config/forwardfw/firewall-policy

   1 #!/bin/sh
   2
   3 eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
   4 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
   5
   6 iptables -F POLICYFWD
   7 iptables -F POLICYOUT
   8 iptables -F POLICYIN
   9
  10 #FORWARDFW
  11 if [ "$POLICY" == "MODE1" ]; then
  12                 if [ "$FWPOLICY" == "REJECT" ]; then
  13                         if [ "$DROPFORWARD" == "on" ]; then
  14                                 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
  15                         fi
  16                         /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
  17                 fi
  18                 if [ "$FWPOLICY" == "DROP" ]; then
  19                         if [ "$DROPFORWARD" == "on" ]; then
  20                                 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
  21                         fi
  22                         /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
  23                 fi
  24 fi
  25 #OUTGOINGFW
  26 if [ "$POLICY1" == "MODE1" ]; then
  27         if [ "$FWPOLICY1" == "REJECT" ]; then
  28                 if [ "$DROPOUTGOING" == "on" ]; then
  29                         /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
  30                 fi
  31                 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_OUTPUT"
  32         fi
  33         if [ "$FWPOLICY1" == "DROP" ]; then
  34                 if [ "$DROPOUTGOING" == "on" ]; then
  35                         /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
  36                 fi
  37                         /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
  38         fi
  39 fi
  40 #INPUT
  41 if [ "$FWPOLICY2" == "REJECT" ]; then
  42         if [ "$DROPINPUT" == "on" ]; then
  43                 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
  44         fi
  45         /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "REJECT_FORWARD"
  46 fi
  47 if [ "$FWPOLICY2" == "DROP" ]; then
  48         if [ "$DROPINPUT" == "on" ]; then
  49                 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
  50         fi
  51         /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_FORWARD"
  52 fi