X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=src%2Finitscripts%2Finit.d%2Ffirewall;h=7db39085dde4a1248ec2149e5223bafabb1bda7b;hp=94b869dd6b9d7bea35cea0a6aec8d68e23bf3d9f;hb=c581b670ef383fe566075abe0a7df300b7da537c;hpb=690b0bd7618c2b0e7284beaebcf771c02daced1d

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 94b869dd6..7db39085d 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -9,359 +9,312 @@ if [ -f /var/ipfire/red/device ]; then
 	DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
 fi
 
+function iptables() {
+	/sbin/iptables --wait "$@"
+}
+
 iptables_init() {
 	# Flush all rules and delete all custom chains
-	/sbin/iptables -F
-	/sbin/iptables -t nat -F
-	/sbin/iptables -t mangle -F
-	/sbin/iptables -X
-	/sbin/iptables -t nat -X
-	/sbin/iptables -t mangle -X
+	iptables -F
+	iptables -t nat -F
+	iptables -t mangle -F
+	iptables -X
+	iptables -t nat -X
+	iptables -t mangle -X
 
 	# Set up policies
-	/sbin/iptables -P INPUT DROP
-	/sbin/iptables -P FORWARD DROP
-	/sbin/iptables -P OUTPUT ACCEPT
+	iptables -P INPUT DROP
+	iptables -P FORWARD DROP
+	iptables -P OUTPUT ACCEPT
 
 	# Empty LOG_DROP and LOG_REJECT chains
-	/sbin/iptables -N LOG_DROP
-	/sbin/iptables -A LOG_DROP   -m limit --limit 10/minute -j LOG
-	/sbin/iptables -A LOG_DROP   -j DROP
-	/sbin/iptables -N LOG_REJECT
-	/sbin/iptables -A LOG_REJECT -m limit --limit 10/minute -j LOG
-	/sbin/iptables -A LOG_REJECT -j REJECT
+	iptables -N LOG_DROP
+	iptables -A LOG_DROP   -m limit --limit 10/minute -j LOG
+	iptables -A LOG_DROP   -j DROP
+	iptables -N LOG_REJECT
+	iptables -A LOG_REJECT -m limit --limit 10/minute -j LOG
+	iptables -A LOG_REJECT -j REJECT
 
 	# This chain will log, then DROPs packets with certain bad combinations
 	# of flags might indicate a port-scan attempt (xmas, null, etc)
-	/sbin/iptables -N PSCAN
+	iptables -N PSCAN
 	if [ "$DROPPORTSCAN" == "on" ]; then
-		/sbin/iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan"
-		/sbin/iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UDP PScan"
-		/sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
-		/sbin/iptables -A PSCAN -f      -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
+		iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan"
+		iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UDP PScan"
+		iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
+		iptables -A PSCAN -f      -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
 	fi
-	/sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
+	iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
 
 	# New tcp packets without SYN set - could well be an obscure type of port scan
 	# that's not covered above, may just be a broken windows machine
-	/sbin/iptables -N NEWNOTSYN
+	iptables -N NEWNOTSYN
 	if [ "$DROPNEWNOTSYN" == "on" ]; then
-		/sbin/iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-prefix "DROP_NEWNOTSYN "
+		iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-prefix "DROP_NEWNOTSYN "
 	fi
-	/sbin/iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
+	iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 
 	# Chain to contain all the rules relating to bad TCP flags
-	/sbin/iptables -N BADTCP
+	iptables -N BADTCP
 
-	#Don't check loopback
-	/sbin/iptables -A BADTCP -i lo -j RETURN
+	# Don't check loopback
+	iptables -A BADTCP -i lo -j RETURN
 
 	# Disallow packets frequently used by port-scanners
 	# nmap xmas
-	/sbin/iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH  -j PSCAN
+	iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH  -j PSCAN
 	# Null
-	/sbin/iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
+	iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
 	# FIN
-	/sbin/iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
+	iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
 	# SYN/RST (also catches xmas variants that set SYN+RST+...)
-	/sbin/iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
+	iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
 	# SYN/FIN (QueSO or nmap OS probe)
-	/sbin/iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
+	iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
 	# NEW TCP without SYN
-	/sbin/iptables -A BADTCP -p tcp ! --syn -m state --state NEW -j NEWNOTSYN
-
-	/sbin/iptables -A INPUT   -j BADTCP
-	/sbin/iptables -A FORWARD -j BADTCP
-
-}
-
-iptables_red() {
-	/sbin/iptables -F REDINPUT
-	/sbin/iptables -F REDFORWARD
-	/sbin/iptables -t nat -F REDNAT
-
-	# PPPoE / PPTP Device
-	if [ "$IFACE" != "" ]; then
-		# PPPoE / PPTP
-		if [ "$DEVICE" != "" ]; then
-			/sbin/iptables -A REDINPUT -i $DEVICE -j ACCEPT
-		fi
-		if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
-			if [ "$RED_DEV" != "" ]; then
-				/sbin/iptables -A REDINPUT -i $RED_DEV -j ACCEPT
-			fi
-		fi
-	fi
-
-	# PPTP over DHCP
-	if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
-		/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
-		/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
-	fi
-
-	# Orange pinholes
-	if [ "$ORANGE_DEV" != "" ]; then
-		# This rule enables a host on ORANGE network to connect to the outside
-		# (only if we have a red connection)
-		if [ "$IFACE" != "" ]; then
-			/sbin/iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT
-		fi
-	fi
+	iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
 
-	if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
-		# DHCP
-		if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
-			/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-			/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		fi
-		if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
-			/sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-			/sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		fi
-
-		# Outgoing masquerading (don't masqerade IPSEC (mark 50))
-		/sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
-		/sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
-
-	fi
-}
-
-# See how we were called.
-case "$1" in
-  start)
-	iptables_init
+	iptables -A INPUT   -p tcp -j BADTCP
+	iptables -A FORWARD -p tcp -j BADTCP
 
-	# Limit Packets- helps reduce dos/syn attacks
-	# original do nothing line
-	#/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec
-	# the correct one, but the negative '!' do nothing...
-	#/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN ! -m limit --limit 10/sec -j DROP
+	# Connection tracking chain
+	iptables -N CONNTRACK
+	iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
 	# Fix for braindead ISP's
-	/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 
 	# CUSTOM chains, can be used by the users themselves
-	/sbin/iptables -N CUSTOMINPUT
-	/sbin/iptables -A INPUT -j CUSTOMINPUT
-	/sbin/iptables -N GUARDIAN
-	/sbin/iptables -A INPUT -j GUARDIAN
-	/sbin/iptables -N OVPNBLOCK
-	/sbin/iptables -A FORWARD -j OVPNBLOCK
-	/sbin/iptables -A FORWARD -j GUARDIAN
-	/sbin/iptables -N CUSTOMFORWARD
-	/sbin/iptables -A FORWARD -j CUSTOMFORWARD
-	/sbin/iptables -N CUSTOMOUTPUT
-	/sbin/iptables -A OUTPUT -j OVPNBLOCK
-	/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-	/sbin/iptables -A OUTPUT -j CUSTOMOUTPUT
-	/sbin/iptables -N OUTGOINGFW
-	/sbin/iptables -A OUTPUT -j OUTGOINGFW
-	/sbin/iptables -t nat -N CUSTOMPREROUTING
-	/sbin/iptables -t nat -N OVPNNAT
-	/sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
-	/sbin/iptables -t nat -N CUSTOMPOSTROUTING
-	/sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
-	/sbin/iptables -t nat -A POSTROUTING -j OVPNNAT
+	iptables -N CUSTOMINPUT
+	iptables -A INPUT -j CUSTOMINPUT
+	iptables -N CUSTOMFORWARD
+	iptables -A FORWARD -j CUSTOMFORWARD
+	iptables -N CUSTOMOUTPUT
+	iptables -A OUTPUT -j CUSTOMOUTPUT
+	iptables -t nat -N CUSTOMPREROUTING
+	iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
+	iptables -t nat -N CUSTOMPOSTROUTING
+	iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
+
+	# Guardian (IPS) chains
+	iptables -N GUARDIAN
+	iptables -A INPUT -j GUARDIAN
+	iptables -A FORWARD -j GUARDIAN
+
+	# Block OpenVPN transfer networks
+	iptables -N OVPNBLOCK
+	for i in INPUT FORWARD; do
+		iptables -A ${i} -j OVPNBLOCK
+	done
+
+	# OpenVPN transfer network translation
+	iptables -t nat -N OVPNNAT
+	iptables -t nat -A POSTROUTING -j OVPNNAT
 
 	# IPTV chains for IGMPPROXY
-	/sbin/iptables -N IPTVINPUT
-	/sbin/iptables -A INPUT -j IPTVINPUT
-	/sbin/iptables -N IPTVFORWARD
-	/sbin/iptables -A FORWARD -j IPTVFORWARD
-
-	# Filtering ovpn networks INPUT
-	/sbin/iptables -A INPUT -j OVPNBLOCK
+	iptables -N IPTVINPUT
+	iptables -A INPUT -j IPTVINPUT
+	iptables -N IPTVFORWARD
+	iptables -A FORWARD -j IPTVFORWARD
 
