iptables: Replace state module by conntrack module.
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-policy
1 #!/bin/sh
2
3 eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
4 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
5 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
6
7 iptables -F POLICYFWD
8 iptables -F POLICYOUT
9 iptables -F POLICYIN
10
11 if [ -f "/var/ipfire/red/iface" ]; then
12 IFACE=`cat /var/ipfire/red/iface`
13 fi
14
15 #FORWARDFW
16 if [ "$POLICY" == "MODE1" ]; then
17 if [ "$FWPOLICY" == "REJECT" ]; then
18 if [ "$DROPFORWARD" == "on" ]; then
19 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
20 fi
21 /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD"
22 fi
23 if [ "$FWPOLICY" == "DROP" ]; then
24 if [ "$DROPFORWARD" == "on" ]; then
25 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
26 fi
27 /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
28 fi
29 else
30 if [ "$BLUE_DEV" ] && [ "$IFACE" ]; then
31 /sbin/iptables -A POLICYFWD -i blue0 ! -o $IFACE -j DROP
32 fi
33 /sbin/iptables -A POLICYFWD -i orange0 ! -o $IFACE -j DROP
34 /sbin/iptables -A POLICYFWD -j ACCEPT
35 /sbin/iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP
36 fi
37
38 #OUTGOINGFW
39 if [ "$POLICY1" == "MODE1" ]; then
40 if [ "$FWPOLICY1" == "REJECT" ]; then
41 if [ "$DROPOUTGOING" == "on" ]; then
42 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
43 fi
44 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
45 fi
46 if [ "$FWPOLICY1" == "DROP" ]; then
47 if [ "$DROPOUTGOING" == "on" ]; then
48 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
49 fi
50 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
51 fi
52 else
53 /sbin/iptables -A POLICYOUT -j ACCEPT
54 /sbin/iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP
55 fi
56 #INPUT
57 if [ "$FWPOLICY2" == "REJECT" ]; then
58 if [ "$DROPINPUT" == "on" ]; then
59 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
60 fi
61 /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
62 fi
63 if [ "$FWPOLICY2" == "DROP" ]; then
64 if [ "$DROPINPUT" == "on" ]; then
65 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
66 fi
67 /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT"
68 fi
69
70 exit 0