From: Adolf Belka Date: Sun, 21 Jan 2024 11:45:49 +0000 (+0100) Subject: firewall: Fixes bug12981 - add if loop to log or not log dropped hostile traffic X-Git-Tag: v2.29-core184~12^2~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=37c5b4b62eb0e6bfb617a7173dd07d473c34f6a5;p=ipfire-2.x.git firewall: Fixes bug12981 - add if loop to log or not log dropped hostile traffic - This v3 version now has two if loops allowing logging of incoming drop hostile or outgoing drop hostile or both or neither. - Dependent on the choice in optionsfw.cgi this loop will either log or not log the dropped hostile traffic. Fixes: bug12981 Tested-by: Adolf Belka Signed-off-by: Adolf Belka Reviewed-by: Bernhard Bitsch Signed-off-by: Michael Tremer --- diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 3aab7dd754..69bdcb594b 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -179,9 +179,18 @@ iptables_init() { iptables -A FORWARD -j HOSTILE iptables -A OUTPUT -j HOSTILE - iptables -N HOSTILE_DROP - iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE " - iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE" + iptables -N HOSTILE_DROP_IN + if [ "$LOGDROPHOSTILEIN" == "on" ]; then + iptables -A HOSTILE_DROP_IN -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE " + fi + iptables -A HOSTILE_DROP_IN -j DROP -m comment --comment "DROP_HOSTILE" + + iptables -N HOSTILE_DROP_OUT + if [ "$LOGDROPHOSTILEOUT" == "on" ]; then + iptables -A HOSTILE_DROP_OUT -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE " + fi + iptables -A HOSTILE_DROP_OUT -j DROP -m comment --comment "DROP_HOSTILE" + # IP Address Blocklist chains iptables -N BLOCKLISTIN