Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fmFirewall New,Established issue #295

Closed
air101 opened this issue Mar 18, 2016 · 6 comments
Closed

fmFirewall New,Established issue #295

air101 opened this issue Mar 18, 2016 · 6 comments

Comments

@air101
Copy link

@air101 air101 commented Mar 18, 2016

Hello WillyXJ,

I was trying to setup my firewall rules. As facileManager uses ALLOW Policy on INPUT/OUTPUT/FORWARD I was trying to allow some services and block the rest. But when it comes to allow established packets back in, the rule sets this in the rules file:

// Allow-Established-Packets-Back-IN
-A INPUT -i venet0 -m state --state NEW,ESTABLISHED -j ACCEPT

And I block everything with this rule:

// From-Internet-IPv4
-A INPUT -i venet0 -j DROP

But due to the NEW before the ESTABLISHED statement, nothing gets blocked and everything is allowed to inside. Is there an option to remove the NEW statement or replace it with RELATED ?

Thank you!

@air101
Copy link
Author

@air101 air101 commented Mar 19, 2016

i've fixed it temporarily
fm-modules/fmFirewall/classes/class_buildconf.php

Add after line 241

                    if($__FM_CONFIG['fw']['policy_options']['established']['bit']) {
                    $search = 'NEW,';
                    $replace = 'RELATED,';
                    $keep_state = str_replace($search, $replace, $keep_state);
                    }
@WillyXJ
Copy link
Owner

@WillyXJ WillyXJ commented Mar 21, 2016

Setting as a feature request.

@air101
Copy link
Author

@air101 air101 commented Mar 21, 2016

Hmm I wouldn't think this is a feature request, as at the moment it is no real firewall. it either blocks everything or allows anything =>

@WillyXJ
Copy link
Owner

@WillyXJ WillyXJ commented Mar 21, 2016

That is true with your particular two rules. However, there are many more rules that can be defined that would make it a firewall using the existing rule support by defining services to allow/deny. The feature that needs to be implemented in support to choose between NEW and RELATED.

@WillyXJ
Copy link
Owner

@WillyXJ WillyXJ commented Mar 29, 2016

Reading the iptables manpage more, it seems to me fmFirewall ought to add RELATED to the states when specifying ESTABLISHED (given the module is still in its infancy). So, for example, your allowed line would be

-A INPUT -i venet0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Or if you untick the "Established connection packets" box on the policy then it would look like

-A INPUT -i venet0 -m state --state NEW -j ACCEPT

@WillyXJ
Copy link
Owner

@WillyXJ WillyXJ commented Apr 25, 2016

v1.3 has been released and contains this improvement.

@WillyXJ WillyXJ closed this Apr 25, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants