Re: [PATCH] Firewall initscript: Restore Tor IPTable rules by manual firewall restart

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1805 bytes --]

Hello Erik,

Thank you for the patch.

> On 16 Jan 2024, at 15:07, Erik Kapfer <erik.kapfer(a)ipfire.org> wrote:
> 
> If the firewall will be manually restart via '/etc/init.d/firewall restart',
> the IPTable rules for the Tor relay will be deleted since 'iptables_init' only
> flushes and creates inbound and unbound chains for Tor but does not restore the
> ruleset from Tor initscript.
> 
> For reference and tests please see -->
> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-give-an-error-message/10697
> 
> Signed-off-by: Erik Kapfer <erik.kapfer(a)ipfire.org>
> ---
> src/initscripts/system/firewall | 6 ++++++
> 1 file changed, 6 insertions(+)
> 
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
> index 50f2b3e02..50a7f2db9 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -25,6 +25,7 @@
> eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
> eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
> eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
> +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)

Is this file available even when Tor is not installed?

We might get an error message here if it does not exist.

> IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
> if [ -z $IFACE ]; then
> IFACE="red0"
> @@ -387,6 +388,11 @@ iptables_init() {
> # run captivectrl
> /usr/local/bin/captivectrl
> 
> + # If a Tor relay is enabled apply firewall rules
> + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then
> + /usr/local/bin/torctrl restart 1> /dev/null
> + fi
> +
> # POLICY CHAIN
> iptables -N POLICYIN
> iptables -A INPUT -j POLICYIN
> -- 
> 2.43.0
>