diff mbox series

[04/11] firewall: Prevent spoofing our own RED IP address

Message ID cefdbc89-1f80-456f-cb51-5740336d000a@ipfire.org
State Accepted
Commit e83ae0d43406ad6d988f2ea56d4dbfc6da1bab90
Headers
Series firewall: Introduce DROP_HOSTILE and improve spoofing logging/protection |

Commit Message

Peter Müller Dec. 18, 2021, 1:48 p.m. UTC 
  There is no legitimate reason why traffic from our own IP address on RED
should ever appear incoming on that interface.

This prevents attackers from impersonating IPFire itself, and is only
cleared/reset if the RED interface is brought up. Therefore, an attacker
cannot bypass this by foring a dial-up or DHCP connection to break down.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 src/initscripts/system/firewall | 11 +++++++++++
 1 file changed, 11 insertions(+)
diff mbox series

Patch

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 1c62c6e2c..9e62c0245 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -374,6 +374,17 @@  iptables_red_up() {
 	iptables -F REDFORWARD
 	iptables -t nat -F REDNAT
 
+	# Prohibit spoofing our own IP address on RED
+	if [ -f /var/ipfire/red/active ]; then
+		REDIP="$( cat /var/ipfire/red/local-ipaddress )";
+
+		if [ "$IFACE" != "" ]; then
+			iptables -A REDINPUT -s $REDIP -i $IFACE -j SPOOFED_MARTIAN
+		elif [ "$DEVICE" != "" ]; then
+			iptables -A REDINPUT -s $REDIP -i $DEVICE -j SPOOFED_MARTIAN
+		fi
+	fi
+
 	# PPPoE / PPTP Device
 	if [ "$IFACE" != "" ]; then
 		# PPPoE / PPTP