 	# filtering from GUI
-	/sbin/iptables -N GUIINPUT
-	/sbin/iptables -A INPUT -j GUIINPUT
-	/sbin/iptables -A GUIINPUT -p icmp --icmp-type 8 -j ACCEPT
+	iptables -N GUIINPUT
+	iptables -A INPUT -j GUIINPUT
+	iptables -A GUIINPUT -p icmp --icmp-type 8 -j ACCEPT
+
+	# Accept everything on loopback
+	iptables -N LOOPBACK
+	iptables -A LOOPBACK -i lo -j ACCEPT
+	iptables -A LOOPBACK -o lo -j ACCEPT
+
+	# Filter all packets with loopback addresses on non-loopback interfaces.
+	iptables -A LOOPBACK -s 127.0.0.0/8 -j DROP
+	iptables -A LOOPBACK -d 127.0.0.0/8 -j DROP
+
+	for i in INPUT FORWARD OUTPUT; do
+		iptables -A ${i} -j LOOPBACK
+	done
 
 	# Accept everything connected
-	/sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
-	/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-	
-	# Accept everything on lo
-	iptables -A INPUT  -i lo -m state --state NEW -j ACCEPT
-	iptables -A OUTPUT -o lo -m state --state NEW -j ACCEPT
-	
+	for i in INPUT FORWARD OUTPUT; do
+		iptables -A ${i} -j CONNTRACK
+	done
+
 	# trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
-	/sbin/iptables -N IPSECINPUT
-	/sbin/iptables -N IPSECFORWARD
-	/sbin/iptables -N IPSECOUTPUT
-	/sbin/iptables -N OPENSSLVIRTUAL
-	/sbin/iptables -A INPUT -j IPSECINPUT
-	/sbin/iptables -A INPUT -j OPENSSLVIRTUAL -m comment --comment "OPENSSLVIRTUAL INPUT"
-	/sbin/iptables -A FORWARD -j IPSECFORWARD
-	/sbin/iptables -A FORWARD -j OPENSSLVIRTUAL -m comment --comment "OPENSSLVIRTUAL FORWARD"
-	/sbin/iptables -A OUTPUT -j IPSECOUTPUT
-	/sbin/iptables -t nat -N IPSECNAT
-	/sbin/iptables -t nat -A POSTROUTING -j IPSECNAT
-
-	# Input Firewall
-	/sbin/iptables -N INPUTFW
-	/sbin/iptables -A INPUT -m state --state NEW -j INPUTFW
+	iptables -N IPSECINPUT
+	iptables -N IPSECFORWARD
+	iptables -N IPSECOUTPUT
+	iptables -A INPUT -j IPSECINPUT
+	iptables -A FORWARD -j IPSECFORWARD
+	iptables -A OUTPUT -j IPSECOUTPUT
+	iptables -t nat -N IPSECNAT
+	iptables -t nat -A POSTROUTING -j IPSECNAT
 
 	# localhost and ethernet.
-	/sbin/iptables -A INPUT   -i lo -m state --state NEW -j ACCEPT
-	/sbin/iptables -A INPUT   -s 127.0.0.0/8 -m state --state NEW -j DROP   # Loopback not on lo
-	/sbin/iptables -A INPUT   -d 127.0.0.0/8 -m state --state NEW -j DROP
-	/sbin/iptables -A FORWARD -i lo -m state --state NEW -j ACCEPT
-	/sbin/iptables -A FORWARD -s 127.0.0.0/8 -m state --state NEW -j DROP
-	/sbin/iptables -A FORWARD -d 127.0.0.0/8 -m state --state NEW -j DROP
-	/sbin/iptables -A INPUT   -i $GREEN_DEV  -m state --state NEW -j ACCEPT ! -p icmp
+	iptables -A INPUT   -i $GREEN_DEV  -m conntrack --ctstate NEW -j ACCEPT ! -p icmp
 	
 	# allow DHCP on BLUE to be turned on/off
-	/sbin/iptables -N DHCPBLUEINPUT 
-	/sbin/iptables -A INPUT -j DHCPBLUEINPUT
+	iptables -N DHCPBLUEINPUT 
+	iptables -A INPUT -j DHCPBLUEINPUT
 	
