* [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init
@ 2021-05-30 14:21 Matthias Fischer
2021-05-30 17:59 ` Peter Müller
0 siblings, 1 reply; 2+ messages in thread
From: Matthias Fischer @ 2021-05-30 14:21 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 3096 bytes --]
In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25
all ALGs were removed from UI.
But they remained - somehow - in the initscript (firewall).
I tried to remove the remnants - hopefully in the correct way.
Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
---
src/initscripts/system/firewall | 65 +--------------------------------
1 file changed, 1 insertion(+), 64 deletions(-)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index dd9f1a484..1e558ee86 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -98,74 +98,11 @@ iptables_init() {
iptables -t raw -N CONNTRACK
iptables -t raw -A PREROUTING -j CONNTRACK
- # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
+ # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
# GRE (always enabled)
modprobe nf_conntrack_proto_gre
- # SIP
- if [ "${CONNTRACK_SIP}" = "on" ]; then
- modprobe nf_nat_sip
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper sip -j ACCEPT
- for proto in udp tcp; do
- iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
- done
- fi
-
- # H.323
- if [ "${CONNTRACK_H323}" = "on" ]; then
- modprobe nf_nat_h323
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper h323 -j ACCEPT
-
- # Gatekeeper RAS
- iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
-
- # Q.931
- iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
- fi
-
- # FTP
- if [ "${CONNTRACK_FTP}" = "on" ]; then
- modprobe nf_nat_ftp
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
- fi
-
- # PPTP
- if [ "${CONNTRACK_PPTP}" = "on" ]; then
- modprobe nf_nat_pptp
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper pptp -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
- fi
-
- # TFTP
- if [ "${CONNTRACK_TFTP}" = "on" ]; then
- modprobe nf_nat_tftp
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper tftp -j ACCEPT
- iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
- fi
-
- # IRC
- if [ "${CONNTRACK_IRC}" = "on" ]; then
- modprobe nf_nat_irc
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper irc -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
- fi
-
- # Amanda
- if [ "${CONNTRACK_AMANDA}" = "on" ]; then
- modprobe nf_nat_amanda
- iptables -A CONNTRACK -m conntrack --ctstate RELATED \
- -m helper --helper amanda -j ACCEPT
- iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
- fi
-
# Fix for braindead ISPs
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
--
2.18.0
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init
2021-05-30 14:21 [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init Matthias Fischer
@ 2021-05-30 17:59 ` Peter Müller
0 siblings, 0 replies; 2+ messages in thread
From: Peter Müller @ 2021-05-30 17:59 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 3861 bytes --]
Hello Matthias,
thank you for this patch - removing the remains of ALGs has been on my to-do list as well... :-)
I agree with the changes you propose to the firewall initscript. However, there are still some ALG-related
configuration files left, and we continue to ship the corresponding kernel modules.
While the latter might be worth a separate patch as soon as Linux 5.10 landed in IPFire 2.x, cleaning
up the rest of ALG bits and pieces as much as we can makes sense to me.
Acked-by: Peter Müller <peter.mueller(a)ipfire.org>
Thanks, and best regards,
Peter Müller
> In https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=ffafaa71a6970a8c3d0942247feb37facfe24d25
> all ALGs were removed from UI.
>
> But they remained - somehow - in the initscript (firewall).
>
> I tried to remove the remnants - hopefully in the correct way.
>
> Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
> ---
> src/initscripts/system/firewall | 65 +--------------------------------
> 1 file changed, 1 insertion(+), 64 deletions(-)
>
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
> index dd9f1a484..1e558ee86 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -98,74 +98,11 @@ iptables_init() {
> iptables -t raw -N CONNTRACK
> iptables -t raw -A PREROUTING -j CONNTRACK
>
> - # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
> + # Conntrack helper (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
>
> # GRE (always enabled)
> modprobe nf_conntrack_proto_gre
>
> - # SIP
> - if [ "${CONNTRACK_SIP}" = "on" ]; then
> - modprobe nf_nat_sip
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper sip -j ACCEPT
> - for proto in udp tcp; do
> - iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
> - done
> - fi
> -
> - # H.323
> - if [ "${CONNTRACK_H323}" = "on" ]; then
> - modprobe nf_nat_h323
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper h323 -j ACCEPT
> -
> - # Gatekeeper RAS
> - iptables -t raw -A CONNTRACK -p udp --dport 1719 -j CT --helper RAS
> -
> - # Q.931
> - iptables -t raw -A CONNTRACK -p tcp --dport 1720 -j CT --helper Q.931
> - fi
> -
> - # FTP
> - if [ "${CONNTRACK_FTP}" = "on" ]; then
> - modprobe nf_nat_ftp
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
> - fi
> -
> - # PPTP
> - if [ "${CONNTRACK_PPTP}" = "on" ]; then
> - modprobe nf_nat_pptp
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper pptp -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp --dport 1723 -j CT --helper pptp
> - fi
> -
> - # TFTP
> - if [ "${CONNTRACK_TFTP}" = "on" ]; then
> - modprobe nf_nat_tftp
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper tftp -j ACCEPT
> - iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
> - fi
> -
> - # IRC
> - if [ "${CONNTRACK_IRC}" = "on" ]; then
> - modprobe nf_nat_irc
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper irc -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp --dport 6667 -j CT --helper irc
> - fi
> -
> - # Amanda
> - if [ "${CONNTRACK_AMANDA}" = "on" ]; then
> - modprobe nf_nat_amanda
> - iptables -A CONNTRACK -m conntrack --ctstate RELATED \
> - -m helper --helper amanda -j ACCEPT
> - iptables -t raw -A CONNTRACK -p tcp -j CT --helper amanda
> - fi
> -
> # Fix for braindead ISPs
> iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-05-30 17:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-30 14:21 [PATCH] Deleted no longer used 'if' clauses (ALG) from firewall init Matthias Fischer
2021-05-30 17:59 ` Peter Müller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox