c26a9ed2 | 135 | # Access from GREEN is granted to everywhere |
475ae4b3 MT |
136 | if [ -n "${GREEN_DEV}" ]; then |
137 | if [ "${IFACE}" = "${GREEN_DEV}" ]; then | |
138 | # internet via green | |
139 | # don't check source IP/NET if IFACE is GREEN | |
140 | iptables -A POLICYFWD -i "${GREEN_DEV}" -j ACCEPT | |
141 | else | |
142 | iptables -A POLICYFWD -i "${GREEN_DEV}" -s "${GREEN_NETADDRESS}/${GREEN_NETMASK}" -j ACCEPT | |
143 | fi | |
c926c637 | 144 | fi |
c26a9ed2 MT |
145 | |
146 | # Grant access for IPsec VPN connections | |
147 | iptables -A POLICYFWD -m policy --pol ipsec --dir in -j ACCEPT | |
148 | ||
149 | # Grant access for OpenVPN connections | |
150 | iptables -A POLICYFWD -i tun+ -j ACCEPT | |
151 | ||
52c5ec83 MT |
152 | if [ -n "${IFACE}" ]; then |
153 | if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then | |
c26a9ed2 | 154 | iptables -A POLICYFWD -i "${BLUE_DEV}" -s "${BLUE_NETADDRESS}/${BLUE_NETMASK}" -o "${IFACE}" -j ACCEPT |
52c5ec83 | 155 | fi |
8089b78d | 156 | |
c26a9ed2 MT |
157 | if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then |
158 | iptables -A POLICYFWD -i "${ORANGE_DEV}" -s "${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" -o "${IFACE}" -j ACCEPT | |
8089b78d | 159 | fi |
c26a9ed2 | 160 | fi |
8089b78d | 161 | |
c26a9ed2 | 162 | if [ "${DROPFORWARD}" = "on" ]; then |
a85a7a60 | 163 | iptables -A POLICYFWD -m limit --limit 10/second -j LOG --log-prefix "DROP_FORWARD " |
5d7faa45 | 164 | fi |
a211fee3 | 165 | iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP |
52c5ec83 MT |
166 | ;; |
167 | esac | |
168 | ||
169 | # OUTGOING | |
170 | case "${POLICY1}" in | |
171 | MODE1) | |
172 | case "${FWPOLICY1}" in | |
173 | REJECT) | |
174 | if [ "${DROPOUTGOING}" = "on" ]; then | |
a85a7a60 | 175 | iptables -A POLICYOUT -m limit --limit 10/second -j LOG --log-prefix "REJECT_OUTPUT " |
52c5ec83 | 176 | fi |
a211fee3 | 177 | iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT" |
52c5ec83 MT |
178 | ;; |
179 | *) # DROP | |
180 | if [ "${DROPOUTGOING}" == "on" ]; then | |
a85a7a60 | 181 | iptables -A POLICYOUT -m limit --limit 10/second -j LOG --log-prefix "DROP_OUTPUT " |
52c5ec83 | 182 | fi |
a211fee3 | 183 | iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT" |
52c5ec83 MT |
184 | ;; |
185 | esac | |
186 | ;; | |
187 | *) | |
a211fee3 MT |
188 | iptables -A POLICYOUT -j ACCEPT |
189 | iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP | |
52c5ec83 MT |
190 | ;; |
191 | esac | |
aff15def AM |
192 | |
193 | exit 0 |