 	# WIRELESS chains
-	/sbin/iptables -N WIRELESSINPUT
-	/sbin/iptables -A INPUT -m state --state NEW -j WIRELESSINPUT
-	/sbin/iptables -N WIRELESSFORWARD
-	/sbin/iptables -A FORWARD -m state --state NEW -j WIRELESSFORWARD
+	iptables -N WIRELESSINPUT
+	iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
+	iptables -N WIRELESSFORWARD
+	iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
+
+	# OpenVPN
+	iptables -N OVPNINPUT
+	iptables -A INPUT -j OVPNINPUT
+
+	# TOR
+	iptables -N TOR_INPUT
+	iptables -A INPUT -j TOR_INPUT
 	
-	# Forward Firewall
-	/sbin/iptables -N FORWARDFW
-	/sbin/iptables -A FORWARD -j FORWARDFW
-		
-	# PORTFWACCESS chain, used for portforwarding
-	/sbin/iptables -N PORTFWACCESS
-	/sbin/iptables -A FORWARD -m state --state NEW -j PORTFWACCESS
-	
-	# OPenSSL
-	/sbin/iptables -N OPENSSLPHYSICAL
-	/sbin/iptables -A INPUT -j OPENSSLPHYSICAL
+	# Jump into the actual firewall ruleset.
+	iptables -N INPUTFW
+	iptables -A INPUT -j INPUTFW
+
+	iptables -N OUTGOINGFW
+	iptables -A OUTPUT -j OUTGOINGFW
+
+	iptables -N FORWARDFW
+	iptables -A FORWARD -j FORWARDFW
+
+	# SNAT rules
+	iptables -t nat -N NAT_SOURCE
+	iptables -t nat -A POSTROUTING -j NAT_SOURCE
 
 	# RED chain, used for the red interface
-	/sbin/iptables -N REDINPUT
-	/sbin/iptables -A INPUT -j REDINPUT
-	/sbin/iptables -N REDFORWARD
-	/sbin/iptables -A FORWARD -j REDFORWARD
-	/sbin/iptables -t nat -N REDNAT
-	/sbin/iptables -t nat -A POSTROUTING -j REDNAT
+	iptables -N REDINPUT
+	iptables -A INPUT -j REDINPUT
+	iptables -N REDFORWARD
+	iptables -A FORWARD -j REDFORWARD
+	iptables -t nat -N REDNAT
+	iptables -t nat -A POSTROUTING -j REDNAT
 
 	iptables_red
-		
-	# Custom prerouting chains (for transparent proxy and port forwarding)
-	/sbin/iptables -t nat -N SQUID
-	/sbin/iptables -t nat -A PREROUTING -j SQUID
-	/sbin/iptables -t nat -N NAT_DESTINATION
-	/sbin/iptables -t nat -N NAT_SOURCE
-	/sbin/iptables -t nat -A PREROUTING -j NAT_DESTINATION
-	/sbin/iptables -t nat -I POSTROUTING 3 -j NAT_SOURCE
-	
-	
-	
+
+	# Custom prerouting chains (for transparent proxy)
+	iptables -t nat -N SQUID
+	iptables -t nat -A PREROUTING -j SQUID
+
+	# DNAT rules
+	iptables -t nat -N NAT_DESTINATION
+	iptables -t nat -A PREROUTING -j NAT_DESTINATION
+
 	# upnp chain for our upnp daemon
-	/sbin/iptables -t nat -N UPNPFW
-	/sbin/iptables -t nat -A PREROUTING -j UPNPFW
-	/sbin/iptables -N UPNPFW
-	/sbin/iptables -A FORWARD -m state --state NEW -j UPNPFW
-
-	# Postrouting rules (for port forwarding)
-	/sbin/iptables -t nat -A POSTROUTING -m mark --mark 1 -j SNAT --to-source $GREEN_ADDRESS
-	if [ "$BLUE_DEV" != "" ]; then
-		/sbin/iptables -t nat -A POSTROUTING -m mark --mark 2 -j SNAT --to-source $BLUE_ADDRESS
-	fi
-	if [ "$ORANGE_DEV" != "" ]; then
-		/sbin/iptables -t nat -A POSTROUTING -m mark --mark 3 -j SNAT --to-source $ORANGE_ADDRESS
-	fi
+	iptables -t nat -N UPNPFW
+	iptables -t nat -A PREROUTING -j UPNPFW
+	iptables -N UPNPFW
+	iptables -A FORWARD -m conntrack --ctstate NEW -j UPNPFW
 
 	# run local firewall configuration, if present
  	if [ -x /etc/sysconfig/firewall.local ]; then
 		/etc/sysconfig/firewall.local start
 	fi
 
-	/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+	# Apply OpenVPN firewall rules
+	/usr/local/bin/openvpnctrl --firewall-rules
 
-	if [ "$DROPINPUT" == "on" ]; then
-		/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
-	fi
-	if [ "$DROPFORWARD" == "on" ]; then
-		/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
-	fi
-	/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
+	# run wirelessctrl
+	/usr/local/bin/wirelessctrl
 
