RE: Forward default "DROP" is not applied to ORANGE traffic?!

[oliver.fuhrer@bluewin.ch]

[-- Attachment #1: Type: text/plain, Size: 2752 bytes --]

Hi Michael,
I observed the same issue on my installations and I think it's coming from the following lines in /etc/rc.d/init.d/firewall:

413         # Orange pinholes
414         if [ "$ORANGE_DEV" != "" ]; then
415                 # This rule enables a host on ORANGE network to connect to the outside
416                 # (only if we have a red connection)
417                 if [ "$IFACE" != "" ]; then
418                         iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT
419                 fi
420         fi


Regards
Oliver


-----Original Message-----
From: Development <development-bounces(a)lists.ipfire.org> On Behalf Of Michael Tremer
Sent: Sunday, December 16, 2018 2:53 PM
To: Peter Müller <peter.mueller(a)link38.eu>
Cc: IPFire: Development-List <development(a)lists.ipfire.org>
Subject: Re: Forward default "DROP" is not applied to ORANGE traffic?!

Hey,

Could you dump the generated iptables ruleset?

I do not see anything that could potentially be a problem here that is causing your behaviour:

  https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=config/firewall/firewall-policy;h=078c3c515c31f1f385a2159f83fb5c6c52f5e89f;hb=HEAD

-Michael

> On 15 Dec 2018, at 16:36, Peter Müller <peter.mueller(a)link38.eu> wrote:
> 
> Hello list,
> 
> I recently stumbled across a strange behaviour of IPFire 2.x, which
> seems to be quite critical in my eyes, but I am not sure whether it is
> intentional or not.
> 
> Default settings of IPFire allow traffic from internal networks
> (GREEN, BLUE, ORANGE) to the internet (RED), as documented here:
> https://wiki.ipfire.org/configuration/firewall/default-policy
> 
> For several reasons, no direct internet access is desired on most
> firewall installations I administer, so setting the "default firewall
> behaviour" to DROP for both FORWARD and OUTGOING usually is one of
> the first steps after installation.
> 
> Speaking about GREEN and BLUE, this seems to work: No direct connection
> is possible except it has been explicitly allowed.
> 
> It turns out this setting does not apply to traffic from ORANGE: Even
> default is set to DROP, and no firewall rules allowing anything are
> in place, a server located in DMZ is able to reach full internet -
> every port on every IP in every country.
> 
> This is not my expectation of "default policy" = DROP after all!
> 
> Could somebody of the core developers urgently have a look at this, please?
> 
> Thanks, and best regards,
> Peter Müller
> -- 
> Microsoft DNS service terminates abnormally when it recieves a response
> to a DNS query that was never made.  Fix Information: Run your DNS
> service on a different platform.
> 		-- bugtraq