1 # Copyright (C) 2009-2010 OpenWrt.org
2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
15 FW_DEFAULT_INPUT_POLICY=REJECT
16 FW_DEFAULT_OUTPUT_POLICY=REJECT
17 FW_DEFAULT_FORWARD_POLICY=REJECT
21 fw_config_get_section "$1" defaults { \
22 string input $FW_DEFAULT_INPUT_POLICY \
23 string output $FW_DEFAULT_OUTPUT_POLICY \
24 string forward $FW_DEFAULT_FORWARD_POLICY \
25 boolean drop_invalid 0 \
27 boolean synflood_protect 0 \
28 string synflood_rate 25 \
29 string synflood_burst 50 \
30 boolean tcp_syncookies 1 \
32 boolean tcp_westwood 0 \
33 boolean tcp_window_scaling 1 \
34 boolean accept_redirects 0 \
35 boolean accept_source_route 0 \
36 boolean custom_chains 1 \
38 [ -n "$FW_DEFAULTS_APPLIED" ] && {
39 echo "Error: multiple defaults sections detected"
44 FW_DEFAULT_INPUT_POLICY=$defaults_input
45 FW_DEFAULT_OUTPUT_POLICY=$defaults_output
46 FW_DEFAULT_FORWARD_POLICY=$defaults_forward
48 FW_ADD_CUSTOM_CHAINS=$defaults_custom_chains
50 FW_ACCEPT_REDIRECTS=$defaults_accept_redirects
51 FW_ACCEPT_SRC_ROUTE=$defaults_accept_source_route
53 fw_callback pre defaults
55 # Seems like there are only one sysctl for both IP versions.
56 for s in syncookies ecn westwood window_scaling; do
57 eval "sysctl -e -w net.ipv4.tcp_${s}=\$defaults_tcp_${s}" >/dev/null
59 fw_sysctl_interface all
61 [ $defaults_drop_invalid == 1 ] && {
62 fw add i f INPUT DROP { -m state --state INVALID }
63 fw add i f OUTPUT DROP { -m state --state INVALID }
64 fw add i f FORWARD DROP { -m state --state INVALID }
68 fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
69 fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
70 fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
72 fw add i f INPUT ACCEPT { -i lo }
73 fw add i f OUTPUT ACCEPT { -o lo }
75 # Compatibility to old 'syn_flood' parameter
76 [ $defaults_syn_flood == 1 ] && \
77 defaults_synflood_protect=1
79 [ $defaults_synflood_protect == 1 ] && {
80 echo "Loading synflood protection"
81 fw_callback pre synflood
83 fw add i f syn_flood RETURN { \
85 -m limit --limit "${defaults_synflood_rate}/second" --limit-burst "${defaults_synflood_burst}" \
87 fw add i f syn_flood DROP
88 fw add i f INPUT syn_flood { -p tcp --syn }
89 fw_callback post synflood
92 [ $defaults_custom_chains == 1 ] && {
93 echo "Adding custom chains"
95 fw add i f output_rule
96 fw add i f forwarding_rule
97 fw add i n prerouting_rule
98 fw add i n postrouting_rule
100 fw add i f INPUT input_rule
101 fw add i f OUTPUT output_rule
102 fw add i f FORWARD forwarding_rule
103 fw add i n PREROUTING prerouting_rule
104 fw add i n POSTROUTING postrouting_rule
111 fw add i f INPUT input
112 fw add i f OUTPUT output
113 fw add i f FORWARD forward
116 fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
117 fw add i f reject REJECT { --reject-with port-unreach }
121 fw_callback post defaults
125 fw_config_get_zone() {
126 [ "${zone_NAME}" != "$1" ] || return
127 fw_config_get_section "$1" zone { \
130 string input "$FW_DEFAULT_INPUT_POLICY" \
131 string output "$FW_DEFAULT_OUTPUT_POLICY" \
132 string forward "$FW_DEFAULT_FORWARD_POLICY" \
134 boolean conntrack 0 \
136 boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
138 [ -n "$zone_name" ] || zone_name=$zone_NAME
139 [ -n "$zone_network" ] || zone_network=$zone_name
143 fw_config_get_zone "$1"
145 list_contains FW_ZONES $zone_name && {
146 fw_die "zone ${zone_name}: duplicated zone"
148 append FW_ZONES $zone_name
152 [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
153 append FW_CONNTRACK_ZONES "$zone_NAME"
155 local chain=zone_${zone_name}
157 fw add i f ${chain}_ACCEPT
158 fw add i f ${chain}_DROP
159 fw add i f ${chain}_REJECT
160 fw add i f ${chain}_MSSFIX
162 # TODO: Rename to ${chain}_input
164 fw add i f ${chain} ${chain}_${zone_input} $
166 fw add i f ${chain}_forward
167 fw add i f ${chain}_forward ${chain}_${zone_forward} $
169 # TODO: add ${chain}_output
170 fw add i f output ${chain}_${zone_output} $
172 # TODO: Rename to ${chain}_MASQUERADE
173 fw add i n ${chain}_nat
174 fw add i n ${chain}_prerouting
176 fw add i r ${chain}_notrack
177 [ $zone_masq == 1 ] && \
178 fw add i n POSTROUTING ${chain}_nat $
180 [ $zone_mtu_fix == 1 ] && \
181 fw add i f FORWARD ${chain}_MSSFIX ^
183 [ $zone_custom_chains == 1 ] && {
184 [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
185 fw_die "zone ${zone_name}: custom_chains globally disabled"
187 fw add i f input_${zone_name}
188 fw add i f ${chain} input_${zone_name} ^
190 fw add i f forwarding_${zone_name}
191 fw add i f ${chain}_forward forwarding_${zone_name} ^
193 fw add i n prerouting_${zone_name}
194 fw add i n ${chain}_prerouting prerouting_${zone_name} ^
197 fw_callback post zone
200 fw_load_notrack_zone() {
201 list_contains FW_CONNTRACK_ZONES "$1" && return
203 fw_config_get_zone "$1"
205 fw_callback pre notrack
207 fw add i f zone_${zone_name}_notrack NOTRACK $
209 fw_callback post notrack
216 local path; config_get path ${name} path
217 [ -e $path ] && . $path
224 fw_set_filter_policy $policy
232 fw_set_filter_policy() {
236 for chn in INPUT OUTPUT FORWARD; do
237 eval "tgt=\${policy:-\${FW_DEFAULT_${chn}_POLICY}}"
238 [ $tgt == "REJECT" ] && tgt=reject
239 [ $tgt == "ACCEPT" -o $tgt == "DROP" ] || {
240 fw add i f $chn $tgt $
243 fw policy i f $chn $tgt
253 eval "libs=\$FW_CB_${pp}_${hk}"
254 [ -n "$libs" ] || return
256 ${lib}_${pp}_${hk}_cb