Some smaller enhancements for the firewall script

git-svn-id: http://svn.ipfire.org/svn/ipfire/branches/2.1/trunk@1135 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8

diff --git a/config/rootfiles/core/4/files b/config/rootfiles/core/4/files
index c4f79caf42bbad4111166a89cb9f08bbd59bae69..47703c959892613a6eaeaa82cc00519af4aaec46 100644 (file)
--- a/config/rootfiles/core/4/files
+++ b/config/rootfiles/core/4/files
@@ -1,4 +1,5 @@
 etc/inid.d/firewall
+usr/local/bin/makegraphs
 var/ipfire/langs
 var/ipfire/optionsfw/settings
 var/ipfire/menu.d/50-firewall.menu

diff --git a/html/cgi-bin/logs.cgi/log.dat b/html/cgi-bin/logs.cgi/log.dat
index 3c408a78fa25feee2efaee7be0b6d11bd483f753..f443a05764e063d7f281addcd96bb29a06180ac1 100644 (file)
--- a/html/cgi-bin/logs.cgi/log.dat
+++ b/html/cgi-bin/logs.cgi/log.dat
@@ -50,7 +50,7 @@ my $year = $now[5]+1900;
 $cgiparams{'DAY'} = $now[3];
 $cgiparams{'MONTH'} = $now[4];
 $cgiparams{'ACTION'} = '';
-$cgiparams{'SECTION'} = 'kernel';
+$cgiparams{'SECTION'} = 'ipfire';
 
 my %sections = (
         'ipfire' => '(ipfire: )',
@@ -61,7 +61,7 @@ my %sections = (
         'ntp' => '(ntpd(?:ate)?\[.*\]: )',
         'ssh' => '(sshd(?:\(.*\))?\[.*\]: )',
         'auth' => '(\w+\(pam_unix\)\[.*\]: )',
-        'kernel' => '(kernel: (?!DROP-))',
+        'kernel' => '(kernel: (?!DROP_))',
         'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |vpnwatch: )',
         'openvpn' => '(openvpnserver)\[.*\]: '
         );

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index a5ffdc03e784900a0ff0aa1055062363e42cf2ad..d7b0ea6d839a6f74e9fb1c7a84bc408adb945b2a 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -2,7 +2,6 @@
 
 eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
-eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
 IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
 
 if [ -f /var/ipfire/red/device ]; then
@@ -35,20 +34,20 @@ iptables_init() {
        # of flags might indicate a port-scan attempt (xmas, null, etc)
        /sbin/iptables -N PSCAN
        if [ "$DROPPORTSCAN" == "on" ]; then
-               /sbin/iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix "DROP-TCP Scan " -m comment --comment "DROP-TCP PScan"
-               /sbin/iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix "DROP-UDP Scan " -m comment --comment "DROP-UPD PScan"
-               /sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP-ICMP Scan " -m comment --comment "DROP-ICMP PScan"
-               /sbin/iptables -A PSCAN -f      -m limit --limit 10/minute -j LOG --log-prefix "DROP-FRAG Scan " -m comment --comment "DROP-FRAG PScan"
+               /sbin/iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan"
+               /sbin/iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UPD PScan"
+               /sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
+               /sbin/iptables -A PSCAN -f      -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
        fi
-       /sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP PScan"
+       /sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
 
        # New tcp packets without SYN set - could well be an obscure type of port scan
        # that's not covered above, may just be a broken windows machine
        /sbin/iptables -N NEWNOTSYN
        if [ "$DROPNEWNOTSYN" == "on" ]; then
-               /sbin/iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-prefix "DROP-NEW not SYN " -m comment --comment "DROP-NEW not SYN"
+               /sbin/iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-prefix "DROP_NEWNOTSYN "
        fi
-       /sbin/iptables -A NEWNOTSYN  -j DROP
+       /sbin/iptables -A NEWNOTSYN  -j DROP -m comment --comment "DROP_NEWNOTSYN"
 
        # Chain to contain all the rules relating to bad TCP flags
        /sbin/iptables -N BADTCP
@@ -262,11 +261,13 @@ case "$1" in
        # last rule in input and forward chain is for logging.
 
        if [ "$DROPINPUT" == "on" ]; then
-               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP-INPUT "  -m comment --comment "DROP-INPUT"
+               /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
        fi
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
        if [ "$DROPOUTPUT" == "on" ]; then
-               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP-OUTPUT "  -m comment --comment "DROP-OUTPUT"
+               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT "
        fi
+       /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT"
         ;;
   startovpn)  
        # run openvpn
@@ -296,11 +297,13 @@ case "$1" in
        fi
 
        if [ "$DROPINPUT" == "on" ]; then
-               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP-INPUT "  -m comment --comment "DROP-INPUT"
+               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
        fi
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
        if [ "$DROPOUTPUT" == "on" ]; then
-               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP-OUTPUT "  -m comment --comment "DROP-OUTPUT"
+               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT "
        fi
+       /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT"
         ;;
   stopovpn)
        # stop openvpn

diff --git a/src/scripts/makegraphs b/src/scripts/makegraphs
index 9cce21a931e1493ec76d36a34f6985ec2f7e1ef0..53daccc888ad52fdd1ea6be34b02bcb61b3e7d6d 100644 (file)
--- a/src/scripts/makegraphs
+++ b/src/scripts/makegraphs
@@ -277,7 +277,7 @@ sub updatefwhitsdata {
        $aktuell = 0;
        if (!$skip) {
                while (<FILE>) {
-                       if (/kernel:.*(IN=.*)$/) {$aktuell++;}
+                       if (/kernel: DROP_INPUT.*$/) {$aktuell++;}
                }
                close (FILE);
        }