From ff4770c79ba800a03fea65ffd5153f75e63cf2b8 Mon Sep 17 00:00:00 2001 From: Alexander Marx Date: Wed, 19 Jun 2013 13:31:40 +0200 Subject: [PATCH 1/1] Forward Firewall: changed /etc/init.d/firewall. deleted stop routine and rearranged iptables_init and restart routine Now it should be possible to use /etc/init.d/firewall restart without errors --- config/forwardfw/rules.pl | 4 +- src/initscripts/init.d/firewall | 167 ++++++++++++-------------------- 2 files changed, 65 insertions(+), 106 deletions(-) diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl index 12723e749..9f9f7e991 100755 --- a/config/forwardfw/rules.pl +++ b/config/forwardfw/rules.pl @@ -179,7 +179,7 @@ sub buildrules my $nat; my $fwaccessdport; foreach my $key (sort {$a <=> $b} keys %$hash){ - next if ($$hash{$key}[6] eq 'RED' && $conexists eq 'off' ); + next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' ); if ($$hash{$key}[28] eq 'ON'){ $command='iptables -t nat -A'; $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]); @@ -228,7 +228,7 @@ sub buildrules $targethash{$key}[0]='0.0.0.0/0'; } if($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1'){ - open(FILE, "/var/ipfire/red/local-ipaddress") or die 'Unable to open config file.'; + open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress"; $targethash{$key}[0]= ; close(FILE); }else{ diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index 5a8cfb171..844cbf6d5 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -73,70 +73,6 @@ iptables_init() { /sbin/iptables -A INPUT -j BADTCP /sbin/iptables -A FORWARD -j BADTCP -} - -iptables_red() { - /sbin/iptables -F REDINPUT - /sbin/iptables -F REDFORWARD - /sbin/iptables -t nat -F REDNAT - - # PPPoE / PPTP Device - if [ "$IFACE" != "" ]; then - # PPPoE / PPTP - if [ "$DEVICE" != "" ]; then - /sbin/iptables -A REDINPUT -i $DEVICE -j ACCEPT - fi - if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then - if [ "$RED_DEV" != "" ]; then - /sbin/iptables -A REDINPUT -i $RED_DEV -j ACCEPT - fi - fi - fi - - # PPTP over DHCP - if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then - /sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT - /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT - fi - - # Orange pinholes - if [ "$ORANGE_DEV" != "" ]; then - # This rule enables a host on ORANGE network to connect to the outside - # (only if we have a red connection) - if [ "$IFACE" != "" ]; then - /sbin/iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT - fi - fi - - if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then - # DHCP - if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then - /sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT - /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT - fi - if [ "$METHOD" == "DHCP" -a "$PROTOCOL" == "RFC1483" ]; then - /sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT - /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT - fi - - # Outgoing masquerading (don't masqerade IPSEC (mark 50)) - /sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN - /sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE - - fi -} - -# See how we were called. -case "$1" in - start) - iptables_init - - # Limit Packets- helps reduce dos/syn attacks - # original do nothing line - #/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec - # the correct one, but the negative '!' do nothing... - #/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN ! -m limit --limit 10/sec -j DROP - # Fix for braindead ISP's /sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu @@ -273,6 +209,12 @@ case "$1" in /etc/sysconfig/firewall.local start fi + # run openvpn + /usr/local/bin/openvpnctrl --create-chains-and-rules + + # run wirelessctrl + /usr/local/bin/wirelessctrl + #POLICY CHAIN /sbin/iptables -N POLICYIN /sbin/iptables -A INPUT -j POLICYIN @@ -283,6 +225,9 @@ case "$1" in /usr/sbin/firewall-policy + # read new firewall + /usr/local/bin/forwardfwctrl + if [ "$DROPINPUT" == "on" ]; then /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT" fi @@ -291,66 +236,80 @@ case "$1" in /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD" fi /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD" - ;; - startovpn) - # run openvpn - /usr/local/bin/openvpnctrl --create-chains-and-rules - ;; - stop) - iptables_init - # Accept everyting connected - /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT +} - # localhost and ethernet. - /sbin/iptables -A INPUT -i lo -j ACCEPT - /sbin/iptables -A INPUT -i $GREEN_DEV -m state --state NEW -j ACCEPT +iptables_red() { + /sbin/iptables -F REDINPUT + /sbin/iptables -F REDFORWARD + /sbin/iptables -t nat -F REDNAT - if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then - /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT - /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT + # PPPoE / PPTP Device + if [ "$IFACE" != "" ]; then + # PPPoE / PPTP + if [ "$DEVICE" != "" ]; then + /sbin/iptables -A REDINPUT -i $DEVICE -j ACCEPT + fi + if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then + if [ "$RED_DEV" != "" ]; then + /sbin/iptables -A REDINPUT -i $RED_DEV -j ACCEPT + fi + fi fi - if [ "$PROTOCOL" == "RFC1483" -a "$METHOD" == "DHCP" ]; then - /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT - /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT + + # PPTP over DHCP + if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then + /sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT + /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT fi - # run local firewall configuration, if present - if [ -x /etc/sysconfig/firewall.local ]; then - /etc/sysconfig/firewall.local stop + # Orange pinholes + if [ "$ORANGE_DEV" != "" ]; then + # This rule enables a host on ORANGE network to connect to the outside + # (only if we have a red connection) + if [ "$IFACE" != "" ]; then + /sbin/iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT + fi fi - /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT" + if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then + # DHCP + if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then + /sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT + /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT + fi + if [ "$METHOD" == "DHCP" -a "$PROTOCOL" == "RFC1483" ]; then + /sbin/iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT + /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT + fi + + # Outgoing masquerading (don't masqerade IPSEC (mark 50)) + /sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN + /sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE - if [ "$DROPINPUT" == "on" ]; then - /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT" - fi - if [ "$DROPFORWARD" == "on" ]; then - /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD" fi - /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_FORWARD" - +} + +# See how we were called. +case "$1" in + start) + iptables_init ;; - stopovpn) - # stop openvpn - /usr/local/bin/openvpnctrl --delete-chains-and-rules - ;; reload) iptables_red - # run local firewall configuration, if present - if [ -x /etc/sysconfig/firewall.local ]; then + if [ -x /etc/sysconfig/firewall.local ]; then /etc/sysconfig/firewall.local reload fi ;; restart) - $0 stop + # run local firewall configuration, if present + if [ -x /etc/sysconfig/firewall.local ]; then + /etc/sysconfig/firewall.local stop + fi $0 start - /usr/local/bin/forwardfwctrl - /usr/local/bin/openvpnctrl -s > /dev/null 2>&1 - /usr/local/bin/openvpnctrl -sn2n > /dev/null 2>&1 ;; *) - echo "Usage: $0 {start|stop|reload|restart}" + echo "Usage: $0 {start|reload|restart}" exit 1 ;; esac -- 2.39.2