Forward Firewall: changed order of LOG and DROP rules for INPUT Chain
authorAlexander Marx <amarx@ipfire.org>
Mon, 17 Jun 2013 08:21:24 +0000 (10:21 +0200)
committerMichael Tremer <michael.tremer@ipfire.org>
Fri, 9 Aug 2013 12:15:28 +0000 (14:15 +0200)
src/initscripts/init.d/firewall

index a7d258a5643dd4eabb64c659ba5e3b3650cd2616..5a8cfb171e0437c41beda131def6ec2c7eb0e9c0 100644 (file)
@@ -283,11 +283,10 @@ case "$1" in
 
        /usr/sbin/firewall-policy
 
-       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
-
        if [ "$DROPINPUT" == "on" ]; then
                /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT"
        fi
+       /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
        if [ "$DROPFORWARD" == "on" ]; then
                /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD"
        fi