src/initscripts/system/firewall

   1 #!/bin/sh
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /etc/sysconfig/rc
  23 . ${rc_functions}
  24
  25 eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
  28 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
  29 if [ -z $IFACE ]; then
  30         IFACE="red0"
  31 fi
  32
  33 if [ -f /var/ipfire/red/device ]; then
  34         DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
  35 fi
  36
  37 NAT_MASK="0x0f000000"
  38
  39 IPS_REPEAT_MARK="0x80000000"
  40 IPS_REPEAT_MASK="0x80000000"
  41 IPS_BYPASS_MARK="0x40000000"
  42 IPS_BYPASS_MASK="0x40000000"
  43
  44 IPSET_DB_DIR="/var/lib/location/ipset"
  45
  46 function iptables() {
  47         /sbin/iptables --wait "$@"
  48 }
  49
  50 iptables_init() {
  51         # Flush all rules and delete all custom chains
  52         iptables -F
  53         iptables -t nat -F
  54         iptables -t mangle -F
  55         iptables -t raw -F
  56         iptables -X
  57         iptables -t nat -X
  58         iptables -t mangle -X
  59         iptables -t raw -X
  60
  61         # Set up policies
  62         iptables -P INPUT DROP
  63         iptables -P FORWARD DROP
  64         iptables -P OUTPUT ACCEPT
  65
  66         # Enable TRACE logging to syslog
  67         modprobe nf_log_ipv4
  68         sysctl -q -w net.netfilter.nf_log.2=nf_log_ipv4
  69
  70         # IPS Bypass Chain which stores the BYPASS bit in connection tracking
  71         iptables -N IPSBYPASS
  72         iptables -A IPSBYPASS -j CONNMARK --save-mark --mask "$(( ~IPS_REPEAT_MASK & 0xffffffff ))"
  73
  74         # Jump into bypass chain when the BYPASS bit is set
  75         for chain in INPUT FORWARD OUTPUT; do
  76                 iptables -A "${chain}" -m mark \
  77                         --mark "$(( IPS_REPEAT_MARK | IPS_BYPASS_MARK ))/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j IPSBYPASS
  78         done
  79
  80         # Empty LOG_DROP and LOG_REJECT chains
  81         iptables -N LOG_DROP
  82         iptables -A LOG_DROP   -m limit --limit 10/second -j LOG
  83         iptables -A LOG_DROP   -j DROP
  84         iptables -N LOG_REJECT
  85         iptables -A LOG_REJECT -m limit --limit 10/second -j LOG
  86         iptables -A LOG_REJECT -j REJECT
  87
  88         # This chain will log, then DROPs packets with certain bad combinations
  89         # of flags might indicate a port-scan attempt (xmas, null, etc.)
  90         iptables -N PSCAN
  91         if [ "$DROPPORTSCAN" == "on" ]; then
  92                 iptables -A PSCAN -p tcp  -m limit --limit 10/second -j LOG --log-prefix "DROP_TCP Scan "  -m comment --comment "DROP_TCP PScan"
  93                 iptables -A PSCAN -p udp  -m limit --limit 10/second -j LOG --log-prefix "DROP_UDP Scan "  -m comment --comment "DROP_UDP PScan"
  94                 iptables -A PSCAN -p icmp -m limit --limit 10/second -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
  95                 iptables -A PSCAN -f      -m limit --limit 10/second -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
  96         fi
  97         iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
  98
  99         # New tcp packets without SYN set - could well be an obscure type of port scan
 100         # that's not covered above, may just be a broken Windows machine
 101         iptables -N NEWNOTSYN
 102         if [ "$DROPNEWNOTSYN" == "on" ]; then
 103                 iptables -A NEWNOTSYN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_NEWNOTSYN "
 104         fi
 105         iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 106
 107         # Log and subsequently drop spoofed packets or "martians", arriving from sources
 108         # on interfaces where we don't expect them
 109         iptables -N SPOOFED_MARTIAN
 110         if [ "$DROPSPOOFEDMARTIAN" == "on" ]; then
 111                 iptables -A SPOOFED_MARTIAN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_SPOOFED_MARTIAN "
 112         fi
 113         iptables -A SPOOFED_MARTIAN -j DROP -m comment --comment "DROP_SPOOFED_MARTIAN"
 114
 115         # Chain to contain all the rules relating to bad TCP flags
 116         iptables -N BADTCP
 117
 118         # Don't check loopback
 119         iptables -A BADTCP -i lo -j RETURN
 120
 121         # Disallow packets frequently used by port-scanners
 122         # NMAP FIN/URG/PSH (XMAS scan)
 123         iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN
 124         # SYN/RST/ACK/FIN/URG
 125         iptables -A BADTCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j PSCAN
 126         # ALL/ALL
 127         iptables -A BADTCP -p tcp --tcp-flags ALL ALL -j PSCAN
 128         # FIN Stealth
 129         iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
 130         # SYN/RST (also catches xmas variants that set SYN+RST+...)
