X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=src%2Finitscripts%2Finit.d%2Ffirewall;h=55bc066aaeb87ba41918cf035a056fa43e50356c;hb=6652626c88bca3a3e89126c47d31779740a21732;hp=c1c0c7e712276ce87e769df08be2e915f9e3f562;hpb=3a1019f6895602c89145cec0e252f015c465a36c;p=people%2Fpmueller%2Fipfire-2.x.git

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index c1c0c7e712..55bc066aae 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -2,6 +2,7 @@
 
 eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
+eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
 
 if [ -f /var/ipfire/red/device ]; then
@@ -33,17 +34,21 @@ iptables_init() {
 	# This chain will log, then DROPs packets with certain bad combinations
 	# of flags might indicate a port-scan attempt (xmas, null, etc)
 	/sbin/iptables -N PSCAN
-	/sbin/iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix "TCP Scan? "
-	/sbin/iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix "UDP Scan? "
-	/sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "ICMP Scan? "
-	/sbin/iptables -A PSCAN -f      -m limit --limit 10/minute -j LOG --log-prefix "FRAG Scan? "
-	/sbin/iptables -A PSCAN -j DROP
+	if [ "$DROPPORTSCAN" == "on" ]; then
+		/sbin/iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan"
+		/sbin/iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UDP PScan"
+		/sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
+		/sbin/iptables -A PSCAN -f      -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
+	fi
+	/sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
 
 	# New tcp packets without SYN set - could well be an obscure type of port scan
 	# that's not covered above, may just be a broken windows machine
 	/sbin/iptables -N NEWNOTSYN
-	/sbin/iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-prefix "NEW not SYN? "
-	/sbin/iptables -A NEWNOTSYN  -j DROP
+	if [ "$DROPNEWNOTSYN" == "on" ]; then
+		/sbin/iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-prefix "DROP_NEWNOTSYN "
+	fi
+	/sbin/iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 
 	# Chain to contain all the rules relating to bad TCP flags
 	/sbin/iptables -N BADTCP
@@ -96,8 +101,7 @@ iptables_red() {
 		# This rule enables a host on ORANGE network to connect to the outside
 		# (only if we have a red connection)
 		if [ "$IFACE" != "" ]; then
-			/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p tcp -o $IFACE -j ACCEPT
-			/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p udp -o $IFACE -j ACCEPT
+			/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT
 		fi
 	fi
 
@@ -127,7 +131,7 @@ case "$1" in
 	# original do nothing line
 	#/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec
 	# the correct one, but the negative '!' do nothing...
-	#/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit ! --limit 10/sec -j DROP
+	#/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN ! -m limit --limit 10/sec -j DROP
 
 	# Fix for braindead ISP's
 	/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
@@ -139,18 +143,43 @@ case "$1" in
 	/sbin/iptables -A FORWARD -j CUSTOMFORWARD
 	/sbin/iptables -N CUSTOMOUTPUT
 	/sbin/iptables -A OUTPUT -j CUSTOMOUTPUT
+	/sbin/iptables -N OUTGOINGFW
+	/sbin/iptables -A OUTPUT -j OUTGOINGFW
 	/sbin/iptables -t nat -N CUSTOMPREROUTING
 	/sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
 	/sbin/iptables -t nat -N CUSTOMPOSTROUTING
 	/sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
 
+	# IPTV chains for IGMPPROXY
+	/sbin/iptables -N IPTVINPUT
+	/sbin/iptables -A INPUT -j IPTVINPUT
+	/sbin/iptables -N IPTVFORWARD
+	/sbin/iptables -A FORWARD -j IPTVFORWARD
+
 	# filtering from GUI
 	/sbin/iptables -N GUIINPUT
 	/sbin/iptables -A INPUT -j GUIINPUT
+	/sbin/iptables -A GUIINPUT -p icmp --icmp-type 8 -j ACCEPT
 
 	# Accept everything connected
 	/sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
 	/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+	
+	# trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
+	/sbin/iptables -N IPSECINPUT
+	/sbin/iptables -N IPSECFORWARD
+	/sbin/iptables -N IPSECOUTPUT
+	/sbin/iptables -N OPENSSLVIRTUAL
+	/sbin/iptables -A INPUT -j IPSECINPUT
+	/sbin/iptables -A INPUT -j OPENSSLVIRTUAL -m comment --comment "OPENSSLVIRTUAL INPUT"
+	/sbin/iptables -A FORWARD -j IPSECFORWARD
+	/sbin/iptables -A FORWARD -j OPENSSLVIRTUAL -m comment --comment "OPENSSLVIRTUAL FORWARD"
+	/sbin/iptables -A OUTPUT -j IPSECOUTPUT
+	#/sbin/iptables -t nat -N IPSECNAT
+	#/sbin/iptables -t nat -A POSTROUTING -j IPSECNAT
+
+	# Outgoing Firewall
+	/sbin/iptables -A FORWARD -j OUTGOINGFW
 
 	# localhost and ethernet.
 	/sbin/iptables -A INPUT   -i lo          -m state --state NEW -j ACCEPT
@@ -159,7 +188,7 @@ case "$1" in
 	/sbin/iptables -A FORWARD -i lo          -m state --state NEW -j ACCEPT
 	/sbin/iptables -A FORWARD -s 127.0.0.0/8 -m state --state NEW -j DROP
 	/sbin/iptables -A FORWARD -d 127.0.0.0/8 -m state --state NEW -j DROP
-	/sbin/iptables -A INPUT   -i $GREEN_DEV  -m state --state NEW -j ACCEPT -p ! icmp
+	/sbin/iptables -A INPUT   -i $GREEN_DEV  -m state --state NEW -j ACCEPT ! -p icmp
 	/sbin/iptables -A FORWARD -i $GREEN_DEV  -m state --state NEW -j ACCEPT
 
 	# If a host on orange tries to initiate a connection to IPFire's red IP and
@@ -167,19 +196,13 @@ case "$1" in
 	# we end up with orange -> orange traffic passing through IPFire
 	[ "$ORANGE_DEV" != "" ] && /sbin/iptables -A FORWARD -i $ORANGE_DEV -o $ORANGE_DEV -m state --state NEW -j ACCEPT
 
-	# accept all traffic from ipsec interfaces
-	/sbin/iptables -A INPUT   -i ipsec+ -j ACCEPT
-	/sbin/iptables -A FORWARD -i ipsec+ -j ACCEPT
-
 	# allow DHCP on BLUE to be turned on/off
 	/sbin/iptables -N DHCPBLUEINPUT 
 	/sbin/iptables -A INPUT -j DHCPBLUEINPUT
 
-	# IPSec chains
-	/sbin/iptables -N IPSECRED
-	/sbin/iptables -A INPUT -j IPSECRED
-	/sbin/iptables -N IPSECBLUE
-	/sbin/iptables -A INPUT -j IPSECBLUE
+	# OPenSSL
+	/sbin/iptables -N OPENSSLPHYSICAL
+	/sbin/iptables -A INPUT -j OPENSSLPHYSICAL
 
 	# WIRELESS chains
 	/sbin/iptables -N WIRELESSINPUT
@@ -218,6 +241,10 @@ case "$1" in
 	/sbin/iptables -t nat -N PORTFW
 	/sbin/iptables -t nat -A PREROUTING -j PORTFW
 
+	# upnp chain for our upnp daemon
+	/sbin/iptables -t nat -N UPNPFW
+	/sbin/iptables -t nat -A PREROUTING -j UPNPFW
+
 
 	# Custom mangle chain (for port fowarding)
 	/sbin/iptables -t mangle -N PORTFWMANGLE
@@ -233,17 +260,25 @@ case "$1" in
 		/sbin/iptables -t nat -A POSTROUTING -m mark --mark 3 -j SNAT --to-source $ORANGE_ADDRESS
 	fi
 
-	# run openvpn
-	/usr/local/bin/openvpnctrl --create-chains-and-rules
-
 	# run local firewall configuration, if present
  	if [ -x /etc/sysconfig/firewall.local ]; then
 		/etc/sysconfig/firewall.local start
 	fi
 	
 	# last rule in input and forward chain is for logging.
-	/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "INPUT "
-	/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT "
+
+	if [ "$DROPINPUT" == "on" ]; then
+		/sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
+	fi
+	/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+	if [ "$DROPOUTPUT" == "on" ]; then
+		/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT "
+	fi
+	/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT"
+        ;;
+  startovpn)  
+	# run openvpn
+	/usr/local/bin/openvpnctrl --create-chains-and-rules
         ;;
   stop)
 	iptables_init
@@ -263,16 +298,23 @@ case "$1" in
 		/sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 	fi
 
-	# stop openvpn
-	/usr/local/bin/openvpnctrl --delete-chains-and-rules
-
 	# run local firewall configuration, if present
  	if [ -x /etc/sysconfig/firewall.local ]; then
 		/etc/sysconfig/firewall.local stop
 	fi
 
-	/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "INPUT "
-	/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT "
+	if [ "$DROPINPUT" == "on" ]; then
+		/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
+	fi
+	/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+	if [ "$DROPOUTPUT" == "on" ]; then
+		/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT "
+	fi
+	/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT"
+        ;;
+  stopovpn)
+	# stop openvpn
+	/usr/local/bin/openvpnctrl --delete-chains-and-rules
         ;;
   reload)
 	iptables_red