config/forwardfw/firewall-policy

   1 #!/bin/sh
   2
   3 eval $(/usr/local/bin/readhash /var/ipfire/forward/settings)
   4 eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
   5
   6 iptables -F POLICYFWD
   7 iptables -F POLICYOUT
   8 iptables -F POLICYIN
   9 IFACE=`cat /var/ipfire/red/iface`
  10
  11 #FORWARDFW
  12 if [ "$POLICY" == "MODE1" ]; then
  13                 if [ "$FWPOLICY" == "REJECT" ]; then
  14                         if [ "$DROPFORWARD" == "on" ]; then
  15                                 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "REJECT_FORWARD"
  16                         fi
  17                         /sbin/iptables -A POLICYFWD -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_FORWARD"
  18                 fi
  19                 if [ "$FWPOLICY" == "DROP" ]; then
  20                         if [ "$DROPFORWARD" == "on" ]; then
  21                                 /sbin/iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
  22                         fi
  23                         /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
  24                 fi
  25 else
  26         /sbin/iptables -A POLICYFWD -i blue0 ! -o $IFACE -j DROP -m comment --comment "DROP_FORWARD_BLUE"
  27         /sbin/iptables -A POLICYFWD -j ACCEPT -m comment --comment "DROP_FORWARD"
  28 fi
  29
  30 #OUTGOINGFW
  31 if [ "$POLICY1" == "MODE1" ]; then
  32         if [ "$FWPOLICY1" == "REJECT" ]; then
  33                 if [ "$DROPOUTGOING" == "on" ]; then
  34                         /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "REJECT_OUTPUT"
  35                 fi
  36                 /sbin/iptables -A POLICYOUT -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_OUTPUT"
  37         fi
  38         if [ "$FWPOLICY1" == "DROP" ]; then
  39                 if [ "$DROPOUTGOING" == "on" ]; then
  40                         /sbin/iptables -A POLICYOUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT"
  41                 fi
  42                         /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
  43         fi
  44 else
  45         /sbin/iptables -A POLICYOUT -j ACCEPT -m comment --comment "DROP_OUTPUT"
  46 fi
  47 #INPUT
  48 if [ "$FWPOLICY2" == "REJECT" ]; then
  49         if [ "$DROPINPUT" == "on" ]; then
  50                 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "REJECT_INPUT"
  51         fi
  52         /sbin/iptables -A POLICYIN -j REJECT --reject-with icmp-host-unreachable -m comment --comment "DROP_INPUT"
  53 fi
  54 if [ "$FWPOLICY2" == "DROP" ]; then
  55         if [ "$DROPINPUT" == "on" ]; then
  56                 /sbin/iptables -A POLICYIN -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
  57         fi
  58         /sbin/iptables -A POLICYIN -j DROP -m comment --comment "DROP_INPUT"
  59 fi