 131         iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
 132         # SYN/FIN (QueSO or nmap OS probe)
 133         iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
 134         # Null
 135         iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
 136         # NEW TCP without SYN
 137         iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 138
 139         iptables -A INPUT   -p tcp -j BADTCP
 140         iptables -A FORWARD -p tcp -j BADTCP
 141
 142         # Connection tracking chains
 143         iptables -N CTINVALID
 144         if [ "$LOGDROPCTINVALID" == "on" ]; then
 145                 iptables -A CTINVALID  -m limit --limit 10/second -j LOG  --log-prefix "DROP_CTINVALID "
 146         fi
 147         iptables -A CTINVALID  -j DROP -m comment --comment "DROP_CTINVALID"
 148
 149         iptables -N CONNTRACK
 150         iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
 151         iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID
 152         iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 153
 154         # Restore any connection marks
 155         iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
 156
 157         # Fix for braindead ISPs
 158         iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 159
 160         # CUSTOM chains, can be used by the users themselves
 161         iptables -N CUSTOMINPUT
 162         iptables -A INPUT -j CUSTOMINPUT
 163         iptables -N CUSTOMFORWARD
 164         iptables -A FORWARD -j CUSTOMFORWARD
 165         iptables -N CUSTOMOUTPUT
 166         iptables -A OUTPUT -j CUSTOMOUTPUT
 167         iptables -t nat -N CUSTOMPREROUTING
 168         iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
 169         iptables -t nat -N CUSTOMPOSTROUTING
 170         iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
 171
 172         # IPS (Guardian) chains
 173         iptables -N GUARDIAN
 174         iptables -A INPUT -j GUARDIAN
 175         iptables -A FORWARD -j GUARDIAN
 176
 177         # Block non-established IPsec networks
 178         iptables -N IPSECBLOCK
 179         iptables -A FORWARD -m policy --dir out --pol none -j IPSECBLOCK
 180         iptables -A OUTPUT  -m policy --dir out --pol none -j IPSECBLOCK
 181
 182         # Block OpenVPN transfer networks
 183         iptables -N OVPNBLOCK
 184         iptables -A INPUT   -i tun+ -j OVPNBLOCK
 185         iptables -A FORWARD -i tun+ -j OVPNBLOCK
 186         iptables -A FORWARD -o tun+ -j OVPNBLOCK
 187
 188         # IPS (Suricata) chains
 189         iptables -N IPS_INPUT
 190         iptables -N IPS_FORWARD
 191         iptables -N IPS_OUTPUT
 192
 193         for chain in INPUT FORWARD OUTPUT; do
 194                 iptables -A "${chain}" -m mark --mark "0x0/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j "IPS_${chain}"
 195         done
 196
 197         # OpenVPN transfer network translation
 198         iptables -t nat -N OVPNNAT
 199         iptables -t nat -A POSTROUTING -j OVPNNAT
 200
 201         # IPTV chains for IGMPPROXY
 202         iptables -N IPTVINPUT
 203         iptables -A INPUT -j IPTVINPUT
 204         iptables -N IPTVFORWARD
 205         iptables -A FORWARD -j IPTVFORWARD
 206
 207         # Allow to ping the firewall.
