2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
6 IPTABLES="echo iptables"
17 ZONE_LIST=$CONFIG_SECTION
27 local item="$1"; shift
29 [ "$i" = "$item" ] && return 0
35 config_get input $1 input
36 config_get output $1 output
37 config_get forward $1 forward
39 DEF_INPUT="${input:-$DEF_INPUT}"
40 DEF_OUTPUT="${output:-$DEF_OUTPUT}"
41 DEF_FORWARD="${forward:-$DEF_FORWARD}"
47 [ "$1" == "loopback" ] && return
49 config_get exists $ZONE_LIST $1
50 [ -n "$exists" ] && return
51 config_set $ZONE_LIST $1 1
54 $IPTABLES -N zone_$1_MSSFIX
55 $IPTABLES -N zone_$1_ACCEPT
56 $IPTABLES -N zone_$1_DROP
57 $IPTABLES -N zone_$1_REJECT
58 $IPTABLES -N zone_$1_forward
59 $IPTABLES -A zone_$1_forward -j zone_$1_$5
60 $IPTABLES -A zone_$1 -j zone_$1_$3
61 $IPTABLES -A output -j zone_$1_$4
62 $IPTABLES -N zone_$1_nat -t nat
63 $IPTABLES -N zone_$1_prerouting -t nat
64 $IPTABLES -t raw -N zone_$1_notrack
65 [ "$6" == "1" ] && $IPTABLES -t nat -A POSTROUTING -j zone_$1_nat
74 config_get n_if core "${network}_ifname"
75 config_get n_zone core "${network}_zone"
77 if [ "$n_zone" != "$zone" ]; then
78 delif "$network" "$n_if" "$n_zone"
84 logger "adding $network ($ifname) to firewall zone $zone"
85 $IPTABLES -A input -i "$ifname" -j zone_${zone}
86 $IPTABLES -I zone_${zone}_MSSFIX 1 -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
87 $IPTABLES -I zone_${zone}_ACCEPT 1 -o "$ifname" -j ACCEPT
88 $IPTABLES -I zone_${zone}_DROP 1 -o "$ifname" -j DROP
89 $IPTABLES -I zone_${zone}_REJECT 1 -o "$ifname" -j reject
90 $IPTABLES -I zone_${zone}_ACCEPT 1 -i "$ifname" -j ACCEPT
91 $IPTABLES -I zone_${zone}_DROP 1 -i "$ifname" -j DROP
92 $IPTABLES -I zone_${zone}_REJECT 1 -i "$ifname" -j reject
93 $IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE
94 $IPTABLES -I PREROUTING 1 -t nat -i "$ifname" -j zone_${zone}_prerouting
95 $IPTABLES -A forward -i "$ifname" -j zone_${zone}_forward
96 $IPTABLES -t raw -I PREROUTING 1 -i "$ifname" -j zone_${zone}_notrack
97 uci_set_state firewall core "${network}_ifname" "$ifname"
98 uci_set_state firewall core "${network}_zone" "$zone"
106 logger "removing $network ($ifname) from firewall zone $zone"
107 $IPTABLES -D input -i "$ifname" -j zone_$zone
108 $IPTABLES -D zone_${zone}_MSSFIX -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
109 $IPTABLES -D zone_${zone}_ACCEPT -o "$ifname" -j ACCEPT
110 $IPTABLES -D zone_${zone}_DROP -o "$ifname" -j DROP
111 $IPTABLES -D zone_${zone}_REJECT -o "$ifname" -j reject
112 $IPTABLES -D zone_${zone}_ACCEPT -i "$ifname" -j ACCEPT
113 $IPTABLES -D zone_${zone}_DROP -i "$ifname" -j DROP
114 $IPTABLES -D zone_${zone}_REJECT -i "$ifname" -j reject
115 $IPTABLES -D zone_${zone}_nat -t nat -o "$ifname" -j MASQUERADE
116 $IPTABLES -D PREROUTING -t nat -i "$ifname" -j zone_${zone}_prerouting
117 $IPTABLES -D forward -i "$ifname" -j zone_${zone}_forward
118 uci_revert_state firewall core "${network}_ifname"
119 uci_revert_state firewall core "${network}_zone"
125 echo "Loading synflood protection"
126 $IPTABLES -N syn_flood
127 $IPTABLES -A syn_flood -p tcp --syn -m limit --limit $rate/second --limit-burst $burst -j RETURN
128 $IPTABLES -A syn_flood -j DROP
129 $IPTABLES -A INPUT -p tcp --syn -j syn_flood
132 fw_set_chain_policy() {
135 [ "$target" == "REJECT" ] && {
136 $IPTABLES -A $chain -j reject
139 $IPTABLES -P $chain $target
152 [ -n "$DEFAULTS_APPLIED" ] && {
