Added GRE and ESP protocoll to outgoing fw.
[people/pmueller/ipfire-2.x.git] / config / outgoingfw / outgoingfw.pl
CommitLineData
dba3aa2b 1#!/usr/bin/perl
70df8302
MT
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
39008af7 5# Copyright (C) 2009 Michael Tremer & Christian Schmidt #
70df8302
MT
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
21
ebb9187c
MT
22
23use strict;
24# enable only the following on debugging purpose
25#use warnings;
26
27require '/var/ipfire/general-functions.pl';
28
29my %outfwsettings = ();
30my %checked = ();
31my %selected= () ;
32my %netsettings = ();
33my $errormessage = "";
34my $configentry = "";
35my @configs = ();
36my @configline = ();
37my $p2pentry = "";
38my @p2ps = ();
39my @p2pline = ();
b4f8d26c 40my @proto = ();
ebb9187c 41my $CMD = "";
b4f8d26c
MT
42my $P2PSTRING = "";
43
ebb9187c
MT
44my $DEBUG = 0;
45
46my $configfile = "/var/ipfire/outgoing/rules";
47my $p2pfile = "/var/ipfire/outgoing/p2protocols";
48
ebb9187c
MT
49### Values that have to be initialized
50$outfwsettings{'ACTION'} = '';
51$outfwsettings{'VALID'} = 'yes';
52$outfwsettings{'EDIT'} = 'no';
53$outfwsettings{'NAME'} = '';
54$outfwsettings{'SNET'} = '';
55$outfwsettings{'SIP'} = '';
56$outfwsettings{'SPORT'} = '';
57$outfwsettings{'SMAC'} = '';
58$outfwsettings{'DIP'} = '';
59$outfwsettings{'DPORT'} = '';
60$outfwsettings{'PROT'} = '';
61$outfwsettings{'STATE'} = '';
62$outfwsettings{'DISPLAY_DIP'} = '';
63$outfwsettings{'DISPLAY_DPORT'} = '';
64$outfwsettings{'DISPLAY_SMAC'} = '';
65$outfwsettings{'DISPLAY_SIP'} = '';
66$outfwsettings{'POLICY'} = 'MODE0';
39008af7 67
ebb9187c
MT
68my $SOURCE = "";
69my $DESTINATION = "";
70my $PROTO = "";
71my $DPORT = "";
72my $DEV = "";
73my $MAC = "";
74my $POLICY = "";
75my $DO = "";
39008af7 76my $DAY = "";
ebb9187c
MT
77
78# read files
79&General::readhash("${General::swroot}/outgoing/settings", \%outfwsettings);
80&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
81
ed828642 82$netsettings{'RED_DEV'}=`cat /var/ipfire/red/iface`;
39008af7 83$netsettings{'RED_IP'}=`cat /var/ipfire/red/local-ipaddress`;
ed828642 84
ebb9187c
MT
85open( FILE, "< $configfile" ) or die "Unable to read $configfile";
86@configs = <FILE>;
87close FILE;
88
b4f8d26c 89if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
ebb9187c
MT
90 $outfwsettings{'STATE'} = "ALLOW";
91 $POLICY = "DROP";
4cb74dce 92 $DO = "ACCEPT";
ebb9187c
MT
93} elsif ( $outfwsettings{'POLICY'} eq 'MODE2' ) {
94 $outfwsettings{'STATE'} = "DENY";
95 $POLICY = "ACCEPT";
a332b303 96 $DO = "DROP -m comment --comment 'DROP_OUTGOINGFW'";
ebb9187c
MT
97}
98
99### Initialize IPTables
100system("/sbin/iptables --flush OUTGOINGFW >/dev/null 2>&1");
101system("/sbin/iptables --delete-chain OUTGOINGFW >/dev/null 2>&1");
102system("/sbin/iptables -N OUTGOINGFW >/dev/null 2>&1");
103
b4f8d26c
MT
104if ( $outfwsettings{'POLICY'} eq 'MODE0' ) {
105 exit 0
106}
107
108if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
4cb74dce 109 $CMD = "/sbin/iptables -A OUTGOINGFW -m state --state ESTABLISHED,RELATED -j ACCEPT";
b4f8d26c 110 if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); }
4cb74dce 111 $CMD = "/sbin/iptables -A OUTGOINGFW -p icmp -j ACCEPT";
b4f8d26c
MT
112 if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); }
113}
114
ebb9187c
MT
115foreach $configentry (sort @configs)
116{
117 $SOURCE = "";
118 $DESTINATION = "";
119 $PROTO = "";
120 $DPORT = "";
121 $DEV = "";
122 $MAC = "";
123 @configline = split( /\;/, $configentry );
124 if ($outfwsettings{'STATE'} eq $configline[0]) {
125 if ($configline[2] eq 'green') {
126 $SOURCE = "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
127 $DEV = $netsettings{'GREEN_DEV'};
39008af7
CS
128 } elsif ($configline[2] eq 'red') {
