Forward Firewall: removed --kerneltz from rules.pl. New function timeconvert in forwa...
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-policy
CommitLineData
5d7faa45
AM
1#!/bin/sh
2
3eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
4eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
5
6iptables -F POLICYFWD
7iptables -F POLICYOUT
d47bb8a1 8iptables -F POLICYIN
5d7faa45
AM
9
10if [ "$POLICY" == "MODE1" ]; then
11 if [ "$FWPOLICY" == "REJECT" ]; then
12 if [ "$DROPFORWARD" == "on" ]; then
13 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
14 fi
d47bb8a1 15 /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
5d7faa45
AM
16 fi
17 if [ "$FWPOLICY" == "DROP" ]; then
18 if [ "$DROPFORWARD" == "on" ]; then
19 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
20 fi
21 /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
22 fi
23fi
24if [ "$POLICY1" == "MODE1" ]; then
aa864783 25 /sbin/iptables -I OUTGOINGFW 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
5d7faa45
AM
26 if [ "$FWPOLICY1" == "REJECT" ]; then
27 if [ "$DROPOUTGOING" == "on" ]; then
28 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
29 fi
d47bb8a1 30 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_OUTPUT"
5d7faa45
AM
31 fi
32 if [ "$FWPOLICY1" == "DROP" ]; then
33 if [ "$DROPOUTGOING" == "on" ]; then
34 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
35 fi
36 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
37 fi
38fi
d47bb8a1
AM
39#INPUT
40if [ "$FWPOLICY2" == "REJECT" ]; then
41 if [ "$DROPINPUT" == "on" ]; then
42 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
43 fi
44 /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
45fi
46if [ "$FWPOLICY2" == "DROP" ]; then
47 if [ "$DROPINPUT" == "on" ]; then
48 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
49 fi
50 /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_FORWARD"
51fi