[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1223cb9dac3f9a14cfa975b6c0e2c9b3f7109428

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1223cb9dac3f9a14cfa975b6c0e2c9b3f7109428

[Michael Tremer]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 3954 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  1223cb9dac3f9a14cfa975b6c0e2c9b3f7109428 (commit)
       via  37411de02cfb42befb397870ca324d188b7a0183 (commit)
      from  31ddf1b10640bfcc871e290e0535ed0e77c5541f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1223cb9dac3f9a14cfa975b6c0e2c9b3f7109428
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Sat Aug 29 14:23:32 2026 +0000

    core205: Ship firewall initscript
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 37411de02cfb42befb397870ca324d188b7a0183
Author: Peter Müller <peter.mueller@ipfire.org>
Date:   Tue Aug 25 13:29:00 2026 +0000

    firewall: Restrict outgoing network access for Knot to DNS-related ports
    
    Since Knot and the RPZ zone sync tool only need access to destination ports
    53 (UDP + TCP) or 853 (TCP) in case of DNS over TLS, keep their firewall
    rules constrained to these ports.
    
    Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/core/205/filelists/files | 1 +
 config/rootfiles/core/205/update.sh       | 3 +++
 src/initscripts/system/firewall           | 6 ++++--
 3 files changed, 8 insertions(+), 2 deletions(-)

Difference in files:
diff --git a/config/rootfiles/core/205/filelists/files b/config/rootfiles/core/205/filelists/files
index 883eff0c7..96c99afb6 100644
--- a/config/rootfiles/core/205/filelists/files
+++ b/config/rootfiles/core/205/filelists/files
@@ -1 +1,2 @@
+etc/rc.d/init.d/firewall
 var/ipfire/main/manualpages
diff --git a/config/rootfiles/core/205/update.sh b/config/rootfiles/core/205/update.sh
index 1c4acfbb0..f297448b2 100644
--- a/config/rootfiles/core/205/update.sh
+++ b/config/rootfiles/core/205/update.sh
@@ -58,6 +58,9 @@ telinit u
 # Restart the gnupg background services
 gpgconf --kill all
 
+# Restart the firewall
+/etc/init.d/firewall restart
+
 # Start services
 /etc/init.d/knot-resolver restart
 /etc/init.d/openvpn-rw restart
diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index a97758dc3..c7627bcab 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -443,7 +443,9 @@ iptables_init() {
 	/usr/local/bin/captivectrl
 
 	# Grant Knot Resolver access
-	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p udp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport 853 -j ACCEPT
 
 	# If a Tor relay is enabled apply firewall rules
 	if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then


hooks/post-receive
--
IPFire 2.x development tree