Merge branch 'master' of ssh://git.ipfire.org/pub/git/ipfire-2.x

[people/mfischer/ipfire-2.x.git] / src / initscripts / system / firewall

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 00512d9fa6015c1804543500f331d75c44fdfc90..1e558ee86a55b2013ac014266138cce42488b84e 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -32,6 +32,10 @@ iptables_init() {
        iptables -P FORWARD DROP
        iptables -P OUTPUT ACCEPT
 
+       # Enable TRACE logging to syslog
+       modprobe nf_log_ipv4
+       sysctl -q -w net.netfilter.nf_log.2=nf_log_ipv4
+
        # Empty LOG_DROP and LOG_REJECT chains
        iptables -N LOG_DROP
        iptables -A LOG_DROP   -m limit --limit 10/second -j LOG
@@ -94,70 +98,10 @@ iptables_init() {
        iptables -t raw -N CONNTRACK
        iptables -t raw -A PREROUTING -j CONNTRACK
 
-       # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
-
-       # SIP
-       if [ "${CONNTRACK_SIP}" = "on" ]; then
-               modprobe nf_nat_sip
-               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-                       -m helper --helper sip -j ACCEPT
-               for proto in udp tcp; do
-                       iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
-               done
-       fi
-
-       # H.323
-       if [ "${CONNTRACK_H323}" = "on" ]; then
-               modprobe nf_nat_h323
-               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-                       -m helper --helper h323 -j ACCEPT
-
-               # Gatekeeper RAS
-               iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
-
-               # Q.931
-               iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
-       fi
-
-       # FTP
-       if [ "${CONNTRACK_FTP}" = "on" ]; then
-               modprobe nf_nat_ftp
-               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-                       -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
-               iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
-       fi
+       # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
 
-       # PPTP
-       if [ "${CONNTRACK_PPTP}" = "on" ]; then
-               modprobe nf_nat_pptp
-               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-                       -m helper --helper pptp -j ACCEPT
-               iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
-       fi
-
-       # TFTP
-       if [ "${CONNTRACK_TFTP}" = "on" ]; then
-               modprobe nf_nat_tftp
-               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-                       -m helper --helper tftp -j ACCEPT
-               iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
-       fi
-
-       # IRC
-       if [ "${CONNTRACK_IRC}" = "on" ]; then
-               modprobe nf_nat_irc
-               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-                       -m helper --helper irc -j ACCEPT
-               iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
-       fi
-
-       # Amanda
-       if [ "${CONNTRACK_AMANDA}" = "on" ]; then
-               modprobe nf_nat_amanda
-               iptables -A CONNTRACK -m conntrack --ctstate RELATED \
-                       -m helper --helper amanda -j ACCEPT
-               iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
-       fi
+       # GRE (always enabled)
+       modprobe nf_conntrack_proto_gre
 
        # Fix for braindead ISPs
        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
@@ -269,10 +213,10 @@ iptables_init() {
                iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
        fi
 
-       # GeoIP block
-       iptables -N GEOIPBLOCK
-       iptables -A INPUT -j GEOIPBLOCK
-       iptables -A FORWARD -j GEOIPBLOCK
+       # Location Block
+       iptables -N LOCATIONBLOCK
+       iptables -A INPUT -j LOCATIONBLOCK
+       iptables -A FORWARD -j LOCATIONBLOCK
 
        # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
        iptables -N IPSECINPUT
@@ -356,12 +300,6 @@ iptables_init() {
                        -m mark --mark 3 -j SNAT --to-source "${ORANGE_ADDRESS}"
        fi
 
-       # upnp chain for our upnp daemon
-       iptables -t nat -N UPNPFW
-       iptables -t nat -A PREROUTING -j UPNPFW
-       iptables -N UPNPFW
-       iptables -A FORWARD -m conntrack --ctstate NEW -j UPNPFW
-
        # RED chain, used for the red interface
        iptables -N REDINPUT
        iptables -A INPUT -j REDINPUT