-	#POLICY CHAIN
-	/sbin/iptables -N POLICYIN
-	/sbin/iptables -A INPUT -j POLICYIN
-	/sbin/iptables -N POLICYFWD
-	/sbin/iptables -A FORWARD -j POLICYFWD
-	/sbin/iptables -N POLICYOUT
-	/sbin/iptables -A OUTPUT -j POLICYOUT
+	# POLICY CHAIN
+	iptables -N POLICYIN
+	iptables -A INPUT -j POLICYIN
+	iptables -N POLICYFWD
+	iptables -A FORWARD -j POLICYFWD
+	iptables -N POLICYOUT
+	iptables -A OUTPUT -j POLICYOUT
 
 	/usr/sbin/firewall-policy
 
-	/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+	# read new firewall
+	/usr/local/bin/firewallctrl
 
 	if [ "$DROPINPUT" == "on" ]; then
-		/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
+		iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
 	fi
+	iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
 	if [ "$DROPFORWARD" == "on" ]; then
-		/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
+		iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
 	fi
-	/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
-	;;
-  startovpn)  
-	# run openvpn
-	/usr/local/bin/openvpnctrl --create-chains-and-rules
-        ;;
-  stop)
-	iptables_init
-	# Accept everyting connected
-	/sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
+	iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
+}
 
-	# localhost and ethernet.
-	/sbin/iptables -A INPUT -i lo -j ACCEPT
-	/sbin/iptables -A INPUT -i $GREEN_DEV -m state --state NEW -j ACCEPT
+iptables_red() {
+	iptables -F REDINPUT
+	iptables -F REDFORWARD
+	iptables -t nat -F REDNAT
 
-	if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
-		/sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		/sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+	# PPPoE / PPTP Device
+	if [ "$IFACE" != "" ]; then
+		# PPPoE / PPTP
+		if [ "$DEVICE" != "" ]; then
+			iptables -A REDINPUT -i $DEVICE -j ACCEPT
+		fi
+		if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
+			if [ "$RED_DEV" != "" ]; then
+				iptables -A REDINPUT -i $RED_DEV -j ACCEPT
+			fi
+		fi
 	fi
-	if [ "$PROTOCOL" == "RFC1483" -a "$METHOD" == "DHCP" ]; then
-		/sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
-		/sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+
+	# PPTP over DHCP
+	if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
+		iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
+		iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
 	fi
 
-	# run local firewall configuration, if present
- 	if [ -x /etc/sysconfig/firewall.local ]; then
-		/etc/sysconfig/firewall.local stop
+	# Orange pinholes
+	if [ "$ORANGE_DEV" != "" ]; then
+		# This rule enables a host on ORANGE network to connect to the outside
+		# (only if we have a red connection)
+		if [ "$IFACE" != "" ]; then
+			iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT
+		fi
 	fi
 
-	/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+	if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
+		# DHCP
+		if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
+			iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+			iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+		fi
+		if [ "$METHOD" == "DHCP"  -a "$PROTOCOL" == "RFC1483" ]; then
+			iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+			iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
+		fi
+
+		# Outgoing masquerading (don't masqerade IPSEC (mark 50))
+		iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
+		iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
 
-	if [ "$DROPINPUT" == "on" ]; then
-		/sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
-	fi
-	if [ "$DROPFORWARD" == "on" ]; then
-		/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
 	fi
-	/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
-	
+}
+
+# See how we were called.
+case "$1" in
+  start)
+	iptables_init
 	;;
-  stopovpn)
-	# stop openvpn
-	/usr/local/bin/openvpnctrl --delete-chains-and-rules
-        ;;
   reload)
 	iptables_red
-
 	# run local firewall configuration, if present
- 	if [ -x /etc/sysconfig/firewall.local ]; then
+	if [ -x /etc/sysconfig/firewall.local ]; then
 		/etc/sysconfig/firewall.local reload
 	fi
 	;;
   restart)
-	$0 stop
+	# run local firewall configuration, if present
+	if [ -x /etc/sysconfig/firewall.local ]; then
+		/etc/sysconfig/firewall.local stop
+	fi
 	$0 start
-	/usr/local/bin/forwardfwctrl
-	/usr/local/bin/openvpnctrl -s > /dev/null 2>&1
-	/usr/local/bin/openvpnctrl -sn2n > /dev/null 2>&1
 	;;
   *)
-        echo "Usage: $0 {start|stop|reload|restart}"
+        echo "Usage: $0 {start|reload|restart}"
         exit 1
 	;;
 esac