Tobias Brunner
0ee4a333a8
ifdown calls bind's rndc, which tries to access TCP port 953 on lo. If these packets are dropped by the firewall we have to wait for the TCP connections to time out, which takes quite a while.
43 lines
1.2 KiB
Plaintext
43 lines
1.2 KiB
Plaintext
*filter
|
|
|
|
# default policy is DROP
|
|
-P INPUT DROP
|
|
-P OUTPUT DROP
|
|
-P FORWARD DROP
|
|
|
|
# allow traffic on lo as ifup/ifdown call bind's rndc which accesses TCP 953
|
|
-A OUTPUT -o lo -j ACCEPT
|
|
-A INPUT -i lo -j ACCEPT
|
|
|
|
# allow IPsec tunnel traffic
|
|
-A INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
|
-A OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
|
|
|
# allow ESP
|
|
-A INPUT -i eth0 -p 50 -j ACCEPT
|
|
-A INPUT -i eth1 -p 50 -j ACCEPT
|
|
-A OUTPUT -o eth0 -p 50 -j ACCEPT
|
|
-A OUTPUT -o eth1 -p 50 -j ACCEPT
|
|
|
|
# allow IKE
|
|
-A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
-A INPUT -i eth1 -p udp --sport 500 --dport 500 -j ACCEPT
|
|
-A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
-A OUTPUT -o eth1 -p udp --dport 500 --sport 500 -j ACCEPT
|
|
|
|
# allow MobIKE
|
|
-A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
-A INPUT -i eth1 -p udp --sport 4500 --dport 4500 -j ACCEPT
|
|
-A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
-A OUTPUT -o eth1 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
|
|
|
# allow ssh
|
|
-A INPUT -p tcp --dport 22 -j ACCEPT
|
|
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
|
|
|
# allow crl fetch from winnetou
|
|
-A INPUT -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
|
-A OUTPUT -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
|
|
|
COMMIT
|