153 echo "Error: multiple defaults sections detected"
160 echo 1 > /proc/sys/net/ipv4/tcp_syncookies
161 for f in /proc/sys/net/ipv4/conf/*/accept_redirects
165 for f in /proc/sys/net/ipv4/conf/*/accept_source_route
170 uci_revert_state firewall core
171 uci_set_state firewall core "" firewall_state
173 $IPTABLES -P INPUT DROP
174 $IPTABLES -P OUTPUT DROP
175 $IPTABLES -P FORWARD DROP
178 config_get_bool drop_invalid $1 drop_invalid 0
180 [ "$drop_invalid" -gt 0 ] && {
181 $IPTABLES -A INPUT -m state --state INVALID -j DROP
182 $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
183 $IPTABLES -A FORWARD -m state --state INVALID -j DROP
187 $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
188 $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
189 $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
191 $IPTABLES -A INPUT -i lo -j ACCEPT
192 $IPTABLES -A OUTPUT -o lo -j ACCEPT
194 config_get syn_flood $1 syn_flood
195 config_get syn_rate $1 syn_rate
196 config_get syn_burst $1 syn_burst
197 [ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
199 echo "Adding custom chains"
206 $IPTABLES -A INPUT -j input
207 $IPTABLES -A OUTPUT -j output
208 $IPTABLES -A FORWARD -j forward
211 $IPTABLES -A reject -p tcp -j REJECT --reject-with tcp-reset
212 $IPTABLES -A reject -j REJECT --reject-with icmp-port-unreachable
214 fw_set_chain_policy INPUT "$DEF_INPUT"
215 fw_set_chain_policy OUTPUT "$DEF_OUTPUT"
216 fw_set_chain_policy FORWARD "$DEF_FORWARD"
224 config_get name $1 name
225 config_get network $1 network
226 config_get_bool masq $1 masq "0"
227 config_get_bool conntrack $1 conntrack "0"
230 [ "$conntrack" = "1" -o "$masq" = "1" ] && append CONNTRACK_ZONES "$name"
231 [ -z "$network" ] && network=$name
232 create_zone "$name" "$network" "$input" "$output" "$forward" "$masq"
233 fw_custom_chains_zone "$name"
249 config_get src $1 src
250 config_get src_ip $1 src_ip
251 config_get src_mac $1 src_mac
252 config_get src_port $1 src_port
253 config_get dest $1 dest
254 config_get dest_ip $1 dest_ip
255 config_get dest_port $1 dest_port
256 config_get proto $1 proto
257 config_get target $1 target
258 config_get ruleset $1 ruleset
260 src_port_first=${src_port%-*}
261 src_port_last=${src_port#*-}
262 [ "$src_port_first" -ne "$src_port_last" ] && { \
263 src_port="$src_port_first:$src_port_last"; }
265 dest_port_first=${dest_port%-*}
266 dest_port_last=${dest_port#*-}
267 [ "$dest_port_first" -ne "$dest_port_last" ] && { \
268 dest_port="$dest_port_first:$dest_port_last"; }
272 [ -z "$target" ] && target=DROP
273 [ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
274 [ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
275 [ -n "$dest" ] && TARGET=zone_${dest}_$target
277 $IPTABLES -I $ZONE 1 \
278 ${proto:+-p $proto} \
279 ${src_ip:+-s $src_ip} \
280 ${src_port:+--sport $src_port} \
281 ${src_mac:+-m mac --mac-source $src_mac} \
282 ${dest_ip:+-d $dest_ip} \
283 ${dest_port:+--dport $dest_port} \
286 [ "$proto" == "tcpudp" -o -z "$proto" ] && {
301 config_get src $1 src
302 config_get dest $1 dest
303 config_get_bool mtu_fix $1 mtu_fix 0
304 [ -n "$src" ] && z_src=zone_${src}_forward || z_src=forward
305 [ -n "$dest" ] && z_dest=zone_${dest}_ACCEPT || z_dest=ACCEPT
306 $IPTABLES -I $z_src 1 -j $z_dest
307 [ "$mtu_fix" -gt 0 -a -n "$dest" ] && $IPTABLES -I $z_src 1 -j zone_${dest}_MSSFIX
309 # propagate masq zone flag
