From: Michael Tremer <michael.tremer@ipfire.org>
Date: Sat, 1 Mar 2014 15:44:05 +0000 (+0100)
Subject: firewall: Make sure that only packets that go through the tunnel are passing OVPNBLOCK.
X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=commitdiff_plain;h=a0a5c14f8525a2885e985b56d8ac360358b4c726

firewall: Make sure that only packets that go through the tunnel are passing OVPNBLOCK.
---

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index de2a04b7d..dd6788937 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -106,9 +106,10 @@ iptables_init() {
 
 	# Block OpenVPN transfer networks
 	iptables -N OVPNBLOCK
-	for i in INPUT FORWARD; do
-		iptables -A ${i} -j OVPNBLOCK
-	done
+	iptables -A INPUT   -i tun+ -j OVPNBLOCK
+	iptables -A OUTPUT  -o tun+ -j OVPNBLOCK
+	iptables -A FORWARD -i tun+ -j OVPNBLOCK
+	iptables -A FORWARD -o tun+ -j OVPNBLOCK
 
 	# OpenVPN transfer network translation
 	iptables -t nat -N OVPNNAT