strongswan: Do not create any NAT rules when using VTI/GRE
[ipfire-2.x.git] / lfs / configroot
1 ###############################################################################
2 #                                                                             #
3 # IPFire.org - A linux based firewall                                         #
4 # Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
5 #                                                                             #
6 # This program is free software: you can redistribute it and/or modify        #
7 # it under the terms of the GNU General Public License as published by        #
8 # the Free Software Foundation, either version 3 of the License, or           #
9 # (at your option) any later version.                                         #
10 #                                                                             #
11 # This program is distributed in the hope that it will be useful,             #
12 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
14 # GNU General Public License for more details.                                #
15 #                                                                             #
16 # You should have received a copy of the GNU General Public License           #
17 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
18 #                                                                             #
19 ###############################################################################
20
21 ###############################################################################
22 # Definitions
23 ###############################################################################
24
25 include Config
26
27 VER        = ipfire
28
29 THISAPP    = configroot
30 DIR_APP    = $(DIR_SRC)/$(THISAPP)
31 TARGET     = $(DIR_INFO)/$(THISAPP)
32
33 ###############################################################################
34 # Top-level Rules
35 ###############################################################################
36
37 install : $(TARGET)
38
39 check :
40
41 download :
42
43 md5 :
44
45 ###############################################################################
46 # Installation Details
47 ###############################################################################
48
49 $(TARGET) :
50         @$(PREBUILD)
51
52         # Create all directories
53         for i in addon-lang auth backup ca captive certs connscheduler crls ddns dhcp dhcpc dns dnsforward \
54                         ethernet extrahd/bin fwlogs fwhosts firewall isdn key langs logging mac main \
55                         menu.d modem optionsfw \
56                         ovpn patches pakfire portfw ppp private proxy/advanced/cre \
57                         proxy/calamaris/bin qos/bin red remote sensors snort time \
58                         updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin upnp vpn \
59                         wakeonlan wireless ; do \
60                 mkdir -p $(CONFIG_ROOT)/$$i; \
61         done
62
63         # Touch empty files
64         for i in auth/users backup/include.user backup/exclude.user \
65             captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \
66             dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
67             ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \
68             fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \
69             isdn/settings mac/settings main/hosts main/routing main/settings optionsfw/settings \
70             ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \
71             ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \
72             qos/tosconfig snort/settings upnp/settings vpn/config vpn/settings vpn/ipsec.conf \
73             vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings; do \
74             touch $(CONFIG_ROOT)/$$i; \
75         done
76
77         # Copy initial configfiles
78         cp $(DIR_SRC)/config/cfgroot/header.pl                  $(CONFIG_ROOT)/
79         cp $(DIR_SRC)/config/cfgroot/general-functions.pl       $(CONFIG_ROOT)/
80         cp $(DIR_SRC)/config/cfgroot/network-functions.pl       $(CONFIG_ROOT)/
81         cp $(DIR_SRC)/config/cfgroot/geoip-functions.pl         $(CONFIG_ROOT)/
82         cp $(DIR_SRC)/config/cfgroot/aws-functions.pl           $(CONFIG_ROOT)/
83         cp $(DIR_SRC)/config/cfgroot/lang.pl                    $(CONFIG_ROOT)/
84         cp $(DIR_SRC)/config/cfgroot/countries.pl               $(CONFIG_ROOT)/
85         cp $(DIR_SRC)/config/cfgroot/graphs.pl                  $(CONFIG_ROOT)/
86         cp $(DIR_SRC)/config/cfgroot/modem-lib.pl               $(CONFIG_ROOT)/
87         cp $(DIR_SRC)/config/cfgroot/advoptions-list            $(CONFIG_ROOT)/dhcp/advoptions-list
88         cp $(DIR_SRC)/config/cfgroot/connscheduler-lib.pl       $(CONFIG_ROOT)/connscheduler/lib.pl
89         cp $(DIR_SRC)/config/cfgroot/connscheduler.conf         $(CONFIG_ROOT)/connscheduler
90         cp $(DIR_SRC)/config/extrahd/*                          $(CONFIG_ROOT)/extrahd/bin/
91         cp $(DIR_SRC)/config/cfgroot/sensors-settings           $(CONFIG_ROOT)/sensors/settings
92         cp $(DIR_SRC)/config/menu/*                             $(CONFIG_ROOT)/menu.d/