310 find_item "$src" $CONNTRACK_ZONES && append CONNTRACK_ZONES $dest
311 find_item "$dest" $CONNTRACK_ZONES && append CONNTRACK_ZONES $src
321 local dest_port dest_port2
324 config_get src $1 src
325 config_get src_ip $1 src_ip
326 config_get src_port $1 src_port
327 config_get src_dport $1 src_dport
328 config_get src_mac $1 src_mac
329 config_get dest_ip $1 dest_ip
330 config_get dest_port $1 dest_port
331 config_get proto $1 proto
332 [ -z "$src" -o -z "$dest_ip" ] && { \
333 echo "redirect needs src and dest_ip"; return ; }
335 src_port_first=${src_port%-*}
336 src_port_last=${src_port#*-}
337 [ "$src_port_first" -ne "$src_port_last" ] && { \
338 src_port="$src_port_first:$src_port_last"; }
340 src_dport_first=${src_dport%-*}
341 src_dport_last=${src_dport#*-}
342 [ "$src_dport_first" -ne "$src_dport_last" ] && { \
343 src_dport="$src_dport_first:$src_dport_last"; }
345 dest_port2=$dest_port
346 dest_port_first=${dest_port2%-*}
347 dest_port_last=${dest_port2#*-}
348 [ "$dest_port_first" -ne "$dest_port_last" ] && { \
349 dest_port2="$dest_port_first:$dest_port_last"; }
352 $IPTABLES -A zone_${src}_prerouting -t nat \
353 ${proto:+-p $proto} \
354 ${src_ip:+-s $src_ip} \
355 ${src_port:+--sport $src_port} \
356 ${src_dport:+--dport $src_dport} \
357 ${src_mac:+-m mac --mac-source $src_mac} \
358 -j DNAT --to-destination $dest_ip${dest_port:+:$dest_port}
360 $IPTABLES -I zone_${src}_forward 1 \
361 ${proto:+-p $proto} \
363 ${src_ip:+-s $src_ip} \
364 ${src_port:+--sport $src_port} \
365 ${dest_port2:+--dport $dest_port2} \
366 ${src_mac:+-m mac --mac-source $src_mac} \
369 [ "$proto" == "tcpudp" -o -z "$proto" ] && {
381 config_get path $1 path
382 [ -e $path ] && . $path
389 config_get ifname $1 ifname
390 [ -n "$up" ] || return 0
391 (ACTION="ifup" INTERFACE="$1" . /etc/hotplug.d/iface/20-firewall)
395 [ -n "$CUSTOM_CHAINS" ] || return 0
396 $IPTABLES -N input_rule
397 $IPTABLES -N output_rule
398 $IPTABLES -N forwarding_rule
399 $IPTABLES -N prerouting_rule -t nat
400 $IPTABLES -N postrouting_rule -t nat
402 $IPTABLES -A INPUT -j input_rule
403 $IPTABLES -A OUTPUT -j output_rule
404 $IPTABLES -A FORWARD -j forwarding_rule
405 $IPTABLES -A PREROUTING -t nat -j prerouting_rule
406 $IPTABLES -A POSTROUTING -t nat -j postrouting_rule
409 fw_custom_chains_zone() {
412 [ -n "$CUSTOM_CHAINS" ] || return 0
413 $IPTABLES -N input_${zone}
414 $IPTABLES -N forwarding_${zone}
415 $IPTABLES -N prerouting_${zone} -t nat
416 $IPTABLES -I zone_${zone} 1 -j input_${zone}
417 $IPTABLES -I zone_${zone}_forward 1 -j forwarding_${zone}
418 $IPTABLES -I zone_${zone}_prerouting 1 -t nat -j prerouting_${zone}
423 config_get name "$zone" name
424 [ -n "$NOTRACK_DISABLED" ] || \
425 find_item "$name" $CONNTRACK_ZONES || \
426 $IPTABLES -t raw -A zone_${name}_notrack -j NOTRACK
432 echo "Loading defaults"
433 config_foreach fw_defaults defaults
435 config_foreach fw_zone zone
436 echo "Loading forwarding"
437 config_foreach fw_forwarding forwarding
438 echo "Loading redirects"
439 config_foreach fw_redirect redirect
441 config_foreach fw_rule rule
442 echo "Loading includes"
443 config_foreach fw_include include
444 uci_set_state firewall core loaded 1
445 config_foreach fw_check_notrack zone
448 config_foreach fw_addif interface
453 $IPTABLES -P INPUT ACCEPT
454 $IPTABLES -P OUTPUT ACCEPT
455 $IPTABLES -P FORWARD ACCEPT
456 uci_revert_state firewall