firewall: Use seperate firewall chains for passing traffic to the IPS

Create and use seperate iptables chain called IPS_INPUT, IPS_FORWARD and IPS_OUTPUT
to be more flexible which kind of traffic should be passed to suricata.

Reference #12062

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index be6c9169f36ff42c125e860b8d9be87c88663a4b..da89857d8b17b75dbeda6515745d5068d9869204 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -186,10 +186,12 @@ iptables_init() {
        iptables -A FORWARD -j GUARDIAN
 
        # IPS (suricata) chains
        iptables -A FORWARD -j GUARDIAN
 
        # IPS (suricata) chains

-       iptables -N IPS
-       iptables -A INPUT -j IPS
-       iptables -A FORWARD -j IPS
-       iptables -A OUTPUT -j IPS
+       iptables -N IPS_INPUT
+       iptables -N IPS_FORWARD
+       iptables -N IPS_OUTPUT
+       iptables -A INPUT -j IPS_INPUT
+       iptables -A FORWARD -j IPS_FORWARD
+       iptables -A OUTPUT -j IPS_OUTPUT

 
        # Block non-established IPsec networks
        iptables -N IPSECBLOCK
 
        # Block non-established IPsec networks
        iptables -N IPSECBLOCK