Forward Firewall: Firewall Hits graph now with stacked values
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-policy
CommitLineData
5d7faa45
AM
1#!/bin/sh
2
3eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
4eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
5
6iptables -F POLICYFWD
7iptables -F POLICYOUT
d47bb8a1 8iptables -F POLICYIN
fb61ec67 9IFACE=`cat /var/ipfire/red/iface`
5d7faa45 10
ef6f983b 11#FORWARDFW
5d7faa45
AM
12if [ "$POLICY" == "MODE1" ]; then
13 if [ "$FWPOLICY" == "REJECT" ]; then
14 if [ "$DROPFORWARD" == "on" ]; then
15 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
16 fi
93b75f31 17 /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD"
5d7faa45
AM
18 fi
19 if [ "$FWPOLICY" == "DROP" ]; then
20 if [ "$DROPFORWARD" == "on" ]; then
21 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
22 fi
23 /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
24 fi
93b75f31 25else
94ea1f03
AM
26 /sbin/iptables -A POLICYFWD -i blue0 ! -o $IFACE -j DROP
27 /sbin/iptables -A POLICYFWD -j ACCEPT
5d7faa45 28fi
93b75f31 29
ef6f983b 30#OUTGOINGFW
5d7faa45 31if [ "$POLICY1" == "MODE1" ]; then
ef6f983b
AM
32 if [ "$FWPOLICY1" == "REJECT" ]; then
33 if [ "$DROPOUTGOING" == "on" ]; then
34 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
5d7faa45 35 fi
93b75f31 36 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
ef6f983b
AM
37 fi
38 if [ "$FWPOLICY1" == "DROP" ]; then
39 if [ "$DROPOUTGOING" == "on" ]; then
40 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
5d7faa45 41 fi
ef6f983b
AM
42 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
43 fi
93b75f31 44else
94ea1f03 45 /sbin/iptables -A POLICYOUT -j ACCEPT
5d7faa45 46fi
d47bb8a1
AM
47#INPUT
48if [ "$FWPOLICY2" == "REJECT" ]; then
49 if [ "$DROPINPUT" == "on" ]; then
50 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
51 fi
93b75f31 52 /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
d47bb8a1
AM
53fi
54if [ "$FWPOLICY2" == "DROP" ]; then
55 if [ "$DROPINPUT" == "on" ]; then
93b75f31 56 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
d47bb8a1 57 fi
93b75f31 58 /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT"
d47bb8a1 59fi