Firewall: fixed rules.pl (no INPUT rules where created when using port and prot ...

[people/teissler/ipfire-2.x.git] / config / forwardfw / rules.pl

diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl
index 82b5dd61e5d3ad0249adcfd0dbc9ad9b9b0c7b2b..ba2ac037369ad1e1ba1ed9376b08932cf15caec6 100755 (executable)
--- a/config/forwardfw/rules.pl
+++ b/config/forwardfw/rules.pl
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2012                                                                                                             #
+# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -18,11 +18,6 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
 #                                                                             #
 ###############################################################################
-#                                                                                                                                                        #
-# Hi folks! I hope this code is useful for all. I needed something to handle  #
-# my VPN Connections in a comfortable way.                                                               #
-# This script builds firewallrules from the webinterface                      #
-###############################################################################
 
 use strict;
 use Time::Local;
@@ -89,7 +84,7 @@ close(CONN1);
 ################################
 #    DEBUG/TEST                #
 ################################
-my $MODE=1;     # 0 - normal operation
+my $MODE=0;     # 0 - normal operation
                                # 1 - print configline and rules to console     
                                # 
 ################################               
@@ -115,7 +110,7 @@ if($param eq 'flush'){
                        system ("/usr/sbin/firewall-policy"); 
                }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
                        &p2pblock;
-                       system ("iptables -A $CHAIN -m state --state NEW -j ACCEPT");
+                       system ("iptables -A $CHAIN -m conntrack --ctstate NEW -j ACCEPT");
                        system ("/usr/sbin/firewall-policy");
                        system ("/etc/sysconfig/firewall.local reload");
                }
@@ -151,8 +146,10 @@ sub buildrules
        my $nat;
        my $fwaccessdport;
        my $natchain;
+       my $icmptype;
        foreach my $key (sort {$a <=> $b} keys %$hash){
                next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' );
+               $command="iptables -A";
                if ($$hash{$key}[28] eq 'ON'){
                        $command='iptables -t nat -A';
                        $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]);
@@ -265,10 +262,15 @@ sub buildrules
                                                                        if(substr($DPORT, 2, 4) eq 'icmp'){
                                                                                my @icmprule= split(",",substr($DPORT, 12,));
                                                                                foreach (@icmprule){
+                                                                                       $icmptype="--icmp-type ";
+                                                                                       if ($_ eq "BLANK") {
+                                                                                                       $icmptype="";
+                                                                                                       $_="";
+                                                                                       }
                                                                                        if ($$hash{$key}[17] eq 'ON'){
-                                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j LOG\n";
+                                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j LOG\n";
                                                                                        }
-                                                                                       print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]\n";
+                                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j $$hash{$key}[0]\n";
                                                                                }
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){
                                                                                $natchain='NAT_DESTINATION';
@@ -294,10 +296,12 @@ sub buildrules
                                                                                $natchain='NAT_SOURCE';
                                                                                print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
                                                                        }
-                                                                       if ($$hash{$key}[17] eq 'ON'){
+                                                                       if ($$hash{$key}[17] eq 'ON' ){
                                                                                        print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
                                                                        }
-                                                                       print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       if ($PROT ne '-p ICMP'){
+                                                                               print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       }
                                                                }                               
                                                        }
                                                }
@@ -314,14 +318,21 @@ sub buildrules
                                                        if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
                                                                if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){
                                                                        if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
+                                                                       #Process ICMP RULE
                                                                        if(substr($DPORT, 2, 4) eq 'icmp'){
                                                                                my @icmprule= split(",",substr($DPORT, 12,));
                                                                                foreach (@icmprule){
+                                                                                       $icmptype="--icmp-type ";
+                                                                                       if ($_ eq "BLANK") {
+                                                                                                       $icmptype="";
+                                                                                                       $_="";
+                                                                                       }
                                                                                        if ($$hash{$key}[17] eq 'ON'){
-                                                                                               system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] -- icmp-type $_ $TIME -j LOG");
+                                                                                               system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j LOG");
                                                                                        }
-                                                                                       system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]");
+                                                                                               system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j $$hash{$key}[0]");
                                                                                }
+                                                                       #PROCESS DNAT RULE (Portforward)
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){
                                                                                $natchain='NAT_DESTINATION';
                                                                                if ($$hash{$key}[17] eq 'ON'){
@@ -342,14 +353,18 @@ sub buildrules
                                                                                }
                                                                                system "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
                                                                                next;
+                                                                       #PROCESS SNAT RULE
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
                                                                                $natchain='NAT_SOURCE';
                                                                                system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
                                                                        }
-                                                                       if ($$hash{$key}[17] eq 'ON'){
+                                                                       if ($$hash{$key}[17] eq 'ON' && substr($DPORT, 2, 4) ne 'icmp'){
                                                                                system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
                                                                        }
-                                                                       system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       #PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double)
+                                                                       if ($PROT ne '-p ICMP'){
+                                                                               system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       }
                                                                }                               
                                                        }
                                                }
@@ -523,12 +538,14 @@ sub get_prot
                }
        }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
                if ($$hash{$key}[14] eq 'TGT_PORT'){
-                       if ($$hash{$key}[15] ne ''){
-                               return "$$hash{$key}[12]";
+                       if ($$hash{$key}[15] ne '' && $$hash{$key}[8] eq ''){
+                               return "TCP,UDP";
                        }elsif($$hash{$key}[13] ne ''){
-                               return "$$hash{$key}[12]";
+                               return "$$hash{$key}[8]";
+                       }elsif($$hash{$key}[15] ne ''){
+                               return "$$hash{$key}[8]";
                        }else{
-                               return "$$hash{$key}[12]";
+                               return "$$hash{$key}[8]";
                        }
                }elsif($$hash{$key}[14] eq 'cust_srv'){
                        return &fwlib::get_srv_prot($$hash{$key}[15]);
@@ -539,7 +556,7 @@ sub get_prot
        }
        #DNAT
        if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){
-               return "$$hash{$key}[12]";
+               return "$$hash{$key}[8]";
        }
 }
 sub get_port
@@ -575,7 +592,7 @@ sub get_port
                                                return "--dport $$hash{$key}[15] ";
                                         }else{
                                                 $$hash{$key}[15] =~ s/\:/-/g;
-                                               return ":$$hash{$key}[15]";
+                                                return ":$$hash{$key}[15]";
                                         }
                                }
                        }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] ne 'All ICMP-Types'){
@@ -585,7 +602,7 @@ sub get_port
                        }
                }elsif($$hash{$key}[14] eq 'cust_srv'){
                        if ($prot ne 'ICMP'){
-                               if($$hash{$key}[31] eq 'dnat'){
+                               if($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
                                        return ":".&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
                                }else{
                                        return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot);