From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: Re: Forward default "DROP" is not applied to ORANGE traffic?! Date: Sun, 23 Dec 2018 16:31:21 +0100 Message-ID: <6e465ff2-a0e2-2a9c-8d49-82524459724b@link38.eu> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2150571918835121717==" List-Id: --===============2150571918835121717== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Michael, sorry for the late reply. I will send you the output of "iptables -L -n -v" directly. So far, I am able to reproduce this issue on two machines (both with default policy set to DROP). In both cases, adding a rule with source =3D ORANGE, destination =3D RED and action =3D DROP to the end of the firewall ruleset in the WebUI solved the problem. So far, it seems like ORANGE is affected by this only. Thanks, and best regards, Peter M=C3=BCller > Hey, >=20 > Could you dump the generated iptables ruleset? >=20 > I do not see anything that could potentially be a problem here that is caus= ing your behaviour: >=20 > https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dblob;f=3Dconfig/firewall/f= irewall-policy;h=3D078c3c515c31f1f385a2159f83fb5c6c52f5e89f;hb=3DHEAD >=20 > -Michael >=20 >> On 15 Dec 2018, at 16:36, Peter M=C3=BCller wr= ote: >> >> Hello list, >> >> I recently stumbled across a strange behaviour of IPFire 2.x, which >> seems to be quite critical in my eyes, but I am not sure whether it is >> intentional or not. >> >> Default settings of IPFire allow traffic from internal networks >> (GREEN, BLUE, ORANGE) to the internet (RED), as documented here: >> https://wiki.ipfire.org/configuration/firewall/default-policy >> >> For several reasons, no direct internet access is desired on most >> firewall installations I administer, so setting the "default firewall >> behaviour" to DROP for both FORWARD and OUTGOING usually is one of >> the first steps after installation. >> >> Speaking about GREEN and BLUE, this seems to work: No direct connection >> is possible except it has been explicitly allowed. >> >> It turns out this setting does not apply to traffic from ORANGE: Even >> default is set to DROP, and no firewall rules allowing anything are >> in place, a server located in DMZ is able to reach full internet - >> every port on every IP in every country. >> >> This is not my expectation of "default policy" =3D DROP after all! >> >> Could somebody of the core developers urgently have a look at this, please? >> >> Thanks, and best regards, >> Peter M=C3=BCller >> --=20 >> Microsoft DNS service terminates abnormally when it recieves a response >> to a DNS query that was never made. Fix Information: Run your DNS >> service on a different platform. >> -- bugtraq >=20 --=20 Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq --===============2150571918835121717==--