Forward Firewall: reordered some rules to get rid of INPUT_DROP messages in log when...

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index df8405b520ab8371ea8a3ca8ae827ce636a6ee44..ca183405147cb278fd235152d6336dab82c0d2b1 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -303,11 +303,10 @@ case "$1" in
        if [ -x /etc/sysconfig/firewall.local ]; then
                /etc/sysconfig/firewall.local stop
        fi
        if [ -x /etc/sysconfig/firewall.local ]; then
                /etc/sysconfig/firewall.local stop
        fi

-
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"

        if [ "$DROPINPUT" == "on" ]; then
                /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
        fi
        if [ "$DROPINPUT" == "on" ]; then
                /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
        fi

-       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"

        if [ "$DROPFORWARD" == "on" ]; then
                /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
        fi
        if [ "$DROPFORWARD" == "on" ]; then
                /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
        fi