Deleted no longer used 'if' clauses (ALG) from firewall init
Commit Message
In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25
all ALGs were removed from UI.
But they remained - somehow - in the initscript (firewall).
I tried to remove the remnants - hopefully in the correct way.
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
---
src/initscripts/system/firewall | 65 +--------------------------------
1 file changed, 1 insertion(+), 64 deletions(-)
Comments
Hello Matthias,
thank you for this patch - removing the remains of ALGs has been on my to-do list as well... :-)
I agree with the changes you propose to the firewall initscript. However, there are still some ALG-related
configuration files left, and we continue to ship the corresponding kernel modules.
While the latter might be worth a separate patch as soon as Linux 5.10 landed in IPFire 2.x, cleaning
up the rest of ALG bits and pieces as much as we can makes sense to me.
Acked-by: Peter Müller <peter.mueller@ipfire.org>
Thanks, and best regards,
Peter Müller
> In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25
> all ALGs were removed from UI.
>
> But they remained - somehow - in the initscript (firewall).
>
> I tried to remove the remnants - hopefully in the correct way.
>
> Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
> ---
> src/initscripts/system/firewall | 65 +--------------------------------
> 1 file changed, 1 insertion(+), 64 deletions(-)
>
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
> index dd9f1a484..1e558ee86 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -98,74 +98,11 @@ iptables_init() {
> iptables -t raw -N CONNTRACK
> iptables -t raw -A PREROUTING -j CONNTRACK
>
> - # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
> + # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
>
> # GRE (always enabled)
> modprobe nf_conntrack_proto_gre
>
> - # SIP
> - if [ "${CONNTRACK_SIP}" = "on" ]; then
> - modprobe nf_nat_sip
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper sip -j ACCEPT
> - for proto in udp tcp; do
> - iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
> - done
> - fi
> -
> - # H.323
> - if [ "${CONNTRACK_H323}" = "on" ]; then
> - modprobe nf_nat_h323
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper h323 -j ACCEPT
> -
> - # Gatekeeper RAS
> - iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
> -
> - # Q.931
> - iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
> - fi
> -
> - # FTP
> - if [ "${CONNTRACK_FTP}" = "on" ]; then
> - modprobe nf_nat_ftp
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
> - fi
> -
> - # PPTP
> - if [ "${CONNTRACK_PPTP}" = "on" ]; then
> - modprobe nf_nat_pptp
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper pptp -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
> - fi
> -
> - # TFTP
> - if [ "${CONNTRACK_TFTP}" = "on" ]; then
> - modprobe nf_nat_tftp
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper tftp -j ACCEPT
> - iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
> - fi
> -
> - # IRC
> - if [ "${CONNTRACK_IRC}" = "on" ]; then
> - modprobe nf_nat_irc
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper irc -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
> - fi
> -
> - # Amanda
> - if [ "${CONNTRACK_AMANDA}" = "on" ]; then
> - modprobe nf_nat_amanda
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper amanda -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
> - fi
> -
> # Fix for braindead ISPs
> iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
>
>
Hello,
They were left intentionally so that people could re-enable the ALGs if there was not other solution available.
Since the migration seemed to have worked well, I would suggest that we merge this and drop the kernel modules with the next kernel update.
> On 30 May 2021, at 18:59, Peter Müller <peter.mueller@ipfire.org> wrote:
>
> Hello Matthias,
>
> thank you for this patch - removing the remains of ALGs has been on my to-do list as well... :-)
>
> I agree with the changes you propose to the firewall initscript. However, there are still some ALG-related
> configuration files left, and we continue to ship the corresponding kernel modules.
Which are those?
> While the latter might be worth a separate patch as soon as Linux 5.10 landed in IPFire 2.x, cleaning
> up the rest of ALG bits and pieces as much as we can makes sense to me.
>
> Acked-by: Peter Müller <peter.mueller@ipfire.org>
>
> Thanks, and best regards,
> Peter Müller
>
>> In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25
>> all ALGs were removed from UI.
>>
>> But they remained - somehow - in the initscript (firewall).
>>
>> I tried to remove the remnants - hopefully in the correct way.
