firewall: initialize IFACE if it is empty

[people/mfischer/ipfire-2.x.git] / src / initscripts / system / firewall

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 776e70d6eea299a865f0a190f72f4269537f2188..577c10c89d8c71c6125b120fd0899f4011bb0c76 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -7,6 +7,9 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
+if [ -z $IFACE]; then
+       IFACE="red0"
+fi
 
 if [ -f /var/ipfire/red/device ]; then
        DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
@@ -80,6 +83,14 @@ iptables_init() {
        fi
        iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 
+       # Log and subsequently drop spoofed packets or "martians", arriving from sources
+       # on interfaces where we don't expect them
+       iptables -N SPOOFED_MARTIAN
+       if [ "$DROPSPOOFEDMARTIAN" == "on" ]; then
+               iptables -A SPOOFED_MARTIAN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_SPOOFED_MARTIAN "
+       fi
+       iptables -A SPOOFED_MARTIAN -j DROP -m comment --comment "DROP_SPOOFED_MARTIAN"
+
        # Chain to contain all the rules relating to bad TCP flags
        iptables -N BADTCP
 
@@ -110,10 +121,8 @@ iptables_init() {
        # Connection tracking chains
        iptables -N CONNTRACK
        iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
-       iptables -A CONNTRACK -m conntrack --ctstate INVALID -j DROP
+       iptables -A CONNTRACK -m conntrack --ctstate INVALID -j LOG_DROP
        iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
-       iptables -t raw -N CONNTRACK
-       iptables -t raw -A PREROUTING -j CONNTRACK
 
        # Restore any connection marks
        iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
@@ -133,12 +142,24 @@ iptables_init() {
        iptables -t nat -N CUSTOMPOSTROUTING
        iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
 
+       # Log and drop any traffic from and to networks known as being hostile, posing
+       # a technical threat to our users (i. e. listed at Spamhaus DROP et al.)
+       iptables -N HOSTILE
+       if [ "$DROPHOSTILE" == "on" ]; then
+               iptables -A HOSTILE -m limit --limit 10/second -j LOG  --log-prefix "DROP_HOSTILE "
+               iptables -A INPUT   -i $IFACE -m geoip --src-cc XD -j HOSTILE
+               iptables -A FORWARD -i $IFACE -m geoip --src-cc XD -j HOSTILE
+               iptables -A FORWARD -o $IFACE -m geoip --dst-cc XD -j HOSTILE
+               iptables -A OUTPUT  -o $IFACE -m geoip --src-cc XD -j HOSTILE
+       fi
+       iptables -A HOSTILE -j DROP -m comment --comment "DROP_HOSTILE"
+
        # P2PBLOCK
        iptables -N P2PBLOCK
        iptables -A INPUT -j P2PBLOCK
        iptables -A FORWARD -j P2PBLOCK
        iptables -A OUTPUT -j P2PBLOCK
-       
+
        # IPS (Guardian) chains
        iptables -N GUARDIAN
        iptables -A INPUT -j GUARDIAN
@@ -179,14 +200,18 @@ iptables_init() {
        iptables -A INPUT -j ICMPINPUT
        iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
 
-       # Accept everything on loopback
+       # Accept everything on loopback if source/destination is loopback space...
        iptables -N LOOPBACK
-       iptables -A LOOPBACK -i lo -j ACCEPT
-       iptables -A LOOPBACK -o lo -j ACCEPT
+       iptables -A LOOPBACK -i lo -s 127.0.0.0/8 -j ACCEPT
+       iptables -A LOOPBACK -o lo -d 127.0.0.0/8 -j ACCEPT
+
+       # ... and drop everything else on the loopback interface, since no other traffic should appear there
+       iptables -A LOOPBACK -i lo -j SPOOFED_MARTIAN
+       iptables -A LOOPBACK -o lo -j SPOOFED_MARTIAN
 
-       # Filter all packets with loopback addresses on non-loopback interfaces.
-       iptables -A LOOPBACK -s 127.0.0.0/8 -j DROP
-       iptables -A LOOPBACK -d 127.0.0.0/8 -j DROP
+       # Filter all packets with loopback addresses on non-loopback interfaces (spoofed)
+       iptables -A LOOPBACK -s 127.0.0.0/8 -j SPOOFED_MARTIAN
+       iptables -A LOOPBACK -d 127.0.0.0/8 -j SPOOFED_MARTIAN
 
        for i in INPUT FORWARD OUTPUT; do
                iptables -A ${i} -j LOOPBACK
@@ -229,6 +254,10 @@ iptables_init() {
                iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
        fi
 
+       # Tor (inbound)
+       iptables -N TOR_INPUT
+       iptables -A INPUT -j TOR_INPUT
+
        # Location Block
        iptables -N LOCATIONBLOCK
        iptables -A INPUT -j LOCATIONBLOCK
@@ -262,12 +291,10 @@ iptables_init() {
        iptables -N OVPNINPUT
        iptables -A INPUT -j OVPNINPUT
 
-       # Tor (inbound and outbound)
-       iptables -N TOR_INPUT
-       iptables -A INPUT -j TOR_INPUT
+       # Tor (outbound)
        iptables -N TOR_OUTPUT
        iptables -A OUTPUT -j TOR_OUTPUT
-       
+
        # Jump into the actual firewall ruleset.
        iptables -N INPUTFW
        iptables -A INPUT -j INPUTFW
@@ -362,6 +389,17 @@ iptables_red_up() {
        iptables -F REDFORWARD
        iptables -t nat -F REDNAT
 
+       # Prohibit spoofing our own IP address on RED
+       if [ -f /var/ipfire/red/active ]; then
+               REDIP="$( cat /var/ipfire/red/local-ipaddress )";
+
+               if [ "$IFACE" != "" ]; then
+                       iptables -A REDINPUT -s $REDIP -i $IFACE -j SPOOFED_MARTIAN
+               elif [ "$DEVICE" != "" ]; then
+                       iptables -A REDINPUT -s $REDIP -i $DEVICE -j SPOOFED_MARTIAN
+               fi
+       fi
+
        # PPPoE / PPTP Device
        if [ "$IFACE" != "" ]; then
                # PPPoE / PPTP