core186: ship header.pl

[ipfire-2.x.git] / config / firewall / rules.pl

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 1b628df169948f7771005c4a430334ef3af572a4..a47c260a152647ab9c740578d4e3c0f27beb0d0a 100644 (file)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2020  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2024  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -55,6 +55,7 @@ my @PRIVATE_NETWORKS = (
        "172.16.0.0/12",
        "192.168.0.0/16",
        "100.64.0.0/10",
+       "224.0.0.0/4",
 );
 
 # MARK masks
@@ -725,8 +726,8 @@ sub drop_hostile_networks () {
        &ipset_restore($HOSTILE_CCODE);
 
        # Check traffic in incoming/outgoing direction and drop if it matches
-       run("$IPTABLES -A HOSTILE -i $RED_DEV -m set --match-set $HOSTILE_CCODE src -j HOSTILE_DROP");
-       run("$IPTABLES -A HOSTILE -o $RED_DEV -m set --match-set $HOSTILE_CCODE dst -j HOSTILE_DROP");
+       run("$IPTABLES -A HOSTILE -i $RED_DEV -m set --match-set $HOSTILE_CCODE src -j HOSTILE_DROP_IN");
+       run("$IPTABLES -A HOSTILE -o $RED_DEV -m set --match-set $HOSTILE_CCODE dst -j HOSTILE_DROP_OUT");
 }
 
 sub ipblocklist () {
@@ -761,7 +762,7 @@ sub ipblocklist () {
                        }
 
                        # Check if logging is enabled.
-                       if($blocklistsettings{'LOGGING'} eq "on") {
+                       if(($blocklistsettings{'LOGGING'}) && ($blocklistsettings{'LOGGING'} eq "on")) {
                                # Create logging rule.
                                run("$IPTABLES -A ${blocklist}_DROP -j LOG -m limit --limit 10/second --log-prefix \"BLKLST_$blocklist \"");
                        }