New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fmFirewall New,Established issue #295

Closed
air101 opened this Issue Mar 18, 2016 · 6 comments

Comments

Projects
None yet
2 participants
@air101

air101 commented Mar 18, 2016

Hello WillyXJ,

I was trying to setup my firewall rules. As facileManager uses ALLOW Policy on INPUT/OUTPUT/FORWARD I was trying to allow some services and block the rest. But when it comes to allow established packets back in, the rule sets this in the rules file:

// Allow-Established-Packets-Back-IN
-A INPUT -i venet0 -m state --state NEW,ESTABLISHED -j ACCEPT

And I block everything with this rule:

// From-Internet-IPv4
-A INPUT -i venet0 -j DROP

But due to the NEW before the ESTABLISHED statement, nothing gets blocked and everything is allowed to inside. Is there an option to remove the NEW statement or replace it with RELATED ?

Thank you!

@air101

This comment has been minimized.

air101 commented Mar 19, 2016

i've fixed it temporarily
fm-modules/fmFirewall/classes/class_buildconf.php

Add after line 241

                    if($__FM_CONFIG['fw']['policy_options']['established']['bit']) {
                    $search = 'NEW,';
                    $replace = 'RELATED,';
                    $keep_state = str_replace($search, $replace, $keep_state);
                    }
@WillyXJ

This comment has been minimized.

Owner

WillyXJ commented Mar 21, 2016

Setting as a feature request.

@air101

This comment has been minimized.

air101 commented Mar 21, 2016

Hmm I wouldn't think this is a feature request, as at the moment it is no real firewall. it either blocks everything or allows anything =>

@WillyXJ

This comment has been minimized.

Owner

WillyXJ commented Mar 21, 2016

That is true with your particular two rules. However, there are many more rules that can be defined that would make it a firewall using the existing rule support by defining services to allow/deny. The feature that needs to be implemented in support to choose between NEW and RELATED.

@WillyXJ

This comment has been minimized.

Owner

WillyXJ commented Mar 29, 2016

Reading the iptables manpage more, it seems to me fmFirewall ought to add RELATED to the states when specifying ESTABLISHED (given the module is still in its infancy). So, for example, your allowed line would be

-A INPUT -i venet0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Or if you untick the "Established connection packets" box on the policy then it would look like

-A INPUT -i venet0 -m state --state NEW -j ACCEPT

@WillyXJ

This comment has been minimized.

Owner

WillyXJ commented Apr 25, 2016

v1.3 has been released and contains this improvement.

@WillyXJ WillyXJ closed this Apr 25, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment