From: Michael Tremer <michael.tremer@ipfire.org>
Date: Tue, 17 Sep 2024 02:04:07 +0000 (+0200)
Subject: firewall: Move the IPS back to INPUT/FORWARD/OUTPUT
X-Git-Tag: v2.29-core189~27
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cf44d8d149dbda8aa8dccd89dd5e3ff75af628b9;p=ipfire-2.x.git

firewall: Move the IPS back to INPUT/FORWARD/OUTPUT

We cannot use the PREROUTING/POSTROUTING chains here because Suricata
will fail to track NAT-ed connections.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 7dbbe38cb3..ab4833a7f1 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -378,7 +378,7 @@ iptables_init() {
 	# IPS (Suricata) chains
 	iptables -t mangle -N IPS
 
-	for chain in PREROUTING POSTROUTING; do
+	for chain in INPUT FORWARD OUTPUT; do
 		iptables -t mangle -A "${chain}" -j IPS
 	done