src/initscripts/system/firewall

   1 #!/bin/sh
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 . /etc/sysconfig/rc
  23 . ${rc_functions}
  24
  25 eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
  26 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  27 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
  28 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
  29 if [ -z $IFACE ]; then
  30         IFACE="red0"
  31 fi
  32
  33 if [ -f /var/ipfire/red/device ]; then
  34         DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
  35 fi
  36
  37 NAT_MASK="0x0f000000"
  38
  39 IPS_REPEAT_MARK="0x80000000"
  40 IPS_REPEAT_MASK="0x80000000"
  41 IPS_BYPASS_MARK="0x40000000"
  42 IPS_BYPASS_MASK="0x40000000"
  43
  44 IPSET_DB_DIR="/var/lib/location/ipset"
  45
  46 function iptables() {
  47         /sbin/iptables --wait "$@"
  48 }
  49
  50 iptables_init() {
  51         # Flush all rules and delete all custom chains
  52         iptables -F
  53         iptables -t nat -F
  54         iptables -t mangle -F
  55         iptables -t raw -F
  56         iptables -X
  57         iptables -t nat -X
  58         iptables -t mangle -X
  59         iptables -t raw -X
  60
  61         # Set up policies
  62         iptables -P INPUT DROP
  63         iptables -P FORWARD DROP
  64         iptables -P OUTPUT ACCEPT
  65
  66         # Enable TRACE logging to syslog
  67         modprobe nf_log_ipv4
  68         sysctl -q -w net.netfilter.nf_log.2=nf_log_ipv4
  69
  70         # IPS Bypass Chain which stores the BYPASS bit in connection tracking
  71         iptables -N IPSBYPASS
  72         iptables -A IPSBYPASS -j CONNMARK --save-mark --mask "$(( ~IPS_REPEAT_MASK & 0xffffffff ))"
  73
  74         # Jump into bypass chain when the BYPASS bit is set
  75         for chain in INPUT FORWARD OUTPUT; do
  76                 iptables -A "${chain}" -m mark \
  77                         --mark "$(( IPS_REPEAT_MARK | IPS_BYPASS_MARK ))/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j IPSBYPASS
  78         done
  79
  80         # Empty LOG_DROP and LOG_REJECT chains
  81         iptables -N LOG_DROP
  82         iptables -A LOG_DROP   -m limit --limit 10/second -j LOG
  83         iptables -A LOG_DROP   -j DROP
  84         iptables -N LOG_REJECT
  85         iptables -A LOG_REJECT -m limit --limit 10/second -j LOG
  86         iptables -A LOG_REJECT -j REJECT
  87
  88         # This chain will log, then DROPs packets with certain bad combinations
  89         # of flags might indicate a port-scan attempt (xmas, null, etc.)
  90         iptables -N PSCAN
  91         if [ "$DROPPORTSCAN" == "on" ]; then
  92                 iptables -A PSCAN -p tcp  -m limit --limit 10/second -j LOG --log-prefix "DROP_TCP Scan "  -m comment --comment "DROP_TCP PScan"
  93                 iptables -A PSCAN -p udp  -m limit --limit 10/second -j LOG --log-prefix "DROP_UDP Scan "  -m comment --comment "DROP_UDP PScan"
  94                 iptables -A PSCAN -p icmp -m limit --limit 10/second -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
  95                 iptables -A PSCAN -f      -m limit --limit 10/second -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
  96         fi
  97         iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
  98
  99         # New tcp packets without SYN set - could well be an obscure type of port scan
 100         # that's not covered above, may just be a broken Windows machine
 101         iptables -N NEWNOTSYN
 102         if [ "$DROPNEWNOTSYN" == "on" ]; then
 103                 iptables -A NEWNOTSYN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_NEWNOTSYN "
 104         fi
 105         iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 106
 107         # Log and subsequently drop spoofed packets or "martians", arriving from sources
 108         # on interfaces where we don't expect them
 109         iptables -N SPOOFED_MARTIAN
 110         if [ "$DROPSPOOFEDMARTIAN" == "on" ]; then
 111                 iptables -A SPOOFED_MARTIAN  -m limit --limit 10/second -j LOG  --log-prefix "DROP_SPOOFED_MARTIAN "
 112         fi
 113         iptables -A SPOOFED_MARTIAN -j DROP -m comment --comment "DROP_SPOOFED_MARTIAN"
 114
 115         # Chain to contain all the rules relating to bad TCP flags
 116         iptables -N BADTCP
 117
 118         # Don't check loopback
 119         iptables -A BADTCP -i lo -j RETURN
 120
 121         # Disallow packets frequently used by port-scanners
 122         # NMAP FIN/URG/PSH (XMAS scan)
 123         iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN
 124         # SYN/RST/ACK/FIN/URG
 125         iptables -A BADTCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j PSCAN
 126         # ALL/ALL
 127         iptables -A BADTCP -p tcp --tcp-flags ALL ALL -j PSCAN
 128         # FIN Stealth
 129         iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
 130         # SYN/RST (also catches xmas variants that set SYN+RST+...)
