Forward Firewall: BUGFIX: When creating DMZ Rules with MANUAL IP as source and afterw...

[people/teissler/ipfire-2.x.git] / src / initscripts / init.d / firewall

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 3d14143b458d78eeb72c230a7cd5c0787dd791a3..200c1550e77f11afe60de6b988065d8044235e00 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -120,8 +120,8 @@ iptables_red() {
                fi
 
                # Outgoing masquerading (don't masqerade IPSEC (mark 50))
-               #/sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
-               #/sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
+               /sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
+               /sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
 
        fi
 }
@@ -243,7 +243,7 @@ case "$1" in
        /sbin/iptables -t nat -N NAT_DESTINATION
        /sbin/iptables -t nat -N NAT_SOURCE
        /sbin/iptables -t nat -A PREROUTING -j NAT_DESTINATION
-       /sbin/iptables -t nat -A POSTROUTING -j NAT_SOURCE
+       /sbin/iptables -t nat -I POSTROUTING 2 -j NAT_SOURCE
        
        
        # upnp chain for our upnp daemon
@@ -267,6 +267,16 @@ case "$1" in
                /etc/sysconfig/firewall.local start
        fi
        
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT_a"
+
+       if [ "$DROPINPUT" == "on" ]; then
+               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT_b"
+       fi
+       if [ "$DROPFORWARD" == "on" ]; then
+               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
+       fi
+       /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
+
        #POLICY CHAIN
        /sbin/iptables -N POLICYIN
        /sbin/iptables -A INPUT -j POLICYIN
@@ -276,10 +286,6 @@ case "$1" in
        /sbin/iptables -A OUTPUT -j POLICYOUT
 
        /usr/sbin/firewall-policy
-       
-       #Only for firewall Hits statistik
-       /sbin/iptables -A POLICYFWD -j DROP  -m comment --comment "DROP_FORWARD"
-       /sbin/iptables -A POLICYOUT -j DROP  -m comment --comment "DROP_OUTPUT"
        ;;
   startovpn)  
        # run openvpn
@@ -308,21 +314,16 @@ case "$1" in
                /etc/sysconfig/firewall.local stop
        fi
 
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+
        if [ "$DROPINPUT" == "on" ]; then
-               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
+               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
        fi
-       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
        if [ "$DROPFORWARD" == "on" ]; then
-               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
+               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
        fi
        /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
        
-       #Only for firewall Hits statistik
-       #/sbin/iptables -A POLICYFWD -j DROP  -m comment --comment "DROP_FORWARD"
-       #/sbin/iptables -A POLICYOUT -j DROP  -m comment --comment "DROP_OUTPUT"
-       
-       
-       
        ;;
   stopovpn)
        # stop openvpn