X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=src%2Finitscripts%2Finit.d%2Ffirewall;h=5d66c60b40b19e973fbc5040e3799d981b6868d0;hp=0888145e28a752769c952a2cbfbdc38d38a9011b;hb=afc611d448aee8eaaefa018dfb6acd4c6d6227a1;hpb=aff15defbc1ade178a1fbbf1fa1b592033d4fb77

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 0888145e2..5d66c60b4 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -68,74 +68,14 @@ iptables_init() {
 	# SYN/FIN (QueSO or nmap OS probe)
 	/sbin/iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
 	# NEW TCP without SYN
-	/sbin/iptables -A BADTCP -p tcp ! --syn -m state --state NEW -j NEWNOTSYN
+	/sbin/iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 
-	/sbin/iptables -A INPUT   -j BADTCP
-	/sbin/iptables -A FORWARD -j BADTCP
+	/sbin/iptables -A INPUT   -p tcp -j BADTCP
+	/sbin/iptables -A FORWARD -p tcp -j BADTCP
 
-}
-
-iptables_red() {
-	/sbin/iptables -F REDINPUT
-	/sbin/iptables -F REDFORWARD
-	/sbin/iptables -t nat -F REDNAT
-
-	# PPPoE / PPTP Device
-	if [ "$IFACE" != "" ]; then
-		# PPPoE / PPTP
-		if [ "$DEVICE" != "" ]; then
-			/sbin/iptables -A REDINPUT -i $DEVICE -j ACCEPT
-		fi
-		if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
-			if [ "$RED_DEV" != "" ]; then
-				/sbin/iptables -A REDINPUT -i $RED_DEV -j ACCEPT
-			fi
-		fi
-	fi
-
-	# PPTP over DHCP
-	if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
-		/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
-		/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
-	fi
-
-	# Orange pinholes
-	if [ "$ORANGE_DEV" != "" ]; then
-		# This rule enables a host on ORANGE network to connect to the outside
-		# (only if we have a red connection)
-		if [ "$IFACE" != "" ]; then
-			/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT
-		fi
-	fi
-
-	if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
-		# DHCP
-		if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
-			/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-			/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		fi
-		if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
-			/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-			/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		fi
-
-		# Outgoing masquerading (don't masqerade IPSEC (mark 50))
-		#/sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
-		#/sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
-
-	fi
-}
-
-# See how we were called.
-case "$1" in
-  start)
-	iptables_init
-
-	# Limit Packets- helps reduce dos/syn attacks
-	# original do nothing line
-	#/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec
-	# the correct one, but the negative '!' do nothing...
-	#/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN ! -m limit --limit 10/sec -j DROP
+	# Connection tracking chain
+	/sbin/iptables -N CONNTRACK
+	/sbin/iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
 	# Fix for braindead ISP's
 	/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
@@ -145,18 +85,22 @@ case "$1" in
 	/sbin/iptables -A INPUT -j CUSTOMINPUT
 	/sbin/iptables -N GUARDIAN
 	/sbin/iptables -A INPUT -j GUARDIAN
+	/sbin/iptables -N OVPNBLOCK
+	/sbin/iptables -A FORWARD -j OVPNBLOCK
 	/sbin/iptables -A FORWARD -j GUARDIAN
 	/sbin/iptables -N CUSTOMFORWARD
 	/sbin/iptables -A FORWARD -j CUSTOMFORWARD
 	/sbin/iptables -N CUSTOMOUTPUT
-	/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+	/sbin/iptables -A OUTPUT -j OVPNBLOCK
 	/sbin/iptables -A OUTPUT -j CUSTOMOUTPUT
 	/sbin/iptables -N OUTGOINGFW
 	/sbin/iptables -A OUTPUT -j OUTGOINGFW
 	/sbin/iptables -t nat -N CUSTOMPREROUTING
+	/sbin/iptables -t nat -N OVPNNAT
 	/sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
 	/sbin/iptables -t nat -N CUSTOMPOSTROUTING
 	/sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
+	/sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
 
 	# IPTV chains for IGMPPROXY
 	/sbin/iptables -N IPTVINPUT
@@ -164,19 +108,27 @@ case "$1" in
 	/sbin/iptables -N IPTVFORWARD
 	/sbin/iptables -A FORWARD -j IPTVFORWARD
 
+	# Filtering ovpn networks INPUT
+	/sbin/iptables -A INPUT -j OVPNBLOCK
+
 	# filtering from GUI
 	/sbin/iptables -N GUIINPUT
 	/sbin/iptables -A INPUT -j GUIINPUT
 	/sbin/iptables -A GUIINPUT -p icmp --icmp-type 8 -j ACCEPT
 