 131         iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
 132         # SYN/FIN (QueSO or nmap OS probe)
 133         iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
 134         # Null
 135         iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
 136         # NEW TCP without SYN
 137         iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 138
 139         iptables -A INPUT   -p tcp -j BADTCP
 140         iptables -A FORWARD -p tcp -j BADTCP
 141
 142         # Connection tracking chains
 143         iptables -N CTINVALID
 144         if [ "$LOGDROPCTINVALID" == "on" ]; then
 145                 iptables -A CTINVALID  -m limit --limit 10/second -j LOG  --log-prefix "DROP_CTINVALID "
 146         fi
 147         iptables -A CTINVALID  -j DROP -m comment --comment "DROP_CTINVALID"
 148
 149         iptables -N CONNTRACK
 150         iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT
 151         iptables -A CONNTRACK -m conntrack --ctstate INVALID -j CTINVALID
 152         iptables -A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT
 153
 154         # Restore any connection marks
 155         iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
 156
 157         # Fix for braindead ISPs
 158         iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 159
 160         # CUSTOM chains, can be used by the users themselves
 161         iptables -N CUSTOMINPUT
 162         iptables -A INPUT -j CUSTOMINPUT
 163         iptables -N CUSTOMFORWARD
 164         iptables -A FORWARD -j CUSTOMFORWARD
 165         iptables -N CUSTOMOUTPUT
 166         iptables -A OUTPUT -j CUSTOMOUTPUT
 167         iptables -t nat -N CUSTOMPREROUTING
 168         iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
 169         iptables -t nat -N CUSTOMPOSTROUTING
 170         iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
 171
 172         # Chains for networks known as being hostile, posing a technical threat to our users
 173         # (i. e. listed at Spamhaus DROP et al.)
 174         iptables -N HOSTILE
 175         iptables -A INPUT -j HOSTILE
 176         iptables -A FORWARD -j HOSTILE
 177         iptables -A OUTPUT -j HOSTILE
 178
 179         iptables -N HOSTILE_DROP
 180         iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE "
 181         iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE"
 182
 183         # IP Address Blocklist chains
 184         iptables -N BLOCKLISTIN
 185         iptables -N BLOCKLISTOUT
 186         iptables -A INPUT ! -p icmp -j BLOCKLISTIN
 187         iptables -A FORWARD ! -p icmp -j BLOCKLISTIN
 188         iptables -A FORWARD ! -p icmp -j BLOCKLISTOUT
 189         iptables -A OUTPUT ! -p icmp -j BLOCKLISTOUT
 190
 191         # IPS (Guardian) chains
 192         iptables -N GUARDIAN
 193         iptables -A INPUT -j GUARDIAN
 194         iptables -A FORWARD -j GUARDIAN
 195
 196         # Block non-established IPsec networks
 197         iptables -N IPSECBLOCK
 198         iptables -A FORWARD -m policy --dir out --pol none -j IPSECBLOCK
 199         iptables -A OUTPUT  -m policy --dir out --pol none -j IPSECBLOCK
 200
 201         # Block OpenVPN transfer networks
 202         iptables -N OVPNBLOCK
 203         iptables -A INPUT   -i tun+ -j OVPNBLOCK
 204         iptables -A FORWARD -i tun+ -j OVPNBLOCK
 205         iptables -A FORWARD -o tun+ -j OVPNBLOCK
 206
 207         # IPS (Suricata) chains
 208         iptables -N IPS_INPUT
 209         iptables -N IPS_FORWARD
 210         iptables -N IPS_OUTPUT
 211
 212         for chain in INPUT FORWARD OUTPUT; do
 213                 iptables -A "${chain}" -m mark --mark "0x0/$(( IPS_REPEAT_MASK | IPS_BYPASS_MASK ))" -j "IPS_${chain}"
 214         done
 215
 216         # OpenVPN transfer network translation
 217         iptables -t nat -N OVPNNAT
 218         iptables -t nat -A POSTROUTING -j OVPNNAT
 219
 220         # IPTV chains for IGMPPROXY
 221         iptables -N IPTVINPUT
 222         iptables -A INPUT -j IPTVINPUT
 223         iptables -N IPTVFORWARD
 224         iptables -A FORWARD -j IPTVFORWARD
 225
 226         # Allow to ping the firewall.
