diff mbox series

[06/12] rules.pl: Move to ipset based data for LOCATIONBLOCK feature.

Message ID 20220214184257.2406-6-stefan.schantl@ipfire.org
State Accepted
Commit 0df1d268edc94df13f6f5e610e69a2bd63d79918
Headers
Series [01/12] location-functions.pl: Rename and set the location for exported databases to "/var/lib/location/ipset/". |

Commit Message

Stefan Schantl Feb. 14, 2022, 6:42 p.m. UTC 
  Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 config/firewall/rules.pl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Peter Müller Feb. 14, 2022, 9:03 p.m. UTC | #1 
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>

> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
>  config/firewall/rules.pl | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
> index 5b1153b08..e009c1838 100644
> --- a/config/firewall/rules.pl
> +++ b/config/firewall/rules.pl
> @@ -671,7 +671,11 @@ sub locationblock {
>  	# is enabled.
>  	foreach my $location (@locations) {
>  		if(exists $locationsettings{$location} && $locationsettings{$location} eq "on") {
> -			run("$IPTABLES -A LOCATIONBLOCK -m geoip --src-cc $location -j DROP");
> +			# Call function to load the networks list for this country.
> +			&ipset_restore($location);
> +
> +			# Call iptables and create rule to use the loaded ipset list.
> +			run("$IPTABLES -A LOCATIONBLOCK -m set --match-set CC_$location src -j DROP");
>  		}
>  	}
>  }
Michael Tremer Feb. 15, 2022, 12:40 p.m. UTC | #2 
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

> On 14 Feb 2022, at 18:42, Stefan Schantl <stefan.schantl@ipfire.org> wrote:
> 
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
> config/firewall/rules.pl | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
> index 5b1153b08..e009c1838 100644
> --- a/config/firewall/rules.pl
> +++ b/config/firewall/rules.pl
> @@ -671,7 +671,11 @@ sub locationblock {
> 	# is enabled.
> 	foreach my $location (@locations) {
> 		if(exists $locationsettings{$location} && $locationsettings{$location} eq "on") {
> -			run("$IPTABLES -A LOCATIONBLOCK -m geoip --src-cc $location -j DROP");
> +			# Call function to load the networks list for this country.
> +			&ipset_restore($location);
> +
> +			# Call iptables and create rule to use the loaded ipset list.
> +			run("$IPTABLES -A LOCATIONBLOCK -m set --match-set CC_$location src -j DROP");
> 		}
> 	}
> }
> -- 
> 2.30.2
>
diff mbox series

Patch

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 5b1153b08..e009c1838 100644
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -671,7 +671,11 @@  sub locationblock {
 	# is enabled.
 	foreach my $location (@locations) {
 		if(exists $locationsettings{$location} && $locationsettings{$location} eq "on") {
-			run("$IPTABLES -A LOCATIONBLOCK -m geoip --src-cc $location -j DROP");
+			# Call function to load the networks list for this country.
+			&ipset_restore($location);
+
+			# Call iptables and create rule to use the loaded ipset list.
+			run("$IPTABLES -A LOCATIONBLOCK -m set --match-set CC_$location src -j DROP");
 		}
 	}
 }