firewall: Move dropping hostile networks to rules.pl.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 7a7c8ed31af62a77a02b5f3f8f81039fc59ae16f..b12764d187a4175d4412e379c23bd53ac5b18a90 100644 (file)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -59,6 +59,9 @@ my @PRIVATE_NETWORKS = (
 # MARK masks
 my $NAT_MASK = 0x0f000000;
 
+# Country code, which is used to mark hostile networks.
+my $HOSTILE_CCODE = "XD";
+
 my %fwdfwsettings=();
 my %fwoptions = ();
 my %defaultNetworks=();
@@ -97,6 +100,9 @@ if (-e "$locationfile") {
 # Get all available locations.
 my @locations = &Location::Functions::get_locations();
 
+# Name or the RED interface.
+my $RED_DEV = &General::get_red_interface();
+
 my @log_limit_options = &make_log_limit_options();
 
 my $POLICY_INPUT_ALLOWED   = 0;
@@ -135,6 +141,9 @@ sub main {
        # Load Location block rules.
        &locationblock();
 
+       # Load rules to block hostile networks.
+       &drop_hostile_networks();
+
        # Reload firewall policy.
        run("/usr/sbin/firewall-policy");
 
@@ -676,6 +685,30 @@ sub locationblock {
        }
 }
 
+sub drop_hostile_networks () {
+       # Flush the HOSTILE firewall chain.
+       run("$IPTABLES -F HOSTILE");
+
+       # If dropping hostile networks is not enabled, we are finished here.
+       if ($fwoptions{'DROPHOSTILE'} ne "on") {
+               # Exit function.
+               return;
+       }
+
+       # Call function to load the network list of hostile networks.
+       &ipset_restore($HOSTILE_CCODE);
+
+       # Setup rules to pass traffic which does not belong to a hostile network.
+       run("$IPTABLES -A HOSTILE -i $RED_DEV -m set ! --match-set $HOSTILE_CCODE src -j RETURN");
+       run("$IPTABLES -A HOSTILE -o $RED_DEV -m set ! --match-set $HOSTILE_CCODE dst -j RETURN");
+
+       # Setup logging.
+       run("$IPTABLES -A HOSTILE -m limit --limit 10/second -j LOG  --log-prefix \"DROP_HOSTILE \"");
+
+       # Drop traffic from/to hostile network.
+        run("$IPTABLES -A HOSTILE -j DROP -m comment --comment \"DROP_HOSTILE\"");
+}
+
 sub get_protocols {
        my $hash = shift;
        my $key = shift;

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 22e3fae5943550abeb4692ca8d6e5f1c372cb748..2c4d3163b6839304140c65c333b245be1bd24d18 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -169,21 +169,6 @@ iptables_init() {
        iptables -t nat -N CUSTOMPOSTROUTING
        iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
 
-       # Log and drop any traffic from and to networks known as being hostile, posing
-       # a technical threat to our users (i. e. listed at Spamhaus DROP et al.)
-       iptables -N HOSTILE
-       if [ "$DROPHOSTILE" == "on" ]; then
-               # Call ipset and load the list which contains the hostile networks.
-               ipset restore < $IPSET_DB_DIR/CC_XD.ipset4
-
-               iptables -A HOSTILE -m limit --limit 10/second -j LOG  --log-prefix "DROP_HOSTILE "
-               iptables -A INPUT   -i $IFACE -m set --match-set CC_XD src -j HOSTILE
-               iptables -A FORWARD -i $IFACE -m set --match-set CC_XD src -j HOSTILE
-               iptables -A FORWARD -o $IFACE -m set --match-set CC_XD dst -j HOSTILE
-               iptables -A OUTPUT  -o $IFACE -m set --match-set CC_XD src -j HOSTILE
-       fi
-       iptables -A HOSTILE -j DROP -m comment --comment "DROP_HOSTILE"
-
        # IPS (Guardian) chains
        iptables -N GUARDIAN
        iptables -A INPUT -j GUARDIAN
@@ -274,6 +259,14 @@ iptables_init() {
                iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
        fi
 
+       # Chains for networks known as being hostile, posing a technical threat to our users
+       # (i. e. listed at Spamhaus DROP et al.)
+       iptables -N HOSTILE
+       iptables -A INPUT -i $IFACE -j HOSTILE
+       iptables -A FORWARD -i $IFACE -j HOSTILE
+       iptables -A FORWARD -o $IFACE -j HOSTILE
+       iptables -A OUTPUT -o $IFACE -j HOSTILE
+
        # Tor (inbound)
        iptables -N TOR_INPUT
        iptables -A INPUT -j TOR_INPUT