 227         iptables -N ICMPINPUT
 228         iptables -A INPUT -j ICMPINPUT
 229         iptables -A ICMPINPUT -p icmp --icmp-type 8 -j ACCEPT
 230
 231         # Accept everything on loopback
 232         iptables -N LOOPBACK
 233         iptables -A LOOPBACK -i lo -j ACCEPT
 234         iptables -A LOOPBACK -o lo -j ACCEPT
 235
 236         # Filter all packets with loopback addresses on non-loopback interfaces (spoofed)
 237         iptables -A LOOPBACK -s 127.0.0.0/8 -j SPOOFED_MARTIAN
 238         iptables -A LOOPBACK -d 127.0.0.0/8 -j SPOOFED_MARTIAN
 239
 240         for i in INPUT FORWARD OUTPUT; do
 241                 iptables -A ${i} -j LOOPBACK
 242         done
 243
 244         # Captive portal
 245         iptables -N CAPTIVE_PORTAL
 246         iptables -N CAPTIVE_PORTAL_CLIENTS
 247         for i in INPUT FORWARD; do
 248                 iptables -A ${i} -j CAPTIVE_PORTAL
 249         done
 250
 251         # Accept everything connected
 252         for i in INPUT FORWARD OUTPUT; do
 253                 iptables -A ${i} -j CONNTRACK
 254         done
 255
 256         # Allow DHCP
 257         iptables -N DHCPINPUT
 258         iptables -A DHCPINPUT -p udp --sport 68 --dport 67 -j ACCEPT
 259         iptables -A DHCPINPUT -p tcp --sport 68 --dport 67 -j ACCEPT
 260
 261         iptables -N DHCPOUTPUT
 262         iptables -A DHCPOUTPUT -p udp --sport 67 --dport 68 -j ACCEPT
 263         iptables -A DHCPOUTPUT -p tcp --sport 67 --dport 68 -j ACCEPT
 264
 265         # Allow DHCP on GREEN
 266         iptables -N DHCPGREENINPUT
 267         iptables -N DHCPGREENOUTPUT
 268         if [ -n "${GREEN_DEV}" ]; then
 269                 iptables -A INPUT  -i "${GREEN_DEV}" -j DHCPGREENINPUT
 270                 iptables -A OUTPUT -o "${GREEN_DEV}" -j DHCPGREENOUTPUT
 271         fi
 272
 273         # Allow DHCP on BLUE to be turned on/off
 274         iptables -N DHCPBLUEINPUT
 275         iptables -N DHCPBLUEOUTPUT
 276         if [ -n "${BLUE_DEV}" ]; then
 277                 iptables -A INPUT  -i "${BLUE_DEV}" -j DHCPBLUEINPUT
 278                 iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
 279         fi
 280
 281         # Tor (inbound)
 282         iptables -N TOR_INPUT
 283         iptables -A INPUT -j TOR_INPUT
 284
 285         # Location Block
 286         iptables -N LOCATIONBLOCK
 287         iptables -A INPUT -j LOCATIONBLOCK
 288         iptables -A FORWARD -j LOCATIONBLOCK
 289
 290         # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
 291         iptables -N IPSECINPUT
 292         iptables -N IPSECFORWARD
 293         iptables -N IPSECOUTPUT
 294         iptables -A INPUT -j IPSECINPUT
 295         iptables -A FORWARD -j IPSECFORWARD
 296         iptables -A OUTPUT -j IPSECOUTPUT
 297         iptables -t nat -N IPSECNAT
 298         iptables -t nat -A POSTROUTING -j IPSECNAT
 299
 300         # localhost and ethernet.
