Hi Michael, I observed the same issue on my installations and I think it's coming from the following lines in /etc/rc.d/init.d/firewall:
413 # Orange pinholes 414 if [ "$ORANGE_DEV" != "" ]; then 415 # This rule enables a host on ORANGE network to connect to the outside 416 # (only if we have a red connection) 417 if [ "$IFACE" != "" ]; then 418 iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT 419 fi 420 fi
Regards Oliver
-----Original Message----- From: Development development-bounces@lists.ipfire.org On Behalf Of Michael Tremer Sent: Sunday, December 16, 2018 2:53 PM To: Peter Müller peter.mueller@link38.eu Cc: IPFire: Development-List development@lists.ipfire.org Subject: Re: Forward default "DROP" is not applied to ORANGE traffic?!
Hey,
Could you dump the generated iptables ruleset?
I do not see anything that could potentially be a problem here that is causing your behaviour:
https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=config/firewall/firewall-p...
-Michael
On 15 Dec 2018, at 16:36, Peter Müller peter.mueller@link38.eu wrote:
Hello list,
I recently stumbled across a strange behaviour of IPFire 2.x, which seems to be quite critical in my eyes, but I am not sure whether it is intentional or not.
Default settings of IPFire allow traffic from internal networks (GREEN, BLUE, ORANGE) to the internet (RED), as documented here: https://wiki.ipfire.org/configuration/firewall/default-policy
For several reasons, no direct internet access is desired on most firewall installations I administer, so setting the "default firewall behaviour" to DROP for both FORWARD and OUTGOING usually is one of the first steps after installation.
Speaking about GREEN and BLUE, this seems to work: No direct connection is possible except it has been explicitly allowed.
It turns out this setting does not apply to traffic from ORANGE: Even default is set to DROP, and no firewall rules allowing anything are in place, a server located in DMZ is able to reach full internet - every port on every IP in every country.
This is not my expectation of "default policy" = DROP after all!
Could somebody of the core developers urgently have a look at this, please?
Thanks, and best regards, Peter Müller -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq