firewall: Add chain name to logged rules.

[people/teissler/ipfire-2.x.git] / config / firewall / rules.pl

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 2ce31c9a256d6ec3a0fc63da87cc23221a10cf37..4bb40a4f9c7b7f65a2b460bdea1d50117fe186ad 100755 (executable)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -33,7 +33,7 @@ my $IPTABLES = "iptables --wait";
 # iptables chains
 my $CHAIN_INPUT           = "INPUTFW";
 my $CHAIN_FORWARD         = "FORWARDFW";
-my $CHAIN_OUTPUT          = "OUTPUTFW";
+my $CHAIN_OUTPUT          = "OUTGOINGFW";
 my $CHAIN                 = $CHAIN_FORWARD;
 my $CHAIN_NAT_SOURCE      = "NAT_SOURCE";
 my $CHAIN_NAT_DESTINATION = "NAT_DESTINATION";
@@ -70,6 +70,8 @@ my $netsettings               = "${General::swroot}/ethernet/settings";
 &General::readhasharray($configgrp, \%customgrp);
 &General::get_aliases(\%aliases);
 
+my @log_limit_options = &make_log_limit_options();
+
 # MAIN
 &main();
 
@@ -121,11 +123,11 @@ sub print_rule {
 }
 
 sub flush {
-       run("$IPTABLES -F FORWARDFW");
-       run("$IPTABLES -F INPUTFW");
-       run("$IPTABLES -F OUTGOINGFW");
-       run("$IPTABLES -t nat -F NAT_DESTINATION");
-       run("$IPTABLES -t nat -F NAT_SOURCE");
+       run("$IPTABLES -F $CHAIN_INPUT");
+       run("$IPTABLES -F $CHAIN_FORWARD");
+       run("$IPTABLES -F $CHAIN_OUTPUT");
+       run("$IPTABLES -t nat -F $CHAIN_NAT_SOURCE");
+       run("$IPTABLES -t nat -F $CHAIN_NAT_DESTINATION");
        run("$IPTABLES -t mangle -F $CHAIN_MANGLE_NAT_DESTINATION_FIX");
 }
 
@@ -172,8 +174,6 @@ sub buildrules {
                # Collect all destinations.
                my @destinations = &get_addresses($hash, $key, "tgt");
 
-               my $time_constraints = "";
-
                # Check if logging should be enabled.
                my $LOG = ($$hash{$key}[17] eq 'ON');
 
@@ -303,27 +303,11 @@ sub buildrules {
 
                                                                if ($dnat_port) {
                                                                        $dnat_address .= ":$dnat_port";
-
-                                                                       # Replace --dport with the translated one.
-                                                                       my @new_nat_options = ();
-                                                                       my $skip_count = 0;
-                                                                       foreach my $option (@nat_options) {
-                                                                               next if ($skip_count-- > 0);
-
-                                                                               if ($option eq "--dport") {
-                                                                                       push(@new_nat_options, ("--dport", $dnat_port));
-                                                                                       $skip_count = 1;
-                                                                                       next;
-                                                                               }
-
-                                                                               push(@new_nat_options, $option);
-                                                                       }
-                                                                       @nat_options = @new_nat_options;
                                                                }
                                                        }
 
                                                        if ($LOG) {
-                                                               run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options -j LOG --log-prefix 'DNAT'");
+                                                               run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options @log_limit_options -j LOG --log-prefix 'DNAT '");
                                                        }
                                                        run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options -j DNAT --to-destination $dnat_address");
 
@@ -335,7 +319,7 @@ sub buildrules {
                                                        push(@nat_options, @destination_options);
 
                                                        if ($LOG) {
-                                                               run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j LOG --log-prefix 'SNAT'");
+                                                               run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @log_limit_options -j LOG --log-prefix 'SNAT '");
                                                        }
                                                        run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j SNAT --to-source $nat_address");
                                                }
@@ -346,7 +330,7 @@ sub buildrules {
 
                                        # Insert firewall rule.
                                        if ($LOG && !$NAT) {
-                                               run("$IPTABLES -A $chain @options -j LOG");
+                                               run("$IPTABLES -A $chain @options @log_limit_options -j LOG --log-prefix '$chain '");
                                        }
                                        run("$IPTABLES -A $chain @options -j $target");
                                }
@@ -688,11 +672,11 @@ sub get_protocol_options {
        if ($use_dst_ports) {
                my $dst_ports_mode = $$hash{$key}[14];
                my $dst_ports      = $$hash{$key}[15];
-               if ($use_dnat && $$hash{$key}[30]) {
-                       $dst_ports = $$hash{$key}[30];
-               }
 
                if (($dst_ports_mode eq "TGT_PORT") && $dst_ports) {
+                       if ($use_dnat && $$hash{$key}[30]) {
+                               $dst_ports = $$hash{$key}[30];
+                       }
                        push(@options, &format_ports($dst_ports, "dst"));
 
                } elsif ($dst_ports_mode eq "cust_srv") {
@@ -738,7 +722,9 @@ sub format_ports {
                push(@options, ("-m", "multiport"));
        }
 
-       push(@options, ($arg, $ports));
+       if ($ports) {
+               push(@options, ($arg, $ports));
+       }
 
        return @options;
 }
@@ -748,7 +734,12 @@ sub get_dnat_target_port {
        my $key  = shift;
 
        if ($$hash{$key}[14] eq "TGT_PORT") {
-               return $$hash{$key}[15];
+               my $port = $$hash{$key}[15];
+               my $external_port = $$hash{$key}[30];
+
+               if ($external_port && ($port ne $external_port)) {
+                       return $$hash{$key}[15];
+               }
        }
 }
 
@@ -775,3 +766,18 @@ sub add_dnat_mangle_rules {
                run("$IPTABLES -t mangle -A $CHAIN_MANGLE_NAT_DESTINATION_FIX @mangle_options");
        }
 }
+
+sub make_log_limit_options {
+       my @options = ("-m", "limit");
+
+       # Maybe we should get this from the configuration.
+       my $limit = 10;
+
+       # We limit log messages to $limit messages per minute.
+       push(@options, ("--limit", "$limit/min"));
+
+       # And we allow bursts of 2x $limit.
+       push(@options, ("--limit-burst", $limit * 2));
+
+       return @options;
+}