+	# Accept everything on loopback
+	/sbin/iptables -N LOOPBACK
+	/sbin/iptables -A LOOPBACK -i lo -j ACCEPT
+	/sbin/iptables -A LOOPBACK -o lo -j ACCEPT
+
+	/sbin/iptables -A INPUT  -j LOOPBACK
+	/sbin/iptables -A OUTPUT -j LOOPBACK
+
 	# Accept everything connected
-	/sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
-	/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-	
-	# Accept everything on lo
-	iptables -A INPUT  -i lo -m state --state NEW -j ACCEPT
-	iptables -A OUTPUT -o lo -m state --state NEW -j ACCEPT
-	
+	for i in INPUT FORWARD OUTPUT; do
+		/sbin/iptables -A ${i} -j CONNTRACK
+	done
+
 	# trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
 	/sbin/iptables -N IPSECINPUT
 	/sbin/iptables -N IPSECFORWARD
@@ -187,23 +139,21 @@ case "$1" in
 	/sbin/iptables -A FORWARD -j IPSECFORWARD
 	/sbin/iptables -A FORWARD -j OPENSSLVIRTUAL -m comment --comment "OPENSSLVIRTUAL FORWARD"
 	/sbin/iptables -A OUTPUT -j IPSECOUTPUT
-	/sbin/iptables -t nat -N OVPNNAT
 	/sbin/iptables -t nat -N IPSECNAT
-	/sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
 	/sbin/iptables -t nat -A POSTROUTING -j IPSECNAT
 
 	# Input Firewall
 	/sbin/iptables -N INPUTFW
-	/sbin/iptables -A INPUT -m state --state NEW -j INPUTFW
+	/sbin/iptables -A INPUT -m conntrack --ctstate NEW -j INPUTFW
 
 	# localhost and ethernet.
-	/sbin/iptables -A INPUT   -i lo -m state --state NEW -j ACCEPT
-	/sbin/iptables -A INPUT   -s 127.0.0.0/8 -m state --state NEW -j DROP   # Loopback not on lo
-	/sbin/iptables -A INPUT   -d 127.0.0.0/8 -m state --state NEW -j DROP
-	/sbin/iptables -A FORWARD -i lo -m state --state NEW -j ACCEPT
-	/sbin/iptables -A FORWARD -s 127.0.0.0/8 -m state --state NEW -j DROP
-	/sbin/iptables -A FORWARD -d 127.0.0.0/8 -m state --state NEW -j DROP
-	/sbin/iptables -A INPUT   -i $GREEN_DEV  -m state --state NEW -j ACCEPT ! -p icmp
+	/sbin/iptables -A INPUT   -i lo -m conntrack --ctstate NEW -j ACCEPT
+	/sbin/iptables -A INPUT   -s 127.0.0.0/8 -m conntrack --ctstate NEW -j DROP   # Loopback not on lo
+	/sbin/iptables -A INPUT   -d 127.0.0.0/8 -m conntrack --ctstate NEW -j DROP
+	/sbin/iptables -A FORWARD -i lo -m conntrack --ctstate NEW -j ACCEPT
+	/sbin/iptables -A FORWARD -s 127.0.0.0/8 -m conntrack --ctstate NEW -j DROP
+	/sbin/iptables -A FORWARD -d 127.0.0.0/8 -m conntrack --ctstate NEW -j DROP
+	/sbin/iptables -A INPUT   -i $GREEN_DEV  -m conntrack --ctstate NEW -j ACCEPT ! -p icmp
 	
 	# allow DHCP on BLUE to be turned on/off
 	/sbin/iptables -N DHCPBLUEINPUT 
@@ -211,18 +161,14 @@ case "$1" in
 	
 	# WIRELESS chains
 	/sbin/iptables -N WIRELESSINPUT
-	/sbin/iptables -A INPUT -m state --state NEW -j WIRELESSINPUT
+	/sbin/iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
 	/sbin/iptables -N WIRELESSFORWARD
-	/sbin/iptables -A FORWARD -m state --state NEW -j WIRELESSFORWARD
+	/sbin/iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
 	
 	# Forward Firewall
 	/sbin/iptables -N FORWARDFW
 	/sbin/iptables -A FORWARD -j FORWARDFW
 		
-	# PORTFWACCESS chain, used for portforwarding
-	/sbin/iptables -N PORTFWACCESS
-	/sbin/iptables -A FORWARD -m state --state NEW -j PORTFWACCESS
-	
 	# OPenSSL
 	/sbin/iptables -N OPENSSLPHYSICAL
 	/sbin/iptables -A INPUT -j OPENSSLPHYSICAL
@@ -243,18 +189,18 @@ case "$1" in
 	/sbin/iptables -t nat -N NAT_DESTINATION
 	/sbin/iptables -t nat -N NAT_SOURCE
 	/sbin/iptables -t nat -A PREROUTING -j NAT_DESTINATION
-	/sbin/iptables -t nat -A POSTROUTING -j NAT_SOURCE
+	/sbin/iptables -t nat -I POSTROUTING 3 -j NAT_SOURCE
+	
 	
 	
 	# upnp chain for our upnp daemon
 	/sbin/iptables -t nat -N UPNPFW
 	/sbin/iptables -t nat -A PREROUTING -j UPNPFW
 	/sbin/iptables -N UPNPFW
-	/sbin/iptables -A FORWARD -m state --state NEW -j UPNPFW
+	/sbin/iptables -A FORWARD -m conntrack --ctstate NEW -j UPNPFW
 