 208         iptables -N ICMPINPUT
 209         iptables -A INPUT -j ICMPINPUT
 210         iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
 211
 212         # Accept everything on loopback
 213         iptables -N LOOPBACK
 214         iptables -A LOOPBACK -i lo -j ACCEPT
 215         iptables -A LOOPBACK -o lo -j ACCEPT
 216
 217         # Filter all packets with loopback addresses on non-loopback interfaces (spoofed)
 218         iptables -A LOOPBACK -s 127.0.0.0/8 -j SPOOFED_MARTIAN
 219         iptables -A LOOPBACK -d 127.0.0.0/8 -j SPOOFED_MARTIAN
 220
 221         for i in INPUT FORWARD OUTPUT; do
 222                 iptables -A ${i} -j LOOPBACK
 223         done
 224
 225         # Captive portal
 226         iptables -N CAPTIVE_PORTAL
 227         iptables -N CAPTIVE_PORTAL_CLIENTS
 228         for i in INPUT FORWARD; do
 229                 iptables -A ${i} -j CAPTIVE_PORTAL
 230         done
 231
 232         # Accept everything connected
 233         for i in INPUT FORWARD OUTPUT; do
 234                 iptables -A ${i} -j CONNTRACK
 235         done
 236
 237         # Allow DHCP
 238         iptables -N DHCPINPUT
 239         iptables -A DHCPINPUT -p udp --sport 68 --dport 67 -j ACCEPT
 240         iptables -A DHCPINPUT -p tcp --sport 68 --dport 67 -j ACCEPT
 241
 242         iptables -N DHCPOUTPUT
 243         iptables -A DHCPOUTPUT -p udp --sport 67 --dport 68 -j ACCEPT
 244         iptables -A DHCPOUTPUT -p tcp --sport 67 --dport 68 -j ACCEPT
 245
 246         # Allow DHCP on GREEN
 247         iptables -N DHCPGREENINPUT
 248         iptables -N DHCPGREENOUTPUT
 249         if [ -n "${GREEN_DEV}" ]; then
 250                 iptables -A INPUT  -i "${GREEN_DEV}" -j DHCPGREENINPUT
 251                 iptables -A OUTPUT -o "${GREEN_DEV}" -j DHCPGREENOUTPUT
 252         fi
 253
 254         # Allow DHCP on BLUE to be turned on/off
 255         iptables -N DHCPBLUEINPUT
 256         iptables -N DHCPBLUEOUTPUT
 257         if [ -n "${BLUE_DEV}" ]; then
 258                 iptables -A INPUT  -i "${BLUE_DEV}" -j DHCPBLUEINPUT
 259                 iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
 260         fi
 261
 262         # Chains for networks known as being hostile, posing a technical threat to our users
 263         # (i. e. listed at Spamhaus DROP et al.)
 264         iptables -N HOSTILE
 265         iptables -A INPUT -j HOSTILE
 266         iptables -A FORWARD -j HOSTILE
 267         iptables -A OUTPUT -j HOSTILE
 268
 269         iptables -N HOSTILE_DROP
 270         iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
 271         iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE"
 272
 273         # Tor (inbound)
 274         iptables -N TOR_INPUT
 275         iptables -A INPUT -j TOR_INPUT
 276
 277         # Location Block
 278         iptables -N LOCATIONBLOCK
 279         iptables -A INPUT -j LOCATIONBLOCK
 280         iptables -A FORWARD -j LOCATIONBLOCK
 281
 282         # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
 283         iptables -N IPSECINPUT
 284         iptables -N IPSECFORWARD
 285         iptables -N IPSECOUTPUT
 286         iptables -A INPUT -j IPSECINPUT
 287         iptables -A FORWARD -j IPSECFORWARD
 288         iptables -A OUTPUT -j IPSECOUTPUT
 289         iptables -t nat -N IPSECNAT
 290         iptables -t nat -A POSTROUTING -j IPSECNAT
 291
 292         # localhost and ethernet.
 293         # Always allow accessing the web GUI from GREEN.
