IPsec: Rename ipsec-block script to ipsec-policy

[ipfire-2.x.git] / src / initscripts / system / firewall

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 7bdb292f7ddb8a2160377a45180fe58de40b93dc..1ffeda993bbd3ee82235c599ddef3bc7089dbe45 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -224,6 +224,13 @@ iptables_init() {
                iptables -A ${i} -j LOOPBACK
        done
 
+       # Captive portal
+       iptables -N CAPTIVE_PORTAL
+       iptables -N CAPTIVE_PORTAL_CLIENTS
+       for i in INPUT FORWARD; do
+               iptables -A ${i} -j CAPTIVE_PORTAL
+       done
+
        # Accept everything connected
        for i in INPUT FORWARD OUTPUT; do
                iptables -A ${i} -j CONNTRACK
@@ -273,7 +280,9 @@ iptables_init() {
        # Always allow accessing the web GUI from GREEN.
        iptables -N GUIINPUT
        iptables -A INPUT -j GUIINPUT
-       iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
+       if [ -n "${GREEN_DEV}" ]; then
+               iptables -A GUIINPUT -i "${GREEN_DEV}" -p tcp --dport 444 -j ACCEPT
+       fi
 
        # WIRELESS chains
        iptables -N WIRELESSINPUT
@@ -303,6 +312,10 @@ iptables_init() {
        iptables -t nat -N NAT_SOURCE
        iptables -t nat -A POSTROUTING -j NAT_SOURCE
 
+       # Captive Portal
+       iptables -t nat -N CAPTIVE_PORTAL
+       iptables -t nat -A PREROUTING -j CAPTIVE_PORTAL
+
        # Custom prerouting chains (for transparent proxy)
        iptables -t nat -N SQUID
        iptables -t nat -A PREROUTING -j SQUID
@@ -318,8 +331,10 @@ iptables_init() {
        iptables -t nat -N NAT_DESTINATION_FIX
        iptables -t nat -A POSTROUTING -j NAT_DESTINATION_FIX
 
-       iptables -t nat -A NAT_DESTINATION_FIX \
-               -m mark --mark 1 -j SNAT --to-source "${GREEN_ADDRESS}"
+       if [ -n "${GREEN_ADDRESS}" ]; then
+               iptables -t nat -A NAT_DESTINATION_FIX \
+                       -m mark --mark 1 -j SNAT --to-source "${GREEN_ADDRESS}"
+       fi
 
        if [ -n "${BLUE_ADDRESS}" ]; then
                iptables -t nat -A NAT_DESTINATION_FIX \
@@ -345,8 +360,8 @@ iptables_init() {
        iptables -t nat -N REDNAT
        iptables -t nat -A POSTROUTING -j REDNAT
 
-       # Populate IPsec block chain
-       /usr/lib/firewall/ipsec-block
+       # Populate IPsec chains
+       /usr/lib/firewall/ipsec-policy
 
        # Apply OpenVPN firewall rules
        /usr/local/bin/openvpnctrl --firewall-rules