 	# Postrouting rules (for port forwarding)
-	/sbin/iptables -t nat -A POSTROUTING -m mark --mark 1 -j SNAT \
-	 --to-source $GREEN_ADDRESS
+	/sbin/iptables -t nat -A POSTROUTING -m mark --mark 1 -j SNAT --to-source $GREEN_ADDRESS
 	if [ "$BLUE_DEV" != "" ]; then
 		/sbin/iptables -t nat -A POSTROUTING -m mark --mark 2 -j SNAT --to-source $BLUE_ADDRESS
 	fi
@@ -266,7 +212,13 @@ case "$1" in
  	if [ -x /etc/sysconfig/firewall.local ]; then
 		/etc/sysconfig/firewall.local start
 	fi
-	
+
+	# run openvpn
+	/usr/local/bin/openvpnctrl --create-chains-and-rules
+
+	# run wirelessctrl
+	/usr/local/bin/wirelessctrl
+
 	#POLICY CHAIN
 	/sbin/iptables -N POLICYIN
 	/sbin/iptables -A INPUT -j POLICYIN
@@ -276,65 +228,92 @@ case "$1" in
 	/sbin/iptables -A OUTPUT -j POLICYOUT
 
 	/usr/sbin/firewall-policy
-	;;
-  startovpn)  
-	# run openvpn
-	/usr/local/bin/openvpnctrl --create-chains-and-rules
-        ;;
-  stop)
-	iptables_init
-	# Accept everyting connected
-	/sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
 
-	# localhost and ethernet.
-	/sbin/iptables -A INPUT -i lo -j ACCEPT
-	/sbin/iptables -A INPUT -i $GREEN_DEV -m state --state NEW -j ACCEPT
+	# read new firewall
+	/usr/local/bin/forwardfwctrl
 
-	if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
-		/sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		/sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+	if [ "$DROPINPUT" == "on" ]; then
+		/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
 	fi
-	if [ "$PROTOCOL" == "RFC1483" -a "$METHOD" == "DHCP" ]; then
-		/sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		/sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+	/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+	if [ "$DROPFORWARD" == "on" ]; then
+		/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
 	fi
+	/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
+}
 
-	# run local firewall configuration, if present
- 	if [ -x /etc/sysconfig/firewall.local ]; then
-		/etc/sysconfig/firewall.local stop
+iptables_red() {
+	/sbin/iptables -F REDINPUT
+	/sbin/iptables -F REDFORWARD
+	/sbin/iptables -t nat -F REDNAT
+
+	# PPPoE / PPTP Device
+	if [ "$IFACE" != "" ]; then
+		# PPPoE / PPTP
+		if [ "$DEVICE" != "" ]; then
+			/sbin/iptables -A REDINPUT -i $DEVICE -j ACCEPT
+		fi
+		if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
+			if [ "$RED_DEV" != "" ]; then
+				/sbin/iptables -A REDINPUT -i $RED_DEV -j ACCEPT
+			fi
+		fi
 	fi
 
-	if [ "$DROPINPUT" == "on" ]; then
-		/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
+	# PPTP over DHCP
+	if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
+		/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
+		/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 	fi
-	/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
-	if [ "$DROPFORWARD" == "on" ]; then
-		/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
+
+	# Orange pinholes
+	if [ "$ORANGE_DEV" != "" ]; then
+		# This rule enables a host on ORANGE network to connect to the outside
+		# (only if we have a red connection)
+		if [ "$IFACE" != "" ]; then
+			/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT
+		fi
 	fi
-	/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
-	
+
+	if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
+		# DHCP
+		if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
+			/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+			/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+		fi
+		if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
+			/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+			/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+		fi
+
+		# Outgoing masquerading (don't masqerade IPSEC (mark 50))
+		/sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
+		/sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
+
+	fi
+}
+
+# See how we were called.
+case "$1" in
+  start)
+	iptables_init
 	;;
-  stopovpn)
-	# stop openvpn
-	/usr/local/bin/openvpnctrl --delete-chains-and-rules
-        ;;
   reload)
 	iptables_red
-
 	# run local firewall configuration, if present
- 	if [ -x /etc/sysconfig/firewall.local ]; then
+	if [ -x /etc/sysconfig/firewall.local ]; then
 		/etc/sysconfig/firewall.local reload
 	fi
 	;;
   restart)
-	$0 stop
+	# run local firewall configuration, if present
+	if [ -x /etc/sysconfig/firewall.local ]; then
+		/etc/sysconfig/firewall.local stop
+	fi
 	$0 start
-	/usr/local/bin/forwardfwctrl
-	/usr/local/bin/openvpnctrl -s > /dev/null 2>&1
-	/usr/local/bin/openvpnctrl -sn2n > /dev/null 2>&1
 	;;
   *)
-        echo "Usage: $0 {start|stop|reload|restart}"
+        echo "Usage: $0 {start|reload|restart}"
         exit 1
 	;;
 esac