Forward Firewall: fixed wrong log Entries INPUT_DROP when connected via Web or ssh
authorAlexander Marx <amarx@ipfire.org>
Tue, 7 May 2013 10:02:17 +0000 (12:02 +0200)
committerMichael Tremer <michael.tremer@ipfire.org>
Fri, 9 Aug 2013 12:13:12 +0000 (14:13 +0200)
src/initscripts/init.d/firewall

index ca183405147cb278fd235152d6336dab82c0d2b1..183ff5ba2fd7b2349ad60bac370229bcfe341bb1 100644 (file)
@@ -267,6 +267,16 @@ case "$1" in
                /etc/sysconfig/firewall.local start
        fi
        
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT_a"
+
+       if [ "$DROPINPUT" == "on" ]; then
+               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT_b"
+       fi
+       if [ "$DROPFORWARD" == "on" ]; then
+               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
+       fi
+       /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"
+
        #POLICY CHAIN
        /sbin/iptables -N POLICYIN
        /sbin/iptables -A INPUT -j POLICYIN
@@ -303,12 +313,14 @@ case "$1" in
        if [ -x /etc/sysconfig/firewall.local ]; then
                /etc/sysconfig/firewall.local stop
        fi
+
        /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
+
        if [ "$DROPINPUT" == "on" ]; then
-               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
+               /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
        fi
        if [ "$DROPFORWARD" == "on" ]; then
-               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
+               /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
        fi
        /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD"