]>
Commit | Line | Data |
---|---|---|
1 | #!/bin/sh | |
2 | ############################################################################### | |
3 | # # | |
4 | # IPFire.org - A linux based firewall # | |
5 | # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org> # | |
6 | # # | |
7 | # This program is free software: you can redistribute it and/or modify # | |
8 | # it under the terms of the GNU General Public License as published by # | |
9 | # the Free Software Foundation, either version 3 of the License, or # | |
10 | # (at your option) any later version. # | |
11 | # # | |
12 | # This program is distributed in the hope that it will be useful, # | |
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # | |
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # | |
15 | # GNU General Public License for more details. # | |
16 | # # | |
17 | # You should have received a copy of the GNU General Public License # | |
18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # | |
19 | # # | |
20 | ############################################################################### | |
21 | ||
22 | eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) | |
23 | eval $(/usr/local/bin/readhash /var/ipfire/firewall/settings) | |
24 | eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) | |
25 | ||
26 | function iptables() { | |
27 | /sbin/iptables --wait "$@" | |
28 | } | |
29 | ||
30 | iptables -F POLICYFWD | |
31 | iptables -F POLICYOUT | |
32 | iptables -F POLICYIN | |
33 | ||
34 | if [ -f "/var/ipfire/red/iface" ]; then | |
35 | IFACE="$(</var/ipfire/red/iface)" | |
36 | fi | |
37 | ||
38 | # Figure out what devices are configured. | |
39 | HAVE_BLUE="false" | |
40 | HAVE_ORANGE="false" | |
41 | ||
42 | case "${CONFIG_TYPE}" in | |
43 | 2) | |
44 | HAVE_ORANGE="true" | |
45 | ;; | |
46 | 3) | |
47 | HAVE_BLUE="true" | |
48 | ;; | |
49 | 4) | |
50 | HAVE_BLUE="true" | |
51 | HAVE_ORANGE="true" | |
52 | ;; | |
53 | esac | |
54 | ||
55 | HAVE_IPSEC="true" | |
56 | HAVE_OPENVPN="true" | |
57 | ||
58 | # INPUT | |
59 | ||
60 | # Allow access from GREEN | |
61 | if [ -n "${GREEN_DEV}" ]; then | |
62 | iptables -A POLICYIN -i "${GREEN_DEV}" -j ACCEPT | |
63 | fi | |
64 | ||
65 | # Allow access from BLUE | |
66 | if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then | |
67 | iptables -A POLICYIN -i "${BLUE_DEV}" -j ACCEPT | |
68 | fi | |
69 | ||
70 | # IPsec INPUT | |
71 | case "${HAVE_IPSEC},${POLICY}" in | |
72 | true,MODE1) ;; | |
73 | true,*) | |
74 | iptables -A POLICYIN -m policy --pol ipsec --dir in -j ACCEPT | |
75 | ;; | |
76 | esac | |
77 | ||
78 | # OpenVPN INPUT | |
79 | # Allow direct access to the internal IP addresses of the firewall | |
80 | # from remote subnets if forward policy is allowed. | |
81 | case "${HAVE_OPENVPN},${POLICY}" in | |
82 | true,MODE1) ;; | |
83 | true,*) | |
84 | iptables -A POLICYIN -i tun+ -j ACCEPT | |
85 | ;; | |
86 | esac | |
87 | ||
88 | case "${FWPOLICY2}" in | |
89 | REJECT) | |
90 | if [ "${DROPINPUT}" = "on" ]; then | |
91 | iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT " | |
92 | fi | |
93 | iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT" | |
94 | ;; | |
95 | *) # DROP | |
96 | if [ "${DROPINPUT}" = "on" ]; then | |
97 | iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT " | |
98 | fi | |
99 | iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT" | |
100 | ;; | |
101 | esac | |
102 | ||
103 | # FORWARD | |
104 | case "${POLICY}" in | |
105 | MODE1) | |
106 | case "${FWPOLICY}" in | |
107 | REJECT) | |
108 | if [ "${DROPFORWARD}" = "on" ]; then | |
109 | iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD " | |
110 | fi | |
111 | iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD" | |
112 | ;; | |
113 | *) # DROP | |
114 | if [ "${DROPFORWARD}" = "on" ]; then | |
115 | iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD " | |
116 | fi | |
117 | iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD" | |
118 | ;; | |
119 | esac | |
120 | ;; | |
121 | ||
122 | *) | |
123 | # Access from GREEN is granted to everywhere | |
124 | if [ -n "${GREEN_DEV}" ]; then | |
125 | if [ "${IFACE}" = "${GREEN_DEV}" ]; then | |
126 | # internet via green | |
127 | # don't check source IP/NET if IFACE is GREEN | |
128 | iptables -A POLICYFWD -i "${GREEN_DEV}" -j ACCEPT | |
129 | else | |
130 | iptables -A POLICYFWD -i "${GREEN_DEV}" -s "${GREEN_NETADDRESS}/${GREEN_NETMASK}" -j ACCEPT | |
131 | fi | |
132 | fi | |
133 | ||
134 | # Grant access for IPsec VPN connections | |
135 | iptables -A POLICYFWD -m policy --pol ipsec --dir in -j ACCEPT | |
136 | ||
137 | # Grant access for OpenVPN connections | |
138 | iptables -A POLICYFWD -i tun+ -j ACCEPT | |
139 | ||
140 | if [ -n "${IFACE}" ]; then | |
141 | if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then | |
142 | iptables -A POLICYFWD -i "${BLUE_DEV}" -s "${BLUE_NETADDRESS}/${BLUE_NETMASK}" -o "${IFACE}" -j ACCEPT | |
143 | fi | |
144 | ||
145 | if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then | |
146 | iptables -A POLICYFWD -i "${ORANGE_DEV}" -s "${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" -o "${IFACE}" -j ACCEPT | |
147 | fi | |
148 | fi | |
149 | ||
150 | if [ "${DROPFORWARD}" = "on" ]; then | |
151 | iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD " | |
152 | fi | |
153 | iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP | |
154 | ;; | |
155 | esac | |
156 | ||
157 | # OUTGOING | |
158 | case "${POLICY1}" in | |
159 | MODE1) | |
160 | case "${FWPOLICY1}" in | |
161 | REJECT) | |
162 | if [ "${DROPOUTGOING}" = "on" ]; then | |
163 | iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT " | |
164 | fi | |
165 | iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT" | |
166 | ;; | |
167 | *) # DROP | |
168 | if [ "${DROPOUTGOING}" == "on" ]; then | |
169 | iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT " | |
170 | fi | |
171 | iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT" | |
172 | ;; | |
173 | esac | |
174 | ;; | |
175 | *) | |
176 | iptables -A POLICYOUT -j ACCEPT | |
177 | iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP | |
178 | ;; | |
179 | esac | |
180 | ||
181 | exit 0 |