This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, next has been updated via 247e97800d294acac4c22376951ca6acaf81f5fa (commit) from e68cfdb1404f7e18c4d2f9601734580ee9c9d8a5 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 247e97800d294acac4c22376951ca6acaf81f5fa Author: Peter Müller peter.mueller@ipfire.org Date: Wed Mar 23 11:18:34 2022 +0000

firewall: Fix placement of HOSTILE chains

They were mistakenly placed after the IPS chains in commit 7b529f5417254c68b6bd33732f30578182893d34, but should be placed after the connection tracking and before the IPS.

Fixes: #12815

Signed-off-by: Peter Müller peter.mueller@ipfire.org Reviewed-by: Michael Tremer michael.tremer@ipfire.org

-----------------------------------------------------------------------

Summary of changes: src/initscripts/system/firewall | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)

Difference in files: diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 2a70feac2..2597dae10 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -169,6 +169,17 @@ iptables_init() { iptables -t nat -N CUSTOMPOSTROUTING iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING

+ # Chains for networks known as being hostile, posing a technical threat to our users + # (i. e. listed at Spamhaus DROP et al.) + iptables -N HOSTILE + iptables -A INPUT -j HOSTILE + iptables -A FORWARD -j HOSTILE + iptables -A OUTPUT -j HOSTILE + + iptables -N HOSTILE_DROP + iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE " + iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE" + # IPS (Guardian) chains iptables -N GUARDIAN iptables -A INPUT -j GUARDIAN @@ -259,17 +270,6 @@ iptables_init() { iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT fi

- # Chains for networks known as being hostile, posing a technical threat to our users - # (i. e. listed at Spamhaus DROP et al.) - iptables -N HOSTILE - iptables -A INPUT -j HOSTILE - iptables -A FORWARD -j HOSTILE - iptables -A OUTPUT -j HOSTILE - - iptables -N HOSTILE_DROP - iptables -A HOSTILE_DROP -m limit --limit 10/second -j LOG --log-prefix "DROP_HOSTILE " - iptables -A HOSTILE_DROP -j DROP -m comment --comment "DROP_HOSTILE" - # Tor (inbound) iptables -N TOR_INPUT iptables -A INPUT -j TOR_INPUT

hooks/post-receive -- IPFire 2.x development tree