Forward Firewall: moved default rules from FORWARDFW to POLICYFWD
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-policy
CommitLineData
5d7faa45
AM
1#!/bin/sh
2
3eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
4eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
53f4c74d 5eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
5d7faa45
AM
6
7iptables -F POLICYFWD
8iptables -F POLICYOUT
d47bb8a1 9iptables -F POLICYIN
53f4c74d
AM
10
11if [ -f "/var/ipfire/red/iface" ]; then
12 IFACE=`cat /var/ipfire/red/iface`
13fi
5d7faa45 14
ef6f983b 15#FORWARDFW
5d7faa45
AM
16if [ "$POLICY" == "MODE1" ]; then
17 if [ "$FWPOLICY" == "REJECT" ]; then
18 if [ "$DROPFORWARD" == "on" ]; then
19 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
20 fi
93b75f31 21 /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD"
5d7faa45
AM
22 fi
23 if [ "$FWPOLICY" == "DROP" ]; then
24 if [ "$DROPFORWARD" == "on" ]; then
25 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
26 fi
27 /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
28 fi
93b75f31 29else
53f4c74d
AM
30 if [ "$BLUE_DEV" ] && [ "$IFACE" ]; then
31 /sbin/iptables -A POLICYFWD -i blue0 ! -o $IFACE -j DROP
32 fi
7f25a65f
AM
33 /sbin/iptables -A POLICYFWD -s "$ORANGE_NETADDRESS"/"$ORANGE_NETMASK" -d "$BLUE_NETADDRESS"/"$BLUE_NETMASK" -j DROP
34 /sbin/iptables -A POLICYFWD -s "$ORANGE_NETADDRESS"/"$ORANGE_NETMASK" -d "$GREEN_NETADDRESS"/"$GREEN_NETMASK" -j DROP
94ea1f03 35 /sbin/iptables -A POLICYFWD -j ACCEPT
aff15def 36 /sbin/iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP
5d7faa45 37fi
93b75f31 38
ef6f983b 39#OUTGOINGFW
5d7faa45 40if [ "$POLICY1" == "MODE1" ]; then
ef6f983b
AM
41 if [ "$FWPOLICY1" == "REJECT" ]; then
42 if [ "$DROPOUTGOING" == "on" ]; then
43 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
5d7faa45 44 fi
93b75f31 45 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
ef6f983b
AM
46 fi
47 if [ "$FWPOLICY1" == "DROP" ]; then
48 if [ "$DROPOUTGOING" == "on" ]; then
49 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
5d7faa45 50 fi
ef6f983b
AM
51 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
52 fi
93b75f31 53else
94ea1f03 54 /sbin/iptables -A POLICYOUT -j ACCEPT
aff15def 55 /sbin/iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP
5d7faa45 56fi
d47bb8a1
AM
57#INPUT
58if [ "$FWPOLICY2" == "REJECT" ]; then
59 if [ "$DROPINPUT" == "on" ]; then
60 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
61 fi
93b75f31 62 /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
d47bb8a1
AM
63fi
64if [ "$FWPOLICY2" == "DROP" ]; then
65 if [ "$DROPINPUT" == "on" ]; then
93b75f31 66 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
d47bb8a1 67 fi
93b75f31 68 /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT"
d47bb8a1 69fi
aff15def
AM
70
71exit 0