Forward Firewall: moved default rules from FORWARDFW to POLICYFWD

[people/teissler/ipfire-2.x.git] / config / forwardfw / rules.pl

diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl
index 4c220c04faa143fd797908b7d1e8fd365ff35756..d62cca0d77dcb6f47a1d32206f3b5f0b54886a12 100755 (executable)
--- a/config/forwardfw/rules.pl
+++ b/config/forwardfw/rules.pl
@@ -55,7 +55,6 @@ require "${General::swroot}/forward/bin/firewall-lib.pl";
 my $configfwdfw                = "${General::swroot}/forward/config";
 my $configinput            = "${General::swroot}/forward/input";
 my $configoutgoing  = "${General::swroot}/forward/outgoing";
-my $confignat          = "${General::swroot}/forward/nat";
 my $p2pfile                    = "${General::swroot}/forward/p2protocols";
 my $configgrp          = "${General::swroot}/fwhosts/customgroups";
 my $netsettings                = "${General::swroot}/ethernet/settings";
@@ -74,7 +73,6 @@ my $snat='';
 &General::readhasharray($configfwdfw, \%configfwdfw);
 &General::readhasharray($configinput, \%configinputfw);
 &General::readhasharray($configoutgoing, \%configoutgoingfw);
-&General::readhasharray($confignat, \%confignatfw);
 &General::readhasharray($configgrp, \%customgrp);
 &General::get_aliases(\%aliases);
 
@@ -116,23 +114,6 @@ if($param eq 'flush'){
                        &p2pblock;
                        system ("/usr/sbin/firewall-policy"); 
                }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
-                       $defaultNetworks{'GREEN_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'GREEN_NETMASK'});
-                       $green="$defaultNetworks{'GREEN_ADDRESS'}/$defaultNetworks{'GREEN_NETMASK'}";
-                       if ($defaultNetworks{'BLUE_DEV'}){
-                               $defaultNetworks{'BLUE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'BLUE_NETMASK'});
-                               $blue="$defaultNetworks{'BLUE_ADDRESS'}/$defaultNetworks{'BLUE_NETMASK'}";
-                               #set default rules for BLUE
-                               system ("iptables -A $CHAIN -s $blue -d $green -j RETURN");
-                       }
-                       if ($defaultNetworks{'ORANGE_DEV'}){
-                               $defaultNetworks{'ORANGE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'ORANGE_NETMASK'});
-                               $orange="$defaultNetworks{'ORANGE_ADDRESS'}/$defaultNetworks{'ORANGE_NETMASK'}";
-                               #set default rules for DMZ
-                               system ("iptables -A $CHAIN -s $orange -d $green -j RETURN");
-                               if ($defaultNetworks{'BLUE_DEV'}){
-                                       system ("iptables -A $CHAIN -s $orange -d $blue -j RETURN");
-                               }
-                       }
                        &p2pblock;
                        system ("iptables -A $CHAIN -m state --state NEW -j ACCEPT");
                        system ("/usr/sbin/firewall-policy");
@@ -145,7 +126,6 @@ sub flush
        system ("iptables -F FORWARDFW");
        system ("iptables -F INPUTFW");
        system ("iptables -F OUTGOINGFW");
-       system ("iptables -F PORTFWACCESS");
        system ("iptables -t nat -F NAT_DESTINATION");
        system ("iptables -t nat -F NAT_SOURCE");
 }                      
@@ -210,7 +190,7 @@ sub buildrules
                                                &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"tgt");
                                        }
                                }
-                       }elsif($$hash{$key}[5] eq 'ipfire'){
+                       }elsif($$hash{$key}[5] eq 'ipfire' ){
                                if($$hash{$key}[6] eq 'GREEN'){
                                        $targethash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'};
                                }
@@ -506,6 +486,30 @@ sub get_address
                $$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,11);
        }elsif($base eq 'ipsec_net_src' || $base eq 'ipsec_net_tgt' || $base eq 'IpSec Network'){
                $$hash{$key}[0]=&fwlib::get_ipsec_net_ip($base2,11);
+       }elsif($base eq 'ipfire_src' ){
+               if($base2 eq 'GREEN'){
+                       $$hash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'};
+               }
+               if($base2 eq 'BLUE'){
+                       $$hash{$key}[0]=$defaultNetworks{'BLUE_ADDRESS'};
+               }
+               if($base2 eq 'ORANGE'){
+                       $$hash{$key}[0]=$defaultNetworks{'ORANGE_ADDRESS'};
+               }
+               if($base2 eq 'ALL'){
+                       $$hash{$key}[0]='0.0.0.0/0';
+               }
+               if($base2 eq 'RED' || $base2 eq 'RED1'){
+                       open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress";
+                       $$hash{$key}[0]= <FILE>;
+                       close(FILE);
+               }else{
+                       foreach my $alias (sort keys %aliases){
+                               if ($base2 eq $alias){
+                                       $$hash{$key}[0]=$aliases{$alias}{'IPT'};
+                               }
+                       }
+               }
        }
 }
 sub get_prot