Merge branch 'master' into fifteen

[people/teissler/ipfire-2.x.git] / src / initscripts / init.d / firewall

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 37ef351ed748b2d9da24fd9315d6f516633ac0f6..be0c8b0227a5f22396c7c1522deee0c7d1da014c 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -99,7 +99,7 @@ iptables_init() {
 
        # Block OpenVPN transfer networks
        /sbin/iptables -N OVPNBLOCK
-       for i in INPUT FORWARD OUTPUT; do
+       for i in INPUT FORWARD; do
                /sbin/iptables -A ${i} -j OVPNBLOCK
        done
 
@@ -177,6 +177,10 @@ iptables_init() {
        /sbin/iptables -N FORWARDFW
        /sbin/iptables -A FORWARD -j FORWARDFW
 
+       # SNAT rules
+       /sbin/iptables -t nat -N NAT_SOURCE
+       /sbin/iptables -t nat -A POSTROUTING -j NAT_SOURCE
+
        # RED chain, used for the red interface
        /sbin/iptables -N REDINPUT
        /sbin/iptables -A INPUT -j REDINPUT
@@ -195,10 +199,6 @@ iptables_init() {
        /sbin/iptables -t nat -N NAT_DESTINATION
        /sbin/iptables -t nat -A PREROUTING -j NAT_DESTINATION
 
-       # SNAT rules
-       /sbin/iptables -t nat -N NAT_SOURCE
-       /sbin/iptables -t nat -A POSTROUTING -j NAT_SOURCE
-
        # upnp chain for our upnp daemon
        /sbin/iptables -t nat -N UPNPFW
        /sbin/iptables -t nat -A PREROUTING -j UPNPFW