129 $SOURCE = "$netsettings{'RED_IP'}";
130 $DEV = "";
ebb9187c
MT
131 } elsif ($configline[2] eq 'blue') {
132 $SOURCE = "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
133 $DEV = $netsettings{'BLUE_DEV'};
134 } elsif ($configline[2] eq 'orange') {
135 $SOURCE = "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
136 $DEV = $netsettings{'ORANGE_DEV'};
137 } elsif ($configline[2] eq 'ip') {
138 $SOURCE = "$configline[5]";
139 $DEV = "";
140 } else {
141 $SOURCE = "0/0";
142 $DEV = "";
143 }
144
145 if ($configline[7]) { $DESTINATION = "$configline[7]"; } else { $DESTINATION = "0/0"; }
b4f8d26c
MT
146
147 if ($configline[3] eq 'tcp') {
148 @proto = ("tcp");
149 } elsif ($configline[3] eq 'udp') {
150 @proto = ("udp");
c791bb2a
CS
151 } elsif ($configline[3] eq 'esp') {
152 @proto = ("esp");
153 } elsif ($configline[3] eq 'gre') {
154 @proto = ("gre");
155 } elsif ($configline[3] eq 'tcp&udp') {
156 @proto = ("tcp","udp");
b4f8d26c 157 } else {
c791bb2a 158 @proto = ("all");
b4f8d26c
MT
159 }
160
161 foreach $PROTO (@proto) {
162 $CMD = "/sbin/iptables -A OUTGOINGFW -s $SOURCE -d $DESTINATION -p $PROTO";
163
ebb9187c
MT
164 if ($configline[8]) {
165 $DPORT = "$configline[8]";
166 $CMD = "$CMD --dport $DPORT";
167 }
b4f8d26c
MT
168
169 if ($DEV) {
170 $CMD = "$CMD -i $DEV";
171 }
172
173 if ($configline[6]) {
174 $MAC = "$configline[6]";
175 $CMD = "$CMD -m mac --mac-source $MAC";
176 }
4cb74dce 177
39008af7
CS
178 if ($configline[17] && $configline[18]) {
179 if ($configline[10]){$DAY = "Mon,"}
180 if ($configline[11]){$DAY .= "Tue,"}
181 if ($configline[12]){$DAY .= "Wed,"}
182 if ($configline[13]){$DAY .= "Thu,"}
183 if ($configline[14]){$DAY .= "Fri,"}
184 if ($configline[15]){$DAY .= "Sat,"}
185 if ($configline[16]){$DAY .= "Sun"}
186 $CMD = "$CMD -m time --timestart $configline[17] --timestop $configline[18] --weekdays $DAY";
187 }
188
b4f8d26c 189 $CMD = "$CMD -o $netsettings{'RED_DEV'}";
4cb74dce
MT
190
191 if ($configline[9] eq "aktiv") {
192 if ($DEBUG) {
52485124 193 print "$CMD -m limit --limit 10/minute -j LOG --log-prefix 'DROP_OUTGOINGFW'\n";
4cb74dce 194 } else {
52485124 195 system("$CMD -m limit --limit 10/minute -j LOG --log-prefix 'DROP_OUTGOINGFW'");
4cb74dce
MT
196 }
197 }
198
b4f8d26c
MT
199 if ($DEBUG) {
200 print "$CMD -j $DO\n";
201 } else {
202 system("$CMD -j $DO");
203 }
b4f8d26c
MT
204 }
205 }
206}
ebb9187c 207
b4f8d26c
MT
208### Do the P2P-Stuff here
209open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile";
210@p2ps = <FILE>;
211close FILE;
ebb9187c 212
b4f8d26c 213$CMD = "/sbin/iptables -A OUTGOINGFW -m ipp2p";
ebb9187c 214
b4f8d26c
MT
215foreach $p2pentry (sort @p2ps)
216{
217 @p2pline = split( /\;/, $p2pentry );
218 if ( $outfwsettings{'POLICY'} eq 'MODE2' ) {
219 $DO = "DROP";
220 if ("$p2pline[2]" eq "off") {
221 $P2PSTRING = "$P2PSTRING --$p2pline[1]";
222 }
223 } else {
4cb74dce 224 $DO = "ACCEPT";
b4f8d26c
MT
225 if ("$p2pline[2]" eq "on") {
226 $P2PSTRING = "$P2PSTRING --$p2pline[1]";
ebb9187c 227 }
b4f8d26c
MT
228 }
229}
230if ($P2PSTRING) {
231 if ($DEBUG) {
232 print "$CMD $P2PSTRING -j $DO\n";
233 } else {
234 system("$CMD $P2PSTRING -j $DO");
235 }
236}
ebb9187c 237
b4f8d26c 238if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
52802b5f 239 if ( $outfwsettings{'MODE1LOG'} eq 'on' ) {
52485124 240 $CMD = "/sbin/iptables -A OUTGOINGFW -o $netsettings{'RED_DEV'} -m limit --limit 10/minute -j LOG --log-prefix 'DROP_OUTGOINGFW'";
52802b5f
CS
241 if ($DEBUG) {
242 print "$CMD\n";
243 } else {
244 system("$CMD");
245 }
246 }
247
a332b303 248 $CMD = "/sbin/iptables -A OUTGOINGFW -o $netsettings{'RED_DEV'} -j DROP -m comment --comment 'DROP_OUTGOINGFW'";
b4f8d26c
MT
249 if ($DEBUG) {
250 print "$CMD\n";
251 } else {
252 system("$CMD");
ebb9187c 253 }
39008af7 254}