Forward Firewall: added GPL header to all files
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-policy
1 #!/bin/sh
2
3 ###############################################################################
4 # #
5 # IPFire.org - A linux based firewall #
6 # Copyright (C) 2013 #
7 # #
8 # This program is free software: you can redistribute it and/or modify #
9 # it under the terms of the GNU General Public License as published by #
10 # the Free Software Foundation, either version 3 of the License, or #
11 # (at your option) any later version. #
12 # #
13 # This program is distributed in the hope that it will be useful, #
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
16 # GNU General Public License for more details. #
17 # #
18 # You should have received a copy of the GNU General Public License #
19 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 # #
21 ###############################################################################
22 # Author: Alexander Marx (amarx@ipfire.org) #
23 ###############################################################################
24
25
26 eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
27 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
28 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
29
30 iptables -F POLICYFWD
31 iptables -F POLICYOUT
32 iptables -F POLICYIN
33
34 if [ -f "/var/ipfire/red/iface" ]; then
35 IFACE=`cat /var/ipfire/red/iface`
36 fi
37
38 #FORWARDFW
39 if [ "$POLICY" == "MODE1" ]; then
40 if [ "$FWPOLICY" == "REJECT" ]; then
41 if [ "$DROPFORWARD" == "on" ]; then
42 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
43 fi
44 /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD"
45 fi
46 if [ "$FWPOLICY" == "DROP" ]; then
47 if [ "$DROPFORWARD" == "on" ]; then
48 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
49 fi
50 /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
51 fi
52 else
53 if [ "$BLUE_DEV" ] && [ "$IFACE" ]; then
54 /sbin/iptables -A POLICYFWD -i blue0 ! -o $IFACE -j DROP
55 fi
56 /sbin/iptables -A POLICYFWD -i orange0 ! -o $IFACE -j DROP
57 /sbin/iptables -A POLICYFWD -j ACCEPT
58 /sbin/iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP
59 fi
60
61 #OUTGOINGFW
62 if [ "$POLICY1" == "MODE1" ]; then
63 if [ "$FWPOLICY1" == "REJECT" ]; then
64 if [ "$DROPOUTGOING" == "on" ]; then
65 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
66 fi
67 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
68 fi
69 if [ "$FWPOLICY1" == "DROP" ]; then
70 if [ "$DROPOUTGOING" == "on" ]; then
71 /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
72 fi
73 /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
74 fi
75 else
76 /sbin/iptables -A POLICYOUT -j ACCEPT
77 /sbin/iptables -A POLICYOUT -m comment --comment "DROP_OUTPUT" -j DROP
78 fi
79 #INPUT
80 if [ "$FWPOLICY2" == "REJECT" ]; then
81 if [ "$DROPINPUT" == "on" ]; then
82 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
83 fi
84 /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
85 fi
86 if [ "$FWPOLICY2" == "DROP" ]; then
87 if [ "$DROPINPUT" == "on" ]; then
88 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
89 fi
90 /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT"
91 fi
92
93 exit 0