From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH 02/11] firewall: Accept inbound Tor traffic before
 applying the location filter
Date: Fri, 07 Jan 2022 16:58:52 +0000
Message-ID: <B32E2AD7-E1AE-4312-B00E-5379ADA2AEED@ipfire.org>
In-Reply-To: <4347b799-f863-9870-50d2-683b8c078670@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8639302387731781502=="
List-Id: <development.lists.ipfire.org>

--===============8639302387731781502==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello,

Can we make sure this is well documented somewhere?

Generally we said that the location filter comes first and this will change t=
hat behaviour.

Best,
-Michael

> On 18 Dec 2021, at 13:47, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wr=
ote:
>=20
> Inbound Tor traffic conflicts with Location block as inbound connections
> have to be accepted from many parts of the world. To solve this,
> inbound Tor traffic has to be accepted before jumping into Location block
> chain.
>=20
> Note this affects Tor relay operators only.
>=20
> Rolled forward as ongoing from
> https://patchwork.ipfire.org/project/ipfire/patch/f8ee2e1d-b642-8c63-1f8a-4=
f24c354cd90(a)ipfire.org/,
> note the documentation in the wiki needs to be updated once this landed
> in production.
>=20
> Signed-off-by: Peter M=C3=BCller <peter.mueller(a)ipfire.org>
> ---
> src/initscripts/system/firewall | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>=20
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firew=
all
> index 49c6b7bf9..cc5baa292 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -227,6 +227,10 @@ iptables_init() {
> 		iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
> 	fi
>=20
> +	# Tor (inbound)
> +	iptables -N TOR_INPUT
> +	iptables -A INPUT -j TOR_INPUT
> +
> 	# Location Block
> 	iptables -N LOCATIONBLOCK
> 	iptables -A INPUT -j LOCATIONBLOCK
> @@ -260,9 +264,7 @@ iptables_init() {
> 	iptables -N OVPNINPUT
> 	iptables -A INPUT -j OVPNINPUT
>=20
> -	# Tor (inbound and outbound)
> -	iptables -N TOR_INPUT
> -	iptables -A INPUT -j TOR_INPUT
> +	# Tor (outbound)
> 	iptables -N TOR_OUTPUT
> 	iptables -A OUTPUT -j TOR_OUTPUT
>=20
> --=20
> 2.26.2


--===============8639302387731781502==--