From: Mark Wooding <mdw@distorted.org.uk>
Date: Tue, 6 Mar 2012 10:43:58 +0000 (+0000)
Subject: Merge branch 'master' into emergency
X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/commitdiff_plain/fd965cc4be6fe6de25b3011aea708c41c3cd9e11?hp=3adc5b0b8fe2f9270e053f7bc46449651b78266e

Merge branch 'master' into emergency

* master:
  radius.m4: Forbid traffic directly to the NAT address.
  radius.m4: Use the correct interface name for NAT.
  local.m4: Fix IGMP acceptance (debris from old interface declarations).
---

diff --git a/local.m4 b/local.m4
index b31b649..36f76b3 100644
--- a/local.m4
+++ b/local.m4
@@ -237,18 +237,18 @@ run iptables -A inbound -j ACCEPT \
 ## Incoming multicast on a network interface associated with a trusted
 ## network is OK, since it must have originated there (or been forwarded, but
 ## we don't do that yet).
-for i in $(echo $if_trusted $if_dmz $if_safe | sed 'y/,/ /'); do
-  echo $i
-done | {
-  seen=:
-  while read i; do
-    case "$seen" in *:$i:*) continue ;; esac
-    seen=$seen$i:
+seen=:-:
+for net in $allnets; do
+  eval class=\$net_class_$net
+  case $class in trusted) ;; *) continue ;; esac
+  for iface in $(net_interfaces FWHOST $net); do
+    case "$seen" in *:$iface:*) continue ;; esac
+    seen=$seen$iface:
     run iptables -A inbound -j ACCEPT \
 	-s 0.0.0.0 -d 224.0.0.0/24 \
-	-i $i
+	-i $iface
   done
-}
+done
 
 ## Allow incoming ping.  This is the only ICMP left.
 run ip46tables -A inbound -j ACCEPT -p icmp
diff --git a/radius.m4 b/radius.m4
index d698998..e543878 100644
--- a/radius.m4
+++ b/radius.m4
@@ -62,12 +62,15 @@ run iptables -t nat -F
 run iptables -t nat -X
 
 run iptables -t nat -N outbound
-run iptables -t nat -A outbound -j RETURN ! -o $if_dmz
+run iptables -t nat -A outbound -j RETURN ! -o eth0
 run iptables -t nat -A outbound -j RETURN ! -s 172.29.198.0/23
 run iptables -t nat -A outbound -j RETURN -d 62.49.204.144/28
 run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23
 run iptables -t nat -A outbound -j SNAT --to-source 62.49.204.158
 run iptables -t nat -A POSTROUTING -j outbound
 
+## Forbid anything complicated to the NAT address.
+run iptables -A INPUT -d 62.49.204.158 ! -p icmp -j REJECT
+
 m4_divert(-1)
 ###----- That's all, folks --------------------------------------------------