If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript.
For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-...
Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org --- src/initscripts/system/firewall | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..50a7f2db9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +388,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl
+ # If a Tor relay is enabled apply firewall rules + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then + /usr/local/bin/torctrl restart 1> /dev/null + fi + # POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN
Hello Erik,
Thank you for the patch.
On 16 Jan 2024, at 15:07, Erik Kapfer erik.kapfer@ipfire.org wrote:
If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript.
For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-...
Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org
src/initscripts/system/firewall | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..50a7f2db9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
Is this file available even when Tor is not installed?
We might get an error message here if it does not exist.
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +388,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl
- # If a Tor relay is enabled apply firewall rules
- if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then
- /usr/local/bin/torctrl restart 1> /dev/null
- fi
# POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN -- 2.43.0
Hi Michael,
Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
Hello Erik,
Thank you for the patch.
On 16 Jan 2024, at 15:07, Erik Kapfer erik.kapfer@ipfire.org wrote:
If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript.
For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-...
Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org
src/initscripts/system/firewall | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..50a7f2db9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
Is this file available even when Tor is not installed?
We might get an error message here if it does not exist.
That´s a bad one, you are absolutely right! Since this is the firewall script, which way do you prefere in here ?
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +388,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl
- # If a Tor relay is enabled apply firewall rules
- if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ];
then
- /usr/local/bin/torctrl restart 1> /dev/null
- fi
# POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN -- 2.43.0
On 16 Jan 2024, at 15:16, ummeegge ummeegge@ipfire.org wrote:
Hi Michael,
Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
Hello Erik,
Thank you for the patch.
On 16 Jan 2024, at 15:07, Erik Kapfer erik.kapfer@ipfire.org wrote:
If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript.
For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-...
Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org
src/initscripts/system/firewall | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..50a7f2db9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
Is this file available even when Tor is not installed?
We might get an error message here if it does not exist.
That´s a bad one, you are absolutely right! Since this is the firewall script, which way do you prefere in here ?
You can simply wrap the line in an if statement checking if the file is readable:
if [ -r “/var/ipfire/tor/settings” ]; then eval … fi
The rest can stay as is.
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +388,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl
- # If a Tor relay is enabled apply firewall rules
- if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ];
then
- /usr/local/bin/torctrl restart 1> /dev/null
- fi
# POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN -- 2.43.0
Hope it matches all the needs.
Best,
Erik
Am Dienstag, dem 16.01.2024 um 15:17 +0000 schrieb Michael Tremer:
On 16 Jan 2024, at 15:16, ummeegge ummeegge@ipfire.org wrote:
Hi Michael,
Am Dienstag, dem 16.01.2024 um 15:11 +0000 schrieb Michael Tremer:
Hello Erik,
Thank you for the patch.
On 16 Jan 2024, at 15:07, Erik Kapfer erik.kapfer@ipfire.org wrote:
If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript.
For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-...
Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org
src/initscripts/system/firewall | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..50a7f2db9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +eval $(/usr/local/bin/readhash /var/ipfire/tor/settings)
Is this file available even when Tor is not installed?
We might get an error message here if it does not exist.
That´s a bad one, you are absolutely right! Since this is the firewall script, which way do you prefere in here ?
You can simply wrap the line in an if statement checking if the file is readable:
if [ -r “/var/ipfire/tor/settings” ]; then eval … fi
The rest can stay as is.
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +388,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl
- # If a Tor relay is enabled apply firewall rules
- if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}"
]; then
- /usr/local/bin/torctrl restart 1> /dev/null
- fi
# POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN -- 2.43.0
If the firewall will be manually restart via '/etc/init.d/firewall restart', the IPTable rules for the Tor relay will be deleted since 'iptables_init' only flushes and creates inbound and unbound chains for Tor but does not restore the ruleset from Tor initscript.
For reference and tests please see --> https://community.ipfire.org/t/tor-stop-working-without-stop-the-process-or-...
Signed-off-by: Erik Kapfer erik.kapfer@ipfire.org --- src/initscripts/system/firewall | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 50f2b3e02..3aab7dd75 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -25,6 +25,9 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) +if [ -r "/var/ipfire/tor/settings" ]; then + eval $(/usr/local/bin/readhash /var/ipfire/tor/settings) +fi IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -z $IFACE ]; then IFACE="red0" @@ -387,6 +390,11 @@ iptables_init() { # run captivectrl /usr/local/bin/captivectrl
+ # If a Tor relay is enabled apply firewall rules + if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then + /usr/local/bin/torctrl restart 1> /dev/null + fi + # POLICY CHAIN iptables -N POLICYIN iptables -A INPUT -j POLICYIN
-
Erik Kapfer -
Michael Tremer -
ummeegge