Forward Firewall: changed order of LOG and DROP rules for INPUT Chain

[people/teissler/ipfire-2.x.git] / src / initscripts / init.d / firewall

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 94b869dd6b9d7bea35cea0a6aec8d68e23bf3d9f..5a8cfb171e0437c41beda131def6ec2c7eb0e9c0 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -273,16 +273,6 @@ case "$1" in
                /etc/sysconfig/firewall.local start
        fi
 
-       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
-
-       if [ "$DROPINPUT" == "on" ]; then
-               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
-       fi
-       if [ "$DROPFORWARD" == "on" ]; then
-               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
-       fi
-       /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
-
        #POLICY CHAIN
        /sbin/iptables -N POLICYIN
        /sbin/iptables -A INPUT -j POLICYIN
@@ -293,11 +283,10 @@ case "$1" in
 
        /usr/sbin/firewall-policy
 
-       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
-
        if [ "$DROPINPUT" == "on" ]; then
                /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
        fi
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
        if [ "$DROPFORWARD" == "on" ]; then
                /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
        fi