Hello,
I would like to make it short since I already said how much I like this on the video call…
Please see my replies to the individual patches.
-Michael
On 18 Dec 2021, at 13:46, Peter Müller peter.mueller@ipfire.org wrote:
This patchset improves IPFire's firewall engine by...
(a) improved logging of spoofed packets and martians
(b) prevention of spoofing attempts on RED's interface IP address
(c) dropping traffic from and to networks known to pose a technical threat to IPFire users (see https://git.ipfire.org/?p=location/libloc.git;a=commit;h=69b3d894fbee6e94afc... for details) by default on new installations, doing so in a dedicated, easy to configure IPtables chain. Sadly, a decent fraction of our userbase does not bother creating any firewall rules at all, so any outbound traffic is allowed on their networks. Therefore, preventing them from reaching the "baddest of the bad" makes sense for a basic detection of their devices and networks. Any sane IPS configuration would already cover the networks in question, so most IPFire machines running a decent IPS policy will already drop the offending traffic, albeit in a rather costly way.
Please note this patchset needs additional commits for the Core Update it is intended to go to, such as shipping the changed files, and adding sane defaults to existing installations in /var/ipfire/optionsfw/settings.
See also: #12031
Peter Müller (11): firewall: Log packets dropped due to conntrack INVALID state firewall: Accept inbound Tor traffic before applying the location filter firewall: Log and drop spoofed loopback packets firewall: Prevent spoofing our own RED IP address firewall: Introduce DROP_HOSTILE optionsfw.cgi: Make logging of spoofed/martians packets and the DROP_HOSTILE filter configurable Update German and English translation files collectd.conf: Keep track of DROP_{HOSTILE,SPOOFED_MARTIAN} graphs.pl: Display spoofed and hostile traffic in firewall hits diagram as well configroot: Enable logging of spoofed packets/martians by default configroot: Drop traffic from and to hostile networks by default
config/cfgroot/graphs.pl | 22 ++++++-- config/collectd/collectd.conf | 2 + html/cgi-bin/optionsfw.cgi | 96 +++++++++++++++++++++++++++------ langs/de/cgi-bin/de.pl | 9 +++- langs/en/cgi-bin/en.pl | 7 ++- lfs/configroot | 4 +- src/initscripts/system/firewall | 63 +++++++++++++++++----- 7 files changed, 166 insertions(+), 37 deletions(-)
-- 2.26.2