This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, master has been updated via c26a9ed25c6a3e81d42d824b4b7785f78f500eea (commit) from 8089b78d9d955cc7b4c4a6284b2499c9e234a799 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit c26a9ed25c6a3e81d42d824b4b7785f78f500eea Author: Michael Tremer michael.tremer@ipfire.org Date: Sun Mar 30 22:33:58 2014 +0200

firewall-policy: Clarify policy rules.

There are no functional changes here. Everything that is not explicitely allowed is now forbidden when the forward policy is "ALLOWED".

-----------------------------------------------------------------------

Summary of changes: config/firewall/firewall-policy | 35 +++++++++++++++-------------------- 1 file changed, 15 insertions(+), 20 deletions(-)

Difference in files: diff --git a/config/firewall/firewall-policy b/config/firewall/firewall-policy index 6990fa9..2176d6b 100755 --- a/config/firewall/firewall-policy +++ b/config/firewall/firewall-policy @@ -110,33 +110,28 @@ case "${POLICY}" in ;;

*) + # Access from GREEN is granted to everywhere + iptables -A POLICYFWD -i "${GREEN_DEV}" -s "${GREEN_NETADDRESS}/${GREEN_NETMASK}" -j ACCEPT + + # Grant access for IPsec VPN connections + iptables -A POLICYFWD -m policy --pol ipsec --dir in -j ACCEPT + + # Grant access for OpenVPN connections + iptables -A POLICYFWD -i tun+ -j ACCEPT + if [ -n "${IFACE}" ]; then if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then - if [ "${DROPFORWARD}" = "on" ]; then - iptables -A POLICYFWD -i "${BLUE_DEV}" ! -o "${IFACE}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD " - fi - iptables -A POLICYFWD -i "${BLUE_DEV}" ! -o "${IFACE}" -j DROP - fi - if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then - if [ "${DROPFORWARD}" = "on" ]; then - iptables -A POLICYFWD -i "${ORANGE_DEV}" ! -o "${IFACE}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD " - fi - iptables -A POLICYFWD -i "${ORANGE_DEV}" ! -o "${IFACE}" -j DROP + iptables -A POLICYFWD -i "${BLUE_DEV}" -s "${BLUE_NETADDRESS}/${BLUE_NETMASK}" -o "${IFACE}" -j ACCEPT fi

- if [ "${DROPFORWARD}" = "on" ]; then - iptables -A POLICYFWD -i "${IFACE}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD " + if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then + iptables -A POLICYFWD -i "${ORANGE_DEV}" -s "${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" -o "${IFACE}" -j ACCEPT fi - iptables -A POLICYFWD -i "${IFACE}" -j DROP + fi

- if [ "${IFACE}" != "${RED_DEV}" ]; then - if [ "${DROPFORWARD}" = "on" ]; then - iptables -A POLICYFWD -i "${RED_DEV}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD " - fi - iptables -A POLICYFWD -i "${RED_DEV}" -j DROP - fi + if [ "${DROPFORWARD}" = "on" ]; then + iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD " fi - iptables -A POLICYFWD -j ACCEPT iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP ;; esac

hooks/post-receive -- IPFire 2.x development tree