93         cp $(DIR_SRC)/config/cfgroot/modem-defaults             $(CONFIG_ROOT)/modem/defaults
94         cp $(DIR_SRC)/config/cfgroot/modem-settings             $(CONFIG_ROOT)/modem/settings
95         cp $(DIR_SRC)/config/cfgroot/proxy-acl                  $(CONFIG_ROOT)/proxy/acl-1.4
96         cp $(DIR_SRC)/config/qos/*                                              $(CONFIG_ROOT)/qos/bin/
97         cp $(DIR_SRC)/config/cfgroot/main-settings              $(CONFIG_ROOT)/main/settings
98         cp $(DIR_SRC)/config/cfgroot/ssh-settings               $(CONFIG_ROOT)/remote/settings
99         cp $(DIR_SRC)/config/cfgroot/time-settings              $(CONFIG_ROOT)/time/settings
100         cp $(DIR_SRC)/config/cfgroot/logging-settings   $(CONFIG_ROOT)/logging/settings
101         cp $(DIR_SRC)/config/cfgroot/ethernet-vlans             $(CONFIG_ROOT)/ethernet/vlans
102         cp $(DIR_SRC)/langs/list                                                $(CONFIG_ROOT)/langs/
103         cp $(DIR_SRC)/config/firewall/convert-xtaccess  /usr/sbin/convert-xtaccess
104         cp $(DIR_SRC)/config/firewall/convert-outgoingfw        /usr/sbin/convert-outgoingfw
105         cp $(DIR_SRC)/config/firewall/convert-dmz       /usr/sbin/convert-dmz
106         cp $(DIR_SRC)/config/firewall/convert-portfw    /usr/sbin/convert-portfw
107         cp $(DIR_SRC)/config/firewall/p2protocols               $(CONFIG_ROOT)/firewall/p2protocols
108         cp $(DIR_SRC)/config/firewall/firewall-policy   /usr/sbin/firewall-policy
109         cp $(DIR_SRC)/config/fwhosts/icmp-types                 $(CONFIG_ROOT)/fwhosts/icmp-types
110         cp $(DIR_SRC)/config/fwhosts/customservices             $(CONFIG_ROOT)/fwhosts/customservices
111         cp $(DIR_SRC)/config/fwhosts/customservices             $(CONFIG_ROOT)/fwhosts/customservices.default
112         # Oneliner configfiles
113         echo  "ENABLED=off"             > $(CONFIG_ROOT)/vpn/settings
114         echo  "01"                      > $(CONFIG_ROOT)/certs/serial
115         echo  "nameserver    1.2.3.4"   > $(CONFIG_ROOT)/ppp/fake-resolv.conf
116         echo  "DROPNEWNOTSYN=on"                >> $(CONFIG_ROOT)/optionsfw/settings
117         echo  "DROPINPUT=on"            >> $(CONFIG_ROOT)/optionsfw/settings
118         echo  "DROPFORWARD=on"          >> $(CONFIG_ROOT)/optionsfw/settings
119         echo  "FWPOLICY=DROP"           >> $(CONFIG_ROOT)/optionsfw/settings
120         echo  "FWPOLICY1=DROP"          >> $(CONFIG_ROOT)/optionsfw/settings
121         echo  "FWPOLICY2=DROP"          >> $(CONFIG_ROOT)/optionsfw/settings
122         echo  "DROPPORTSCAN=on"         >> $(CONFIG_ROOT)/optionsfw/settings
123         echo  "DROPOUTGOING=on"         >> $(CONFIG_ROOT)/optionsfw/settings
124         echo  "DROPSAMBA=off"           >> $(CONFIG_ROOT)/optionsfw/settings
125         echo  "DROPPROXY=off"           >> $(CONFIG_ROOT)/optionsfw/settings
126         echo  "SHOWREMARK=on"           >> $(CONFIG_ROOT)/optionsfw/settings
127         echo  "SHOWCOLORS=on"           >> $(CONFIG_ROOT)/optionsfw/settings
128         echo  "SHOWTABLES=off"          >> $(CONFIG_ROOT)/optionsfw/settings
129         echo  "SHOWDROPDOWN=off"        >> $(CONFIG_ROOT)/optionsfw/settings
130         echo  "DROPWIRELESSINPUT=on"    >> $(CONFIG_ROOT)/optionsfw/settings
131         echo  "DROPWIRELESSFORWARD=on"  >> $(CONFIG_ROOT)/optionsfw/settings
132         echo  "POLICY=MODE2"            >> $(CONFIG_ROOT)/firewall/settings
133         echo  "POLICY1=MODE2"           >> $(CONFIG_ROOT)/firewall/settings
134
135         # Add conntrack helper default settings
136         for proto in FTP H323 IRC SIP TFTP; do \
137                 echo "CONNTRACK_$${proto}=on" >> $(CONFIG_ROOT)/optionsfw/settings; \
138         done
139
140         # Do not enable these by default because these are broken
141         for proto in AMANDA PPTP; do \
142                 echo "CONNTRACK_$${proto}=off" >> $(CONFIG_ROOT)/optionsfw/settings; \
143         done
144
145         # set converters executable
146         chmod 755 /usr/sbin/convert-*
147
148         # Modify variables in header.pl
149         sed -i -e "s+CONFIG_ROOT+$(CONFIG_ROOT)+g" \
150             -e "s+VERSION+$(VERSION)+g" \
151             $(CONFIG_ROOT)/header.pl
152
153         # Modify variables in general-functions.pl
154         sed -i -e "s+CONFIG_ROOT+$(CONFIG_ROOT)+g" \
155             -e "s+VERSION+$(VERSION)+g" \
156             $(CONFIG_ROOT)/general-functions.pl
157
158         # Modify CONFIG_ROOT in lang.pl
159         sed -i -e "s+CONFIG_ROOT+$(CONFIG_ROOT)+g" \
160             $(CONFIG_ROOT)/lang.pl
161
162         # Language files
163         cp $(DIR_SRC)/langs/*/cgi-bin/*.pl $(CONFIG_ROOT)/langs/
164
165         # Configroot permissions
166         chown -R nobody:nobody $(CONFIG_ROOT)
167         chown      root:root   $(CONFIG_ROOT)
168         for i in backup/ header.pl general-functions.pl graphs.pl lang.pl addon-lang/ langs/ red/ ; do \
169             chown -R root:root $(CONFIG_ROOT)/$$i; \
170         done
171         chown -Rv root:root $(CONFIG_ROOT)/*/bin
172         chown root:nobody $(CONFIG_ROOT)/dhcpc
173
174         @$(POSTBUILD)