From: Stefan Schantl <stefan.schantl@ipfire.org>
Date: Wed, 6 Apr 2022 19:15:52 +0000 (+0200)
Subject: suricata: Do not create silly forward rules.
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fheads%2Fids-whitelist-ipset;p=people%2Fstevee%2Fipfire-2.x.git

suricata: Do not create silly forward rules.

Skip creating forward rules if the input and the output device are the
same.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---

diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 5ede405ce1..a40e02c83d 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -171,6 +171,11 @@ function generate_fw_rules {
 
 			# Create rules which are required to handle forwarded traffic.
 			for enabled_ips_zone_forward in "${enabled_ips_zones[@]}"; do
+				# Skip loop iteration if both zones are the same.
+				if [ "$enabled_ips_zone" -eq "$enabled_ips_zone_forward" ]; then
+					continue
+				fi
+				
 				# Check if the whetelist file is not empty.
 				if [ -s "$WHITELIST_FILE" ]; then
 					# Create rules to handle whitelisted hosts.