 301         # Always allow accessing the web GUI from GREEN.
 302         iptables -N GUIINPUT
 303         iptables -A INPUT -j GUIINPUT
 304         if [ -n "${GREEN_DEV}" ]; then
 305                 iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
 306         fi
 307
 308         # WIRELESS chains
 309         iptables -N WIRELESSINPUT
 310         iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
 311         iptables -N WIRELESSFORWARD
 312         iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
 313
 314         # OpenVPN
 315         iptables -N OVPNINPUT
 316         iptables -A INPUT -j OVPNINPUT
 317
 318         # Tor (outbound)
 319         iptables -N TOR_OUTPUT
 320         iptables -A OUTPUT -j TOR_OUTPUT
 321
 322         # Jump into the actual firewall ruleset.
 323         iptables -N INPUTFW
 324         iptables -A INPUT -j INPUTFW
 325
 326         iptables -N OUTGOINGFW
 327         iptables -A OUTPUT -j OUTGOINGFW
 328
 329         iptables -N FORWARDFW
 330         iptables -A FORWARD -j FORWARDFW
 331
 332         # SNAT rules
 333         iptables -t nat -N NAT_SOURCE
 334         iptables -t nat -A POSTROUTING -j NAT_SOURCE
 335
 336         # Captive Portal
 337         iptables -t nat -N CAPTIVE_PORTAL
 338         iptables -t nat -A PREROUTING -j CAPTIVE_PORTAL
 339
 340         # Custom prerouting chains (for transparent proxy)
 341         iptables -t nat -N SQUID
 342         iptables -t nat -A PREROUTING -j SQUID
 343
 344         # DNAT rules
 345         iptables -t nat -N NAT_DESTINATION
 346         iptables -t nat -A PREROUTING -j NAT_DESTINATION
 347         iptables -t nat -A OUTPUT -j NAT_DESTINATION
 348
 349         iptables -t mangle -N NAT_DESTINATION
 350         iptables -t mangle -A PREROUTING -j NAT_DESTINATION
 351
 352         iptables -t nat -N NAT_DESTINATION_FIX
 353         iptables -t nat -A POSTROUTING -j NAT_DESTINATION_FIX
 354
 355         if [ -n "${GREEN_ADDRESS}" ]; then
 356                 iptables -t nat -A NAT_DESTINATION_FIX \
 357                         -m mark --mark "0x01000000/${NAT_MASK}" -j SNAT --to-source "${GREEN_ADDRESS}"
 358         fi
 359
 360         if [ -n "${BLUE_ADDRESS}" ]; then
 361                 iptables -t nat -A NAT_DESTINATION_FIX \
 362                         -m mark --mark "0x02000000/${NAT_MASK}" -j SNAT --to-source "${BLUE_ADDRESS}"
 363         fi
 364
 365         if [ -n "${ORANGE_ADDRESS}" ]; then
 366                 iptables -t nat -A NAT_DESTINATION_FIX \
 367                         -m mark --mark "0x04000000/${NAT_MASK}" -j SNAT --to-source "${ORANGE_ADDRESS}"
 368         fi
 369
 370         # RED chain, used for the red interface
 371         iptables -N REDINPUT
 372         iptables -A INPUT -j REDINPUT
 373         iptables -N REDFORWARD
 374         iptables -A FORWARD -j REDFORWARD
 375         iptables -t nat -N REDNAT
 376         iptables -t nat -A POSTROUTING -j REDNAT
 377
 378         # Populate IPsec chains
 379         /usr/lib/firewall/ipsec-policy
 380
 381         # Apply OpenVPN firewall rules
 382         /usr/local/bin/openvpnctrl --firewall-rules
 383
 384         # run wirelessctrl
 385         /usr/local/bin/wirelessctrl
 386
 387         # run captivectrl
 388         /usr/local/bin/captivectrl
 389
 390         # POLICY CHAIN
 391         iptables -N POLICYIN
 392         iptables -A INPUT -j POLICYIN
 393         iptables -N POLICYFWD
 394         iptables -A FORWARD -j POLICYFWD
 395         iptables -N POLICYOUT
 396         iptables -A OUTPUT -j POLICYOUT
 397
 398         # Initialize firewall policies.
 399         /usr/sbin/firewall-policy
 400
 401         # Install firewall rules for the red interface.
