PATH=/usr/local/sbin:/usr/local/bin:/bin:/usr/bin:/sbin:/usr/sbin; export PATH
eval $(/usr/local/bin/readhash /var/ipfire/suricata/settings)
+eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
# Name of the firewall chain.
FW_CHAIN="IPS"
network_zones=( red green blue orange )
# Mark and Mask options.
-MARK="0x16"
-MASK="0x16"
+MARK="0x70000000"
+MASK="0x70000000"
# PID file of suricata.
PID_FILE="/var/run/suricata.pid"
# Check if the IDS is enabled for this network zone.
if [ "${!enable_ids_zone}" == "on" ]; then
- # Generate name of the network interface.
- network_device=$zone
- network_device+="0"
+ # Check if the current processed zone is "red" and the configured type is PPPoE dialin.
+ if [ "$zone" == "red" ] && [ "$RED_TYPE" == "PPPOE" ]; then
+ # Set device name to ppp0.
+ network_device="ppp0"
+ else
+ # Generate variable name which contains the device name.
+ zone_name="$zone_upper"
+ zone_name+="_DEV"
+
+ # Grab device name.
+ network_device=${!zone_name}
+ fi
# Assign NFQ_OPTS
NFQ_OPTIONS=$NFQ_OPTS
# Check if there are multiple cpu cores available.
if [ "$cpu_count" -gt "1" ]; then
# Balance beetween all queues.
- NFQ_OPTIONS+="--queue-balance 0:"
- NFQ_OPTIONS+=$(($cpu_count-1))
+ NFQ_OPTIONS+="--queue-balance 0:$(($cpu_count-1))"
+ NFQ_OPTIONS+=" --queue-cpu-fanout"
else
# Send all packets to queue 0.
NFQ_OPTIONS+="--queue-num 0"
iptables -I "$FW_CHAIN" -o "$network_device" -m mark ! --mark "$MARK"/"$MASK" -j NFQUEUE $NFQ_OPTIONS
fi
done
+
+ # Clear repeat bit, so that it does not confuse IPsec or QoS
+ iptables -A "${FW_CHAIN}" -j MARK --set-xmark "0x0/${MASK}"
}
# Function to flush the firewall chain.
# Numer of NFQUES.
NFQUEUES=
- for i in $(seq 0 $cpu_count); do
+ for i in $(seq 0 $((cpu_count-1)) ); do
NFQUEUES+="-q $i "
done