config/firewall/firewall-policy

   1 #!/bin/sh
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  23 eval $(/usr/local/bin/readhash /var/ipfire/firewall/settings)
  24 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
  25
  26 iptables -F POLICYFWD
  27 iptables -F POLICYOUT
  28 iptables -F POLICYIN
  29
  30 if [ -f "/var/ipfire/red/iface" ]; then
  31         IFACE="$(</var/ipfire/red/iface)"
  32 fi
  33
  34 # Figure out what devices are configured.
  35 HAVE_BLUE="false"
  36 HAVE_ORANGE="false"
  37
  38 case "${CONFIG_TYPE}" in
  39         2)
  40                 HAVE_BLUE="true"
  41                 ;;
  42         3)
  43                 HAVE_ORANGE="true"
  44                 ;;
  45         4)
  46                 HAVE_BLUE="true"
  47                 HAVE_ORANGE="true"
  48                 ;;
  49 esac
  50
  51 # INPUT
  52 case "${FWPOLICY2}" in
  53         REJECT)
  54                 if [ "${DROPINPUT}" = "on" ]; then
  55                         /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
  56                 fi
  57                 /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
  58                 ;;
  59         *) # DROP
  60                 if [ "${DROPINPUT}" = "on" ]; then
  61                         /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
  62                 fi
  63                 /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT"
  64                 ;;
  65 esac
  66
  67 # FORWARD
  68 case "${POLICY}" in
  69         MODE1)
  70                 case "${FWPOLICY}" in
  71                         REJECT)
  72                                 if [ "${DROPFORWARD}" = "on" ]; then
  73                                         /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
  74                                 fi
  75                                 /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD"
  76                                 ;;
  77                         *) # DROP
  78                                 if [ "${DROPFORWARD}" = "on" ]; then
  79                                         /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
  80                                 fi
  81                                 /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
  82                                 ;;
  83                 esac
  84                 ;;
  85
  86         *)
  87                 if [ -n "${IFACE}" ]; then
  88                         if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then
  89                                 /sbin/iptables -A POLICYFWD -i "${BLUE_DEV}" ! -o "${IFACE}" -j DROP
  90                         fi
  91                         if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then
  92                                 /sbin/iptables -A POLICYFWD -i "${ORANGE_DEV}" ! -o "${IFACE}" -j DROP
  93                         fi
  94                 fi
  95                 /sbin/iptables -A POLICYFWD -j ACCEPT
  96                 /sbin/iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP
  97                 ;;
  98 esac
  99
 100 # OUTGOING
 101 case "${POLICY1}" in
 102         MODE1)
 103                 case "${FWPOLICY1}" in
 104                         REJECT)
 105                                 if [ "${DROPOUTGOING}" = "on" ]; then
 106                                         /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
 107                                 fi
 108                                 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
 109                                 ;;
 110                         *) # DROP
 111                                 if [ "${DROPOUTGOING}" == "on" ]; then
 112                                         /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
 113                                 fi
 114                                 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
 115                                 ;;
 116                 esac
 117                 ;;
 118         *)
 119                 /sbin/iptables -A POLICYOUT -j ACCEPT
 120                 /sbin/iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP
 121                 ;;
 122 esac
 123
 124 exit 0