 294         iptables -N GUIINPUT
 295         iptables -A INPUT -j GUIINPUT
 296         if [ -n "${GREEN_DEV}" ]; then
 297                 iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
 298         fi
 299
 300         # WIRELESS chains
 301         iptables -N WIRELESSINPUT
 302         iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
 303         iptables -N WIRELESSFORWARD
 304         iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
 305
 306         # OpenVPN
 307         iptables -N OVPNINPUT
 308         iptables -A INPUT -j OVPNINPUT
 309
 310         # Tor (outbound)
 311         iptables -N TOR_OUTPUT
 312         iptables -A OUTPUT -j TOR_OUTPUT
 313
 314         # Jump into the actual firewall ruleset.
 315         iptables -N INPUTFW
 316         iptables -A INPUT -j INPUTFW
 317
 318         iptables -N OUTGOINGFW
 319         iptables -A OUTPUT -j OUTGOINGFW
 320
 321         iptables -N FORWARDFW
 322         iptables -A FORWARD -j FORWARDFW
 323
 324         # SNAT rules
 325         iptables -t nat -N NAT_SOURCE
 326         iptables -t nat -A POSTROUTING -j NAT_SOURCE
 327
 328         # Captive Portal
 329         iptables -t nat -N CAPTIVE_PORTAL
 330         iptables -t nat -A PREROUTING -j CAPTIVE_PORTAL
 331
 332         # Custom prerouting chains (for transparent proxy)
 333         iptables -t nat -N SQUID
 334         iptables -t nat -A PREROUTING -j SQUID
 335
 336         # DNAT rules
 337         iptables -t nat -N NAT_DESTINATION
 338         iptables -t nat -A PREROUTING -j NAT_DESTINATION
 339         iptables -t nat -A OUTPUT -j NAT_DESTINATION
 340
 341         iptables -t mangle -N NAT_DESTINATION
 342         iptables -t mangle -A PREROUTING -j NAT_DESTINATION
 343
 344         iptables -t nat -N NAT_DESTINATION_FIX
 345         iptables -t nat -A POSTROUTING -j NAT_DESTINATION_FIX
 346
 347         if [ -n "${GREEN_ADDRESS}" ]; then
 348                 iptables -t nat -A NAT_DESTINATION_FIX \
 349                         -m mark --mark "0x01000000/${NAT_MASK}" -j SNAT --to-source "${GREEN_ADDRESS}"
 350         fi
 351
 352         if [ -n "${BLUE_ADDRESS}" ]; then
 353                 iptables -t nat -A NAT_DESTINATION_FIX \
 354                         -m mark --mark "0x02000000/${NAT_MASK}" -j SNAT --to-source "${BLUE_ADDRESS}"
 355         fi
 356
 357         if [ -n "${ORANGE_ADDRESS}" ]; then
 358                 iptables -t nat -A NAT_DESTINATION_FIX \
 359                         -m mark --mark "0x04000000/${NAT_MASK}" -j SNAT --to-source "${ORANGE_ADDRESS}"
 360         fi
 361
 362         # RED chain, used for the red interface
 363         iptables -N REDINPUT
 364         iptables -A INPUT -j REDINPUT
 365         iptables -N REDFORWARD
 366         iptables -A FORWARD -j REDFORWARD
 367         iptables -t nat -N REDNAT
 368         iptables -t nat -A POSTROUTING -j REDNAT
 369
 370         # Populate IPsec chains
 371         /usr/lib/firewall/ipsec-policy
 372
 373         # Apply OpenVPN firewall rules
 374         /usr/local/bin/openvpnctrl --firewall-rules
 375
 376         # run wirelessctrl
 377         /usr/local/bin/wirelessctrl
 378
 379         # run captivectrl
 380         /usr/local/bin/captivectrl
 381
 382         # POLICY CHAIN
 383         iptables -N POLICYIN
 384         iptables -A INPUT -j POLICYIN
 385         iptables -N POLICYFWD
 386         iptables -A FORWARD -j POLICYFWD
 387         iptables -N POLICYOUT
 388         iptables -A OUTPUT -j POLICYOUT
 389
 390         # Initialize firewall policies.
 391         /usr/sbin/firewall-policy
 392
 393         # Install firewall rules for the red interface.
