From: Michael Tremer <michael.tremer@ipfire.org>
Date: Tue, 17 Sep 2024 02:04:07 +0000 (+0200)
Subject: firewall: Move the IPS back to INPUT/FORWARD/OUTPUT
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=225bd32f5b80b7d8a8ee07b2a9b321ffa7bacf7c;p=people%2Fms%2Fipfire-2.x.git

firewall: Move the IPS back to INPUT/FORWARD/OUTPUT

We cannot use the PREROUTING/POSTROUTING chains here because Suricata
will fail to track NAT-ed connections.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 7dbbe38cb..ab4833a7f 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -378,7 +378,7 @@ iptables_init() {
 	# IPS (Suricata) chains
 	iptables -t mangle -N IPS
 
-	for chain in PREROUTING POSTROUTING; do
+	for chain in INPUT FORWARD OUTPUT; do
 		iptables -t mangle -A "${chain}" -j IPS
 	done