config/forwardfw/firewall-policy

   1 #!/bin/sh
   2
   3 eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
   4 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
   5
   6 iptables -F POLICYFWD
   7 iptables -F POLICYOUT
   8 iptables -F POLICYIN
   9
  10 if [ "$POLICY" == "MODE1" ]; then
  11                 if [ "$FWPOLICY" == "REJECT" ]; then
  12                         if [ "$DROPFORWARD" == "on" ]; then
  13                                 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
  14                         fi
  15                         /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
  16                 fi
  17                 if [ "$FWPOLICY" == "DROP" ]; then
  18                         if [ "$DROPFORWARD" == "on" ]; then
  19                                 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
  20                         fi
  21                         /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
  22                 fi
  23 fi
  24 if [ "$POLICY1" == "MODE1" ]; then
  25         /sbin/iptables -I OUTGOINGFW 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
  26                 if [ "$FWPOLICY1" == "REJECT" ]; then
  27                         if [ "$DROPOUTGOING" == "on" ]; then
  28                                 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
  29                         fi
  30                                 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_OUTPUT"
  31                 fi
  32                 if [ "$FWPOLICY1" == "DROP" ]; then
  33                         if [ "$DROPOUTGOING" == "on" ]; then
  34                                 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
  35                         fi
  36                                 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
  37                 fi
  38 fi
  39 #INPUT
  40 if [ "$FWPOLICY2" == "REJECT" ]; then
  41         if [ "$DROPINPUT" == "on" ]; then
  42                 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
  43         fi
  44         /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
  45 fi
  46 if [ "$FWPOLICY2" == "DROP" ]; then
  47         if [ "$DROPINPUT" == "on" ]; then
  48                 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
  49         fi
  50         /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_FORWARD"
  51 fi