From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: Re: Forward default "DROP" is not applied to ORANGE traffic?! Date: Fri, 04 Jan 2019 22:12:31 +0100 Message-ID: <5f24d29f-b012-4926-875d-8cf8bfbadc65@link38.eu> In-Reply-To: <6e465ff2-a0e2-2a9c-8d49-82524459724b@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6963298473773245487==" List-Id: --===============6963298473773245487== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Michael, just a quick reminder on this. :-) I know it's still the very beginning of the year... If there are any questions, please drop me a line. Thanks, and best regards, Peter M=C3=BCller > Hello Michael, >=20 > sorry for the late reply. >=20 > I will send you the output of "iptables -L -n -v" directly. >=20 > So far, I am able to reproduce this issue on two machines > (both with default policy set to DROP). In both cases, adding > a rule with source =3D ORANGE, destination =3D RED and action =3D DROP > to the end of the firewall ruleset in the WebUI solved the > problem. >=20 > So far, it seems like ORANGE is affected by this only. >=20 > Thanks, and best regards, > Peter M=C3=BCller >=20 >> Hey, >> >> Could you dump the generated iptables ruleset? >> >> I do not see anything that could potentially be a problem here that is cau= sing your behaviour: >> >> https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dblob;f=3Dconfig/firewall/= firewall-policy;h=3D078c3c515c31f1f385a2159f83fb5c6c52f5e89f;hb=3DHEAD >> >> -Michael >> >>> On 15 Dec 2018, at 16:36, Peter M=C3=BCller w= rote: >>> >>> Hello list, >>> >>> I recently stumbled across a strange behaviour of IPFire 2.x, which >>> seems to be quite critical in my eyes, but I am not sure whether it is >>> intentional or not. >>> >>> Default settings of IPFire allow traffic from internal networks >>> (GREEN, BLUE, ORANGE) to the internet (RED), as documented here: >>> https://wiki.ipfire.org/configuration/firewall/default-policy >>> >>> For several reasons, no direct internet access is desired on most >>> firewall installations I administer, so setting the "default firewall >>> behaviour" to DROP for both FORWARD and OUTGOING usually is one of >>> the first steps after installation. >>> >>> Speaking about GREEN and BLUE, this seems to work: No direct connection >>> is possible except it has been explicitly allowed. >>> >>> It turns out this setting does not apply to traffic from ORANGE: Even >>> default is set to DROP, and no firewall rules allowing anything are >>> in place, a server located in DMZ is able to reach full internet - >>> every port on every IP in every country. >>> >>> This is not my expectation of "default policy" =3D DROP after all! >>> >>> Could somebody of the core developers urgently have a look at this, pleas= e? >>> >>> Thanks, and best regards, >>> Peter M=C3=BCller >>> --=20 >>> Microsoft DNS service terminates abnormally when it recieves a response >>> to a DNS query that was never made. Fix Information: Run your DNS >>> service on a different platform. >>> -- bugtraq >> >=20 --=20 Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq --===============6963298473773245487==--