 402         iptables_red_up
 403
 404         # If red has not been brought up yet, we will
 405         # add the blocking rules for MASQUERADE
 406         if [ ! -e "/var/ipfire/red/active" ]; then
 407                 iptables_red_down
 408         fi
 409 }
 410
 411 iptables_red_up() {
 412         iptables -F REDINPUT
 413         iptables -F REDFORWARD
 414         iptables -t nat -F REDNAT
 415
 416         # Prohibit spoofing our own IP address on RED
 417         if [ -f /var/ipfire/red/active ]; then
 418                 REDIP="$( cat /var/ipfire/red/local-ipaddress )";
 419
 420                 if [ "$IFACE" != "" ]; then
 421                         iptables -A REDINPUT -s $REDIP -i $IFACE -j SPOOFED_MARTIAN
 422                 elif [ "$DEVICE" != "" ]; then
 423                         iptables -A REDINPUT -s $REDIP -i $DEVICE -j SPOOFED_MARTIAN
 424                 fi
 425         fi
 426
 427         # PPPoE / PPTP Device
 428         if [ "$IFACE" != "" ]; then
 429                 # PPPoE / PPTP
 430                 if [ "$DEVICE" != "" ]; then
 431                         iptables -A REDINPUT -i $DEVICE -j ACCEPT
 432                 fi
 433                 if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
 434                         if [ "$RED_DEV" != "" ]; then
 435                                 iptables -A REDINPUT -i $RED_DEV -j ACCEPT
 436                         fi
 437                 fi
 438         fi
 439
 440         # PPTP over DHCP
 441         if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
 442                 iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 443                 iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 444         fi
 445
 446         if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
 447                 # DHCP
 448                 if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
 449                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 450                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 451                 fi
 452                 if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
 453                         iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 454                         iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
 455                 fi
 456
 457                 # Outgoing masquerading (don't masqerade IPsec)
 458                 iptables -t nat -A REDNAT -m policy --pol ipsec --dir=out -o "${IFACE}" -j RETURN
 459
 460                 if [ "${IFACE}" = "${GREEN_DEV}" ]; then
 461                         iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN
 462                 fi
 463
 464                 local NO_MASQ_NETWORKS
 465
 466                 if [ "${MASQUERADE_GREEN}" = "off" ]; then
 467                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${GREEN_NETADDRESS}/${GREEN_NETMASK}"
 468                 fi
 469
 470                 if [ "${MASQUERADE_BLUE}" = "off" ]; then
 471                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${BLUE_NETADDRESS}/${BLUE_NETMASK}"
 472                 fi
 473
 474                 if [ "${MASQUERADE_ORANGE}" = "off" ]; then
 475                         NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${ORANGE_NETADDRESS}/${ORANGE_NETMASK}"
 476                 fi
 477
 478                 local network
 479                 for network in ${NO_MASQ_NETWORKS}; do
 480                         iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN
 481                 done
 482
 483                 # Masquerade everything else
 484                 iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
 485         fi
 486
 487         # Reload all rules.
 488         /usr/local/bin/firewallctrl
 489 }
 490
 491 iptables_red_down() {
 492         # Prohibit packets to reach the masquerading rule
 493         # while the WAN interface is down - this is required to
 494         # circumvent udp related NAT issues
 495         # http://forum.ipfire.org/index.php?topic=11127.0
 496         if [ -n "${IFACE}" ]; then
 497                 iptables -F REDFORWARD
 498                 iptables -A REDFORWARD -o "${IFACE}" -j DROP
 499         fi
 500
 501         # Reload all rules.
 502         /usr/local/bin/firewallctrl
 503 }
 504
 505 # See how we were called.
 506 case "$1" in
 507   start)
 508         boot_mesg "Setting up firewall"
 509         iptables_init
 510         evaluate_retval
 511         ;;
 512   reload|up)
 513         boot_mesg "Reloading firewall"
 514         iptables_red_up
 515         evaluate_retval
 516         ;;
 517   down)
 518         boot_mesg "Disabling firewall access to RED"
 519         iptables_red_down
 520         evaluate_retval
 521         ;;
 522   restart)
 523         $0 start
 524         ;;
 525   *)
 526         echo "Usage: $0 {start|reload|restart}"
 527         exit 1
 528         ;;
 529 esac
 530
 531 exit 0