Forward Firewall: deleted portfw from buildsystem
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-policy
CommitLineData
5d7faa45
AM
1#!/bin/sh
2
3eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
4eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
5
6iptables -F POLICYFWD
7iptables -F POLICYOUT
d47bb8a1 8iptables -F POLICYIN
5d7faa45 9
ef6f983b 10#FORWARDFW
5d7faa45
AM
11if [ "$POLICY" == "MODE1" ]; then
12 if [ "$FWPOLICY" == "REJECT" ]; then
13 if [ "$DROPFORWARD" == "on" ]; then
14 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
15 fi
d47bb8a1 16 /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
5d7faa45
AM
17 fi
18 if [ "$FWPOLICY" == "DROP" ]; then
19 if [ "$DROPFORWARD" == "on" ]; then
20 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
21 fi
22 /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
23 fi
24fi
ef6f983b 25#OUTGOINGFW
5d7faa45 26if [ "$POLICY1" == "MODE1" ]; then
ef6f983b
AM
27 if [ "$FWPOLICY1" == "REJECT" ]; then
28 if [ "$DROPOUTGOING" == "on" ]; then
29 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
5d7faa45 30 fi
ef6f983b
AM
31 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_OUTPUT"
32 fi
33 if [ "$FWPOLICY1" == "DROP" ]; then
34 if [ "$DROPOUTGOING" == "on" ]; then
35 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
5d7faa45 36 fi
ef6f983b
AM
37 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
38 fi
5d7faa45 39fi
d47bb8a1
AM
40#INPUT
41if [ "$FWPOLICY2" == "REJECT" ]; then
42 if [ "$DROPINPUT" == "on" ]; then
43 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
44 fi
45 /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
46fi
47if [ "$FWPOLICY2" == "DROP" ]; then
48 if [ "$DROPINPUT" == "on" ]; then
49 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
50 fi
51 /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_FORWARD"
52fi