 394         iptables_red_up
 395
 396         # If red has not been brought up yet, we will
 397         # add the blocking rules for MASQUERADE
 398         if [ ! -e "/var/ipfire/red/active" ]; then
 399                 iptables_red_down
 400         fi
 401 }
 402
 403 iptables_red_up() {
 404         iptables -F REDINPUT
 405         iptables -F REDFORWARD
 406         iptables -t nat -F REDNAT
 407
 408         # Prohibit spoofing our own IP address on RED
 409         if [ -f /var/ipfire/red/active ]; then
 410                 REDIP="$( cat /var/ipfire/red/local-ipaddress )";
 411
 412                 if [ "$IFACE" != "" ]; then
 413                         iptables -A REDINPUT -s $REDIP -i $IFACE -j SPOOFED_MARTIAN
 414                 elif [ "$DEVICE" != "" ]; then
 415                         iptables -A REDINPUT -s $REDIP -i $DEVICE -j SPOOFED_MARTIAN
 416                 fi
 417         fi
 418
 419         # PPPoE / PPTP Device
 420         if [ "$IFACE" != "" ]; then
 421                 # PPPoE / PPTP
 422                 if [ "$DEVICE" != "" ]; then
 423                         iptables -A REDINPUT -i $DEVICE -j ACCEPT
 424                 fi
 425                 if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
 426                         if [ "$RED_DEV" != "" ]; then
 427                                 iptables -A REDINPUT -i $RED_DEV -j ACCEPT
 428                         fi
 429                 fi
 430         fi
 431
 432         # PPTP over DHCP
 433         if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
 434                 iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 435                 iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 436         fi
 437
 438         if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
 439                 # DHCP
 440                 if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
 441                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 442                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 443                 fi
 444                 if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
 445                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 446                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 447                 fi
 448
 449                 # Outgoing masquerading (don't masqerade IPsec)
 450                 iptables -t nat -A REDNAT -m policy --pol ipsec --dir=out -o "${IFACE}" -j RETURN
 451
 452                 if [ "${IFACE}" = "${GREEN_DEV}" ]; then
 453                         iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN
 454                 fi
 455
 456                 local NO_MASQ_NETWORKS
 457
 458                 if [ "${MASQUERADE_GREEN}" = "off" ]; then
 459                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${GREEN_NETADDRESS}/${GREEN_NETMASK}"
 460                 fi
 461
 462                 if [ "${MASQUERADE_BLUE}" = "off" ]; then
 463                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${BLUE_NETADDRESS}/${BLUE_NETMASK}"
 464                 fi
 465
 466                 if [ "${MASQUERADE_ORANGE}" = "off" ]; then
 467                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${ORANGE_NETADDRESS}/${ORANGE_NETMASK}"
 468                 fi
 469
 470                 local network
 471                 for network in ${NO_MASQ_NETWORKS}; do
 472                         iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN
 473                 done
 474
 475                 # Masquerade everything else
 476                 iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
 477         fi
 478
 479         # Reload all rules.
 480         /usr/local/bin/firewallctrl
 481 }
 482
 483 iptables_red_down() {
 484         # Prohibit packets to reach the masquerading rule
 485         # while the WAN interface is down - this is required to
 486         # circumvent udp related NAT issues
 487         # http://forum.ipfire.org/index.php?topic=11127.0
 488         if [ -n "${IFACE}" ]; then
 489                 iptables -F REDFORWARD
 490                 iptables -A REDFORWARD -o "${IFACE}" -j DROP
 491         fi
 492
 493         # Reload all rules.
 494         /usr/local/bin/firewallctrl
 495 }
 496
 497 # See how we were called.
 498 case "$1" in
 499   start)
 500         boot_mesg "Setting up firewall"
 501         iptables_init
 502         evaluate_retval
 503         ;;
 504   reload|up)
 505         boot_mesg "Reloading firewall"
 506         iptables_red_up
 507         evaluate_retval
 508         ;;
 509   down)
 510         boot_mesg "Disabling firewall access to RED"
 511         iptables_red_down
 512         evaluate_retval
 513         ;;
 514   restart)
 515         $0 start
 516         ;;
 517   *)
 518         echo "Usage: $0 {start|reload|restart}"
 519         exit 1
 520         ;;
 521 esac
 522
 523 exit 0