From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: Forward default "DROP" is not applied to ORANGE traffic?!
Date: Sun, 16 Dec 2018 13:53:23 +0000
Message-ID: <EA5EABB1-AC7A-4338-90A9-90A2EA3D549B@ipfire.org>
In-Reply-To: <52f6a8c0-7faf-d8ae-1261-996fe91e2e4d@link38.eu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2696010314198335421=="
List-Id: <development.lists.ipfire.org>

--===============2696010314198335421==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hey,

Could you dump the generated iptables ruleset?

I do not see anything that could potentially be a problem here that is causin=
g your behaviour:

  https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dblob;f=3Dconfig/firewall/fir=
ewall-policy;h=3D078c3c515c31f1f385a2159f83fb5c6c52f5e89f;hb=3DHEAD

-Michael

> On 15 Dec 2018, at 16:36, Peter M=C3=BCller <peter.mueller(a)link38.eu> wro=
te:
>=20
> Hello list,
>=20
> I recently stumbled across a strange behaviour of IPFire 2.x, which
> seems to be quite critical in my eyes, but I am not sure whether it is
> intentional or not.
>=20
> Default settings of IPFire allow traffic from internal networks
> (GREEN, BLUE, ORANGE) to the internet (RED), as documented here:
> https://wiki.ipfire.org/configuration/firewall/default-policy
>=20
> For several reasons, no direct internet access is desired on most
> firewall installations I administer, so setting the "default firewall
> behaviour" to DROP for both FORWARD and OUTGOING usually is one of
> the first steps after installation.
>=20
> Speaking about GREEN and BLUE, this seems to work: No direct connection
> is possible except it has been explicitly allowed.
>=20
> It turns out this setting does not apply to traffic from ORANGE: Even
> default is set to DROP, and no firewall rules allowing anything are
> in place, a server located in DMZ is able to reach full internet -
> every port on every IP in every country.
>=20
> This is not my expectation of "default policy" =3D DROP after all!
>=20
> Could somebody of the core developers urgently have a look at this, please?
>=20
> Thanks, and best regards,
> Peter M=C3=BCller
> --=20
> Microsoft DNS service terminates abnormally when it recieves a response
> to a DNS query that was never made.  Fix Information: Run your DNS
> service on a different platform.
> 		-- bugtraq


--===============2696010314198335421==--