firewall: Move scripts from /var/ipfire/firewall/bin to /usr/lib/firewall.

[people/teissler/ipfire-2.x.git] / config / firewall / rules.pl

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 3b88d2308497a2bc8996ab7c7a76ee3823ad46c9..43807647cab91f24e06d7b3cb89d861481f254be 100755 (executable)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -45,7 +45,7 @@ my @DPROT=();
 my @p2ps=();
 require '/var/ipfire/general-functions.pl';
 require "${General::swroot}/lang.pl";
-require "${General::swroot}/firewall/bin/firewall-lib.pl";
+require "/usr/lib/firewall/firewall-lib.pl";
 
 my $configfwdfw                = "${General::swroot}/firewall/config";
 my $configinput            = "${General::swroot}/firewall/input";
@@ -252,16 +252,20 @@ sub buildrules
                                #print rules to console
                                foreach my $DPROT (@DPROT){
                                        $DPORT = &get_port($hash,$key,$DPROT);
+                                       if ($DPROT ne 'TCP' && $DPROT ne 'UDP' && $DPROT ne 'ICMP' ){
+                                               $DPORT='';
+                                       }
                                        $PROT=$DPROT;
                                        $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
                                        foreach my $a (sort keys %sourcehash){
                                                foreach my $b (sort keys %targethash){
+                                                       next if ($targethash{$b}[0] eq 'none');
+                                                       $STAG='';
                                                        if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
                                                                if($DPROT ne ''){
                                                                        if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
                                                                        #Process ICMP RULE
                                                                        if(substr($DPORT, 2, 4) eq 'icmp'){
-                                                                               print"uzlputz ICMP Regel\n";
                                                                                my @icmprule= split(",",substr($DPORT, 12,));
                                                                                foreach (@icmprule){
                                                                                        $icmptype="--icmp-type ";
@@ -334,8 +338,13 @@ sub buildrules
                                        $DPORT = &get_port($hash,$key,$DPROT);
                                        $PROT=$DPROT;
                                        $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
+                                       if ($DPROT ne 'TCP' && $DPROT ne'UDP' && $DPROT ne 'ICMP' ){
+                                               $DPORT='';
+                                       }
                                        foreach my $a (sort keys %sourcehash){
                                                foreach my $b (sort keys %targethash){
+                                                       next if ($targethash{$b}[0] eq 'none');
+                                                       $STAG='';
                                                        if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
                                                                if($DPROT ne ''){
                                                                        if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}