>>
>> Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
>> ---
>> src/initscripts/system/firewall | 65 +--------------------------------
>> 1 file changed, 1 insertion(+), 64 deletions(-)
>>
>> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
>> index dd9f1a484..1e558ee86 100644
>> --- a/src/initscripts/system/firewall
>> +++ b/src/initscripts/system/firewall
>> @@ -98,74 +98,11 @@ iptables_init() {
>> iptables -t raw -N CONNTRACK
>> iptables -t raw -A PREROUTING -j CONNTRACK
>>
>> - # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
>> + # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
>>
>> # GRE (always enabled)
>> modprobe nf_conntrack_proto_gre
>>
>> - # SIP
>> - if [ "${CONNTRACK_SIP}" = "on" ]; then
>> - modprobe nf_nat_sip
>> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
>> - -m helper --helper sip -j ACCEPT
>> - for proto in udp tcp; do
>> - iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
>> - done
>> - fi
>> -
>> - # H.323
>> - if [ "${CONNTRACK_H323}" = "on" ]; then
>> - modprobe nf_nat_h323
>> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
>> - -m helper --helper h323 -j ACCEPT
>> -
>> - # Gatekeeper RAS
>> - iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
>> -
>> - # Q.931
>> - iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
>> - fi
>> -
>> - # FTP
>> - if [ "${CONNTRACK_FTP}" = "on" ]; then
>> - modprobe nf_nat_ftp
>> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
>> - -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
>> - iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
>> - fi
>> -
>> - # PPTP
>> - if [ "${CONNTRACK_PPTP}" = "on" ]; then
>> - modprobe nf_nat_pptp
>> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
>> - -m helper --helper pptp -j ACCEPT
>> - iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
>> - fi
>> -
>> - # TFTP
>> - if [ "${CONNTRACK_TFTP}" = "on" ]; then
>> - modprobe nf_nat_tftp
>> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
>> - -m helper --helper tftp -j ACCEPT
>> - iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
>> - fi
>> -
>> - # IRC
>> - if [ "${CONNTRACK_IRC}" = "on" ]; then
>> - modprobe nf_nat_irc
>> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
>> - -m helper --helper irc -j ACCEPT
>> - iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
>> - fi
>> -
>> - # Amanda
>> - if [ "${CONNTRACK_AMANDA}" = "on" ]; then
>> - modprobe nf_nat_amanda
>> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
>> - -m helper --helper amanda -j ACCEPT
>> - iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
>> - fi
>> -
>> # Fix for braindead ISPs
>> iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
>>
>>
@@ -98,74 +98,11 @@ iptables_init() {
iptables -t raw -N CONNTRACK
iptables -t raw -A PREROUTING -j CONNTRACK
- # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
+ # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
# GRE (always enabled)
modprobe nf_conntrack_proto_gre
- # SIP
- if [ "${CONNTRACK_SIP}" = "on" ]; then
- modprobe nf_nat_sip
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper sip -j ACCEPT
- for proto in udp tcp; do
- iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
- done
- fi
-
- # H.323
- if [ "${CONNTRACK_H323}" = "on" ]; then
- modprobe nf_nat_h323
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper h323 -j ACCEPT
-
- # Gatekeeper RAS
- iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
-
- # Q.931
- iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
- fi
-
- # FTP
- if [ "${CONNTRACK_FTP}" = "on" ]; then
- modprobe nf_nat_ftp
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
- fi
-
- # PPTP
- if [ "${CONNTRACK_PPTP}" = "on" ]; then
- modprobe nf_nat_pptp
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper pptp -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
- fi
-
- # TFTP
- if [ "${CONNTRACK_TFTP}" = "on" ]; then
- modprobe nf_nat_tftp
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper tftp -j ACCEPT
- iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
- fi
-
- # IRC
- if [ "${CONNTRACK_IRC}" = "on" ]; then
- modprobe nf_nat_irc
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper irc -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
- fi
-
- # Amanda
- if [ "${CONNTRACK_AMANDA}" = "on" ]; then
- modprobe nf_nat_amanda
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper amanda -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
- fi
-
# Fix for braindead ISPs
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu