From patchwork Thu Feb 7 08:00:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 2071 Return-Path: Received: from mail01.ipfire.org (unknown [172.28.1.200]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail01.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web07.i.ipfire.org (Postfix) with ESMTPS id 074B488B609 for ; Wed, 6 Feb 2019 21:00:55 +0000 (GMT) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 43vv4616sCz5JKcN; Wed, 6 Feb 2019 21:00:54 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1549486854; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:list-id:list-unsubscribe:list-subscribe:list-post; bh=7a7Kok1YsSJON0paOw6OtEIxT+KEZD7/aeb+i6AEri0=; b=m7x+SDo77UBTjeqeSMl4BdKSgm7NfZntfx0PLS8p05nGQvv2TeoD9iqmSf54FHyha2HG1R uhK35Ox+FqYKQC1n1Rr+lxcZzzpSW2dF6p2Zg5OdbV8sZnopz/4/A0DuFgt/ozqJeMIEUC 9flSl0OqU2Fv6QetMU6P36eqss8bfXI5NlIlbcAvqDLv/gmEZjV62t6bg2GCzLbPZW+YOm Ujy8ox0Q4NTWIDikbt0pfJH5VSOgpRKYu4Ykj+eHnVLWJojWxWvVQMRcn6XHLTb1A/NcFu ZM+b+Use/sk4JKm+buvRp9rCcpPmtcnjVslO5Q9qe/ZsrrktnMXubOoSuK2xSA== Received: from [127.0.0.1] (tor2.anonymizer.ccc.de [217.115.10.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 43vv430XWZz5JHxq; Wed, 6 Feb 2019 21:00:50 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1549486851; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=7a7Kok1YsSJON0paOw6OtEIxT+KEZD7/aeb+i6AEri0=; b=L35pVeyN564fQFFbeW+0O6ec08ahBU2alI3iAlSi/mwYbIlBsgtk8pMBeQrzwKioKdMLhC NysKn25/PYkTMCdNMdSxEeqCz8dCWheeJxRBMiNJpGlB4L4N5mWXwgg9iM2R36S/Usp64u T5mHNAs4J2By+2MuwAegf79XadBjicm8VEDMfq52S1nxHkHd9NBnPYfnOnxA+HlTXArM2d Xtv6Iucp/B128cfPVl2HjL72TohzberYk7C/CC49L/jQzrri2yjwbl0/L2HlxyJVgb5tbc /F3GpI/LGJph0og0yS395wZyC4RMFWJgi+PrZSHZFYGvAMQCtKB+gDTD1dEc5Q== To: "IPFire: Development-List" , Michael Tremer , Oliver Fuhrer From: =?utf-8?q?Peter_M=C3=BCller?= Organization: IPFire.org Subject: [PATCH] apply default firewall policy for ORANGE, too Message-ID: Date: Wed, 06 Feb 2019 21:00:00 +0000 MIME-Version: 1.0 Content-Language: en-US Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=pmueller smtp.mailfrom=peter.mueller@ipfire.org X-Spamd-Result: default: False [-5.44 / 11.00]; ARC_NA(0.00)[]; BAYES_HAM(-3.00)[100.00%]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; HAS_ORG_HEADER(0.00)[]; DKIM_SIGNED(0.00)[]; TO_DN_ALL(0.00)[]; NEURAL_HAM(-2.34)[-0.778,0]; RCVD_COUNT_ZERO(0.00)[0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:31078, ipnet:217.115.0.0/20, country:DE]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_TLS_ALL(0.00)[] X-Spam-Status: No, score=-5.44 X-Rspamd-Server: mail01.i.ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" If firewall default policy is set to DROP, this setting was not applied to outgoing ORANGE traffic as well, which was misleading. Fixes #11973 Signed-off-by: Peter Müller Cc: Michael Tremer Cc: Oliver Fuhrer --- src/initscripts/system/firewall | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 707209987..b9dd3485e 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -294,7 +294,7 @@ iptables_init() { iptables -N OVPNINPUT iptables -A INPUT -j OVPNINPUT - # TOR + # Tor iptables -N TOR_INPUT iptables -A INPUT -j TOR_INPUT @@ -414,15 +414,6 @@ iptables_red_up() { iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT fi - # Orange pinholes - if [ "$ORANGE_DEV" != "" ]; then - # This rule enables a host on ORANGE network to connect to the outside - # (only if we have a red connection) - if [ "$IFACE" != "" ]; then - iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT - fi - fi - if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then # DHCP if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then @@ -470,7 +461,7 @@ iptables_red_up() { iptables_red_down() { # Prohibit packets to reach the masquerading rule - # while the wan interface is down - this is required to + # while the WAN interface is down - this is required to # circumvent udp related NAT issues # http://forum.ipfire.org/index.php?topic=11127.0 if [ -n "${IFACE}" ]; then