From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@link38.eu>
To: development@lists.ipfire.org
Subject: Forward default "DROP" is not applied to ORANGE traffic?!
Date: Sat, 15 Dec 2018 17:36:41 +0100
Message-ID: <52f6a8c0-7faf-d8ae-1261-996fe91e2e4d@link38.eu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============9078794615186866017=="
List-Id: <development.lists.ipfire.org>

--===============9078794615186866017==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Hello list,

I recently stumbled across a strange behaviour of IPFire 2.x, which
seems to be quite critical in my eyes, but I am not sure whether it is
intentional or not.

Default settings of IPFire allow traffic from internal networks
(GREEN, BLUE, ORANGE) to the internet (RED), as documented here:
https://wiki.ipfire.org/configuration/firewall/default-policy

For several reasons, no direct internet access is desired on most
firewall installations I administer, so setting the "default firewall
behaviour" to DROP for both FORWARD and OUTGOING usually is one of
the first steps after installation.

Speaking about GREEN and BLUE, this seems to work: No direct connection
is possible except it has been explicitly allowed.

It turns out this setting does not apply to traffic from ORANGE: Even
default is set to DROP, and no firewall rules allowing anything are
in place, a server located in DMZ is able to reach full internet -
every port on every IP in every country.

This is not my expectation of "default policy" = DROP after all!

Could somebody of the core developers urgently have a look at this, please?

Thanks, and best regards,
Peter Müller
-- 
Microsoft DNS service terminates abnormally when it recieves a response
to a DNS query that was never made.  Fix Information: Run your DNS
service on a different platform.
		-- bugtraq

--===============9078794615186866017==--