From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: Forward default "DROP" is not applied to ORANGE traffic?! Date: Sat, 05 Jan 2019 12:51:19 +0000 Message-ID: <0C6639EE-04B7-4C93-8AE3-E6042E8D20A5@ipfire.org> In-Reply-To: <5f24d29f-b012-4926-875d-8cf8bfbadc65@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1005175783771938421==" List-Id: --===============1005175783771938421== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, > On 4 Jan 2019, at 21:12, Peter M=C3=BCller wrot= e: >=20 > Hello Michael, >=20 > just a quick reminder on this. :-) I know it's still the very beginning > of the year... >=20 > If there are any questions, please drop me a line. Reminder of what? According to the code this is intentional. If you think that this should not be like this, please send a patch. -Michael > Thanks, and best regards, > Peter M=C3=BCller >=20 >=20 >> Hello Michael, >>=20 >> sorry for the late reply. >>=20 >> I will send you the output of "iptables -L -n -v" directly. >>=20 >> So far, I am able to reproduce this issue on two machines >> (both with default policy set to DROP). In both cases, adding >> a rule with source =3D ORANGE, destination =3D RED and action =3D DROP >> to the end of the firewall ruleset in the WebUI solved the >> problem. >>=20 >> So far, it seems like ORANGE is affected by this only. >>=20 >> Thanks, and best regards, >> Peter M=C3=BCller >>=20 >>> Hey, >>>=20 >>> Could you dump the generated iptables ruleset? >>>=20 >>> I do not see anything that could potentially be a problem here that is ca= using your behaviour: >>>=20 >>> https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dblob;f=3Dconfig/firewall/= firewall-policy;h=3D078c3c515c31f1f385a2159f83fb5c6c52f5e89f;hb=3DHEAD >>>=20 >>> -Michael >>>=20 >>>> On 15 Dec 2018, at 16:36, Peter M=C3=BCller = wrote: >>>>=20 >>>> Hello list, >>>>=20 >>>> I recently stumbled across a strange behaviour of IPFire 2.x, which >>>> seems to be quite critical in my eyes, but I am not sure whether it is >>>> intentional or not. >>>>=20 >>>> Default settings of IPFire allow traffic from internal networks >>>> (GREEN, BLUE, ORANGE) to the internet (RED), as documented here: >>>> https://wiki.ipfire.org/configuration/firewall/default-policy >>>>=20 >>>> For several reasons, no direct internet access is desired on most >>>> firewall installations I administer, so setting the "default firewall >>>> behaviour" to DROP for both FORWARD and OUTGOING usually is one of >>>> the first steps after installation. >>>>=20 >>>> Speaking about GREEN and BLUE, this seems to work: No direct connection >>>> is possible except it has been explicitly allowed. >>>>=20 >>>> It turns out this setting does not apply to traffic from ORANGE: Even >>>> default is set to DROP, and no firewall rules allowing anything are >>>> in place, a server located in DMZ is able to reach full internet - >>>> every port on every IP in every country. >>>>=20 >>>> This is not my expectation of "default policy" =3D DROP after all! >>>>=20 >>>> Could somebody of the core developers urgently have a look at this, plea= se? >>>>=20 >>>> Thanks, and best regards, >>>> Peter M=C3=BCller >>>> --=20 >>>> Microsoft DNS service terminates abnormally when it recieves a response >>>> to a DNS query that was never made. Fix Information: Run your DNS >>>> service on a different platform. >>>> -- bugtraq >>>=20 >>=20 > --=20 > Microsoft DNS service terminates abnormally when it recieves a response > to a DNS query that was never made. Fix Information: Run your DNS > service on a different platform. > -- bugtraq --===============1005175783771938421==--