1 # Copyright (C) 2009-2011 OpenWrt.org
2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
17 FW_DEFAULT_INPUT_POLICY
=REJECT
18 FW_DEFAULT_OUTPUT_POLICY
=REJECT
19 FW_DEFAULT_FORWARD_POLICY
=REJECT
26 fw_config_get_section
"$1" defaults
{ \
27 string input
$FW_DEFAULT_INPUT_POLICY \
28 string output
$FW_DEFAULT_OUTPUT_POLICY \
29 string forward
$FW_DEFAULT_FORWARD_POLICY \
30 boolean drop_invalid
0 \
32 boolean synflood_protect
0 \
33 string synflood_rate
25 \
34 string synflood_burst
50 \
35 boolean tcp_syncookies
1 \
37 boolean tcp_westwood
0 \
38 boolean tcp_window_scaling
1 \
39 boolean accept_redirects
0 \
40 boolean accept_source_route
0 \
41 boolean custom_chains
1 \
42 boolean disable_ipv6
0 \
44 [ -n "$FW_DEFAULTS_APPLIED" ] && {
45 fw_log error
"duplicate defaults section detected, skipping"
50 FW_DEFAULT_INPUT_POLICY
=$defaults_input
51 FW_DEFAULT_OUTPUT_POLICY
=$defaults_output
52 FW_DEFAULT_FORWARD_POLICY
=$defaults_forward
54 FW_ADD_CUSTOM_CHAINS
=$defaults_custom_chains
56 FW_ACCEPT_REDIRECTS
=$defaults_accept_redirects
57 FW_ACCEPT_SRC_ROUTE
=$defaults_accept_source_route
59 FW_DISABLE_IPV6
=$defaults_disable_ipv6
61 fw_callback pre defaults
63 # Seems like there are only one sysctl for both IP versions.
64 for s
in syncookies ecn westwood window_scaling
; do
65 eval "sysctl -e -w net.ipv4.tcp_${s}=\$defaults_tcp_${s}" >/dev
/null
67 fw_sysctl_interface all
69 fw add i f INPUT ACCEPT
{ -m conntrack
--ctstate RELATED
,ESTABLISHED
}
70 fw add i f OUTPUT ACCEPT
{ -m conntrack
--ctstate RELATED
,ESTABLISHED
}
71 fw add i f FORWARD ACCEPT
{ -m conntrack
--ctstate RELATED
,ESTABLISHED
}
73 [ $defaults_drop_invalid == 1 ] && {
74 fw add i f INPUT DROP
{ -m conntrack
--ctstate INVALID
}
75 fw add i f OUTPUT DROP
{ -m conntrack
--ctstate INVALID
}
76 fw add i f FORWARD DROP
{ -m conntrack
--ctstate INVALID
}
80 fw add i f INPUT ACCEPT
{ -i lo
}
81 fw add i f OUTPUT ACCEPT
{ -o lo
}
83 # Compatibility to old 'syn_flood' parameter
84 [ $defaults_syn_flood == 1 ] && \
85 defaults_synflood_protect
=1
87 [ "${defaults_synflood_rate%/*}" == "$defaults_synflood_rate" ] && \
88 defaults_synflood_rate
="$defaults_synflood_rate/second"
90 [ $defaults_synflood_protect == 1 ] && {
91 echo "Loading synflood protection"
92 fw_callback pre synflood
94 fw add i f syn_flood RETURN
{ \
96 -m limit
--limit "${defaults_synflood_rate}" --limit-burst "${defaults_synflood_burst}" \
98 fw add i f syn_flood DROP
99 fw add i f INPUT syn_flood
{ -p tcp
--syn }
100 fw_callback post synflood
103 [ $defaults_custom_chains == 1 ] && {
104 echo "Adding custom chains"
105 fw add i f input_rule
106 fw add i f output_rule
107 fw add i f forwarding_rule
108 fw add i n prerouting_rule
109 fw add i n postrouting_rule
111 fw add i f INPUT input_rule
112 fw add i f OUTPUT output_rule
113 fw add i f FORWARD forwarding_rule
114 fw add i n PREROUTING prerouting_rule
115 fw add i n POSTROUTING postrouting_rule
118 fw add i f delegate_input
119 fw add i f delegate_output
120 fw add i f delegate_forward
122 fw add i f INPUT delegate_input
123 fw add i f OUTPUT delegate_output
124 fw add i f FORWARD delegate_forward
127 fw add i f reject REJECT
{ --reject-with tcp-reset
-p tcp
}
128 fw add i f reject REJECT
{ --reject-with port-unreach
}
132 fw_callback post defaults
136 fw_config_get_zone
() {
137 [ "${zone_NAME}" != "$1" ] ||
return
138 fw_config_get_section
"$1" zone
{ \
143 string input
"$FW_DEFAULT_INPUT_POLICY" \
144 string output
"$FW_DEFAULT_OUTPUT_POLICY" \
145 string forward
"$FW_DEFAULT_FORWARD_POLICY" \
148 string masq_dest
"" \
150 string extra_src
"" \
151 string extra_dest
"" \
152 boolean conntrack
0 \
154 boolean custom_chains
0 \
156 string log_limit
10 \
159 [ -n "$zone_name" ] || zone_name
=$zone_NAME
160 [ -n "$zone_extra_src" ] || zone_extra_src
="$zone_extra"
161 [ -n "$zone_extra_dest" ] || zone_extra_dest
="$zone_extra"
162 [ -n "$zone_network$zone_subnet$zone_device$zone_extra_src$zone_extra_dest" ] || zone_network
