Bug #3129: IPS: shorewall configuration not applied if there is at least an orange interface - NethServer 6 - NethServer.org

Bug #3129

« Previous | Next »

IPS: shorewall configuration not applied if there is at least an orange interface

Added by Giacomo Sanchietti over 6 years ago. Updated over 6 years ago.

Status:

CLOSED

Start date:

Priority:

Normal

Due date:

Assignee:

% Done:

100%

Category:

nethserver-firewall-base

Target version:

v6.6

Security class:

Resolution:

Affected version:

v6.6-final

NEEDINFO:

Description

Steps to reproduce

Configure an orange interface
Enable the IPS
Shorewall stops working

Expected behavior

Firewall must correctly run
Snort should inspect traffic from/to orange zone

Actual behavior

Firewall rules are not applied

Thanks to Charlie Lehardy (AZChas) for reporting.

Associated revisions

Revision 6ffa8a0d
Added by Giacomo Sanchietti over 6 years ago

IPS: fix support for orange zone. Refs #3129

History

#1 Updated by Giacomo Sanchietti over 6 years ago

Status changed from NEW to TRIAGED
Target version set to v6.6
% Done changed from 0 to 20
Affected version set to v6.6-final

#2 Updated by Giacomo Sanchietti over 6 years ago

Workaround

Create the following template-custom

/etc/e-smith/templates-custom/etc/shorewall/rules/10base20established

#
# SECTION ESTABLISHED
#
?SECTION ESTABLISHED

{
    use esmith::NetworksDB;
    my $nfqueue = $firewall{'nfqueue'} || 'disabled';
    if ($nfqueue eq 'enabled') {
        $OUT .= "# Enable NFQ for ESTABLISHED connections\n";
        $OUT .= "NFQBY\tloc\tnet\n";
        $OUT .= "NFQBY\tnet\tloc\n";
        $OUT .= "NFQBY\tnet\tfw\n";
        $OUT .= "NFQBY\tfw\tnet\n";

        my $ndb = esmith::NetworksDB->open_ro();
        if ($ndb->blue) {
            $OUT .= "NFQBY\tblue\tnet\n";
        }
        if ($ndb->orange) {
            $OUT .= "NFQBY\torang\tnet\n";
        }
        if ($ndb->blue && $ndb->orange) {
            $OUT .= "NFQBY\tblue\torang\n";
        }
    }
}

/etc/e-smith/templates-custom/etc/shorewall/rules/10base50related

#
# SECTION RELATED
#
?SECTION RELATED

{
    use esmith::NetworksDB;
    my $nfqueue = $firewall{'nfqueue'} || 'disabled';
    if ($nfqueue eq 'enabled') {
        $OUT .= "# Enable NFQ for RELATED connections\n";
        $OUT .= "NFQBY\tloc\tnet\n";
        $OUT .= "NFQBY\tnet\tloc\n";
        $OUT .= "NFQBY\tnet\tfw\n";
        $OUT .= "NFQBY\tfw\tnet\n";

        my $ndb = esmith::NetworksDB->open_ro();
        if ($ndb->blue) {
            $OUT .= "NFQBY\tblue\tnet\n";
        }
        if ($ndb->orange) {
            $OUT .= "NFQBY\torang\tnet\n";
        }
        if ($ndb->blue && $ndb->orange) {
            $OUT .= "NFQBY\tblue\torang\n";
        }
    }
}