[git.ipfire.org] IPFire 2.x development tree branch, master, updated. c26a9ed25c6a3e81d42d824b4b7785f78f500eea

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. c26a9ed25c6a3e81d42d824b4b7785f78f500eea

[git]

[-- Attachment #1: Type: text/plain, Size: 3557 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  c26a9ed25c6a3e81d42d824b4b7785f78f500eea (commit)
      from  8089b78d9d955cc7b4c4a6284b2499c9e234a799 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c26a9ed25c6a3e81d42d824b4b7785f78f500eea
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Sun Mar 30 22:33:58 2014 +0200

    firewall-policy: Clarify policy rules.
    
    There are no functional changes here. Everything that
    is not explicitely allowed is now forbidden when the
    forward policy is "ALLOWED".

-----------------------------------------------------------------------

Summary of changes:
 config/firewall/firewall-policy | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)

Difference in files:
diff --git a/config/firewall/firewall-policy b/config/firewall/firewall-policy
index 6990fa9..2176d6b 100755
--- a/config/firewall/firewall-policy
+++ b/config/firewall/firewall-policy
@@ -110,33 +110,28 @@ case "${POLICY}" in
 		;;
 
 	*)
+		# Access from GREEN is granted to everywhere
+		iptables -A POLICYFWD -i "${GREEN_DEV}" -s "${GREEN_NETADDRESS}/${GREEN_NETMASK}" -j ACCEPT
+
+		# Grant access for IPsec VPN connections
+		iptables -A POLICYFWD -m policy --pol ipsec --dir in -j ACCEPT
+
+		# Grant access for OpenVPN connections
+		iptables -A POLICYFWD -i tun+ -j ACCEPT
+
 		if [ -n "${IFACE}" ]; then
 			if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then
-				if [ "${DROPFORWARD}" = "on" ]; then
-					iptables -A POLICYFWD -i "${BLUE_DEV}" ! -o "${IFACE}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
-				fi
-				iptables -A POLICYFWD -i "${BLUE_DEV}" ! -o "${IFACE}" -j DROP
-			fi
-			if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then
-				if [ "${DROPFORWARD}" = "on" ]; then
-					iptables -A POLICYFWD -i "${ORANGE_DEV}" ! -o "${IFACE}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
-				fi
-				iptables -A POLICYFWD -i "${ORANGE_DEV}" ! -o "${IFACE}" -j DROP
+				iptables -A POLICYFWD -i "${BLUE_DEV}" -s "${BLUE_NETADDRESS}/${BLUE_NETMASK}" -o "${IFACE}" -j ACCEPT
 			fi
 
-			if [ "${DROPFORWARD}" = "on" ]; then
-				iptables -A POLICYFWD -i "${IFACE}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
+			if [ "${HAVE_ORANGE}" = "true" ] && [ -n "${ORANGE_DEV}" ]; then
+				iptables -A POLICYFWD -i "${ORANGE_DEV}" -s "${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" -o "${IFACE}" -j ACCEPT
 			fi
-			iptables -A POLICYFWD -i "${IFACE}" -j DROP
+		fi
 
-			if [ "${IFACE}" != "${RED_DEV}" ]; then
-				if [ "${DROPFORWARD}" = "on" ]; then
-					iptables -A POLICYFWD -i "${RED_DEV}" -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
-				fi
-				iptables -A POLICYFWD -i "${RED_DEV}" -j DROP
-			fi
+		if [ "${DROPFORWARD}" = "on" ]; then
+			iptables -A POLICYFWD -m limit --limit 10/minute -j LOG --log-prefix "DROP_FORWARD "
 		fi
-		iptables -A POLICYFWD -j ACCEPT
 		iptables -A POLICYFWD -m comment --comment "DROP_FORWARD" -j DROP
 		;;
 esac


hooks/post-receive
--
IPFire 2.x development tree