=$zone_name
166 fw_config_get_zone
"$1"
168 list_contains FW_ZONES
$zone_name && {
169 fw_log error
"zone ${zone_name}: duplicated zone, skipping"
172 append FW_ZONES
$zone_name
176 [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
177 append FW_CONNTRACK_ZONES
"$zone_name"
180 case "$zone_family" in
183 append FW_ZONES4
$zone_name
184 uci_set_state firewall core
${zone_name}_ipv4
1
188 append FW_ZONES6
$zone_name
189 uci_set_state firewall core
${zone_name}_ipv6
1
193 append FW_ZONES4
$zone_name
194 append FW_ZONES6
$zone_name
195 uci_set_state firewall core
${zone_name}_ipv4
1
196 uci_set_state firewall core
${zone_name}_ipv6
1
200 local chain
=zone_
${zone_name}
202 fw add
$mode f
${chain}_src_ACCEPT
203 fw add
$mode f
${chain}_src_DROP
204 fw add
$mode f
${chain}_src_REJECT
206 fw add
$mode f
${chain}_dest_ACCEPT
207 fw add
$mode f
${chain}_dest_DROP
208 fw add
$mode f
${chain}_dest_REJECT
210 fw add
$mode f
${chain}_input
211 fw add
$mode f
${chain}_input ${chain}_src_${zone_input} $
213 fw add
$mode f
${chain}_forward
214 fw add
$mode f
${chain}_forward ${chain}_dest_${zone_forward} $
216 fw add
$mode f
${chain}_output
217 fw add
$mode f
${chain}_output ${chain}_dest_${zone_output} $
219 # TODO: Rename to ${chain}_MASQUERADE
220 fw add
$mode n
${chain}_nat
221 fw add
$mode n
${chain}_prerouting
223 fw add
$mode r
${chain}_notrack
225 [ $zone_mtu_fix == 1 ] && {
226 fw add
$mode m
${chain}_MSSFIX
227 fw add
$mode m FORWARD
${chain}_MSSFIX ^
228 uci_set_state firewall core
${zone_name}_tcpmss
1
231 [ $zone_custom_chains == 1 ] && {
232 [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
233 fw_die
"zone ${zone_name}: custom_chains globally disabled"
235 fw add
$mode f input_
${zone_name}
236 fw add
$mode f
${chain}_input input_
${zone_name} ^
238 fw add
$mode f forwarding_
${zone_name}
239 fw add
$mode f
${chain}_forward forwarding_
${zone_name} ^
241 fw add
$mode n prerouting_
${zone_name}
242 fw add
$mode n
${chain}_prerouting prerouting_
${zone_name} ^
245 [ "$zone_log" == 1 ] && {
246 [ "${zone_log_limit%/*}" == "$zone_log_limit" ] && \
247 zone_log_limit
="$zone_log_limit/minute"
250 for t
in REJECT DROP
; do
252 for d
in src dest
; do
253 fw add
$mode f
${chain}_${d}_${t} LOG ^ \
254 { -m limit
--limit $zone_log_limit --log-prefix "$t($d:$zone_name): " }
258 [ $zone_mtu_fix == 1 ] && \
259 fw add
$mode m
${chain}_MSSFIX LOG ^ \
260 { -p tcp
--tcp-flags SYN
,RST SYN
-m limit
--limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
263 # NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
264 if [ "$zone_masq" == 1 ]; then
266 for msrc
in ${zone_masq_src:-0.0.0.0/0}; do
268 *.
*) fw_get_negation msrc
'-s' "$msrc" ;;
269 *) fw_get_subnet4 msrc
'-s' "$msrc" ||
break ;;
272 for mdst
in ${zone_masq_dest:-0.0.0.0/0}; do
274 *.
*) fw_get_negation mdst
'-d' "$mdst" ;;
275 *) fw_get_subnet4 mdst
'-d' "$mdst" ||
break ;;
278 fw add
$mode n
${chain}_nat MASQUERADE $
{ $msrc $mdst }
284 for dev
in ${zone_device:-""}; do
286 for net
in ${zone_subnet:-""}; do
287 [ -n "$dev" ] ||
[ -n "$net" ] ||
continue
288 fw_do_interface_rules add
"${zone_name}" "$dev" "$net" \
289 "${zone_extra_src}" "${zone_extra_dest}"
293 fw_callback post zone
296 fw_load_notrack_zone
() {
297 fw_config_get_zone
"$1"
298 list_contains FW_CONNTRACK_ZONES
"${zone_name}" && return
300 fw_callback pre notrack
302 fw add i r zone_
${zone_name}_notrack NOTRACK $
304 fw_callback post notrack
312 config_get path
${name} path
316 fw_log error
"You cannot use UCI in firewall includes!" >&2
327 fw_set_filter_policy
$policy
335 fw_set_filter_policy
() {
339 for chn
in INPUT OUTPUT FORWARD
; do
340 eval "tgt=\${policy:-\${FW_DEFAULT_${chn}_POLICY}}"
341 [ $tgt == "REJECT" ] && tgt
=reject
342 [ $tgt == "ACCEPT" -o $tgt == "DROP" ] ||
{
343 fw add i f
$chn $tgt $
346 fw policy i f
$chn $tgt
356 eval "libs=\$FW_CB_${pp}_${hk}"
357 [ -n "$libs" ] ||
return
359 ${lib}_${pp}_${hk}_cb