mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

* remove the temporary rule loading workarounds in /etc/rc

Browse Source 
* adjust the boot order slightly in rc.bootup
* rename filter_ipmon_start to filter_pflog_start
This commit is contained in:
Scott Ullrich 2005-02-08 06:23:20 +00:00
parent 1a51af434c
commit 24d15c0c13
3 changed files with 29 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
etc/inc/filter.inc
View File

@ -55,7 +55,7 @@ function filter_resync() {
mwexec("/sbin/pfctl -y"); /* XXX */
}
function filter_ipmon_start() {
function filter_pflog_start() {
global $config, $g;
mwexec("ifconfig pflog0 up && pflogd -sD");
@ -84,6 +84,9 @@ function filter_configure() {
mwexec("/sbin/pfctl -e");
mwexec("/sbin/pfctl -F nat");
mwexec("/sbin/pfctl -F rules");
} else {
mwexec("/sbin/pfctl -d");
return;
}
/* get our wan interface? */
@ -98,29 +101,32 @@ function filter_configure() {
$mssclamp = "";
$fd = fopen("/tmp/rules.debug", "w");
fwrite($fd, $aliases . " \n");
fwrite($fd, "set loginterface $wanif \n");
$rules = $aliases . " \n";
$rules.= "set loginterface $wanif \n";
$optimization = "normal";
if($config['system']['optimization'] <> "") $optimization = $config['system']['optimization'];
fwrite($fd, "set optimization " . $optimization . "\n");
$rules.= "set optimization " . $optimization . "\n";
if($config['system']['maximumstates'] <> "" && is_numeric($config['system']['maximumstates'])) {
/* User defined maximum states in Advanced menu. */
$maximumstates = $config['system']['maximumstates'];
fwrite($fd, "set limit states " . $maximumstates . "\n");
$rules.= "set limit states " . $maximumstates . "\n";
}
fwrite($fd, "\nscrub all " . $mssclamp ."\n"); // reassemble all directions
fwrite($fd, $altq_ints);
/*
* Anchors will be used to allow scripts and or users
* to add or subtract rules from the system using shellcmd.
*/
fwrite($fd, $altq_queues . "\n");
fwrite($fd, $natrules);
fwrite($fd, $pfrules);
$rules.= "\nscrub all " . $mssclamp ."\n"; // reassemble all directions
$rules.= $altq_ints;
$rules.= $altq_queues . "\n";
$rules.= $natrules;
$rules.= $pfrules;
fwrite($fd, $rules);
fclose($fd);
$rules_loading = mwexec("/sbin/pfctl -f /tmp/rules.debug");
$rules_loading = popen("/sbin/pfctl -f - > /dev/null 2>&1", "w");
if (!$rules_loading) {
printf("Cannot open /sbin/pfctl in filter_configure()\n");
return 1;
}
fwrite($rules_loading, $rules);
pclose($rules_loading);
/* load ipfw+altq module */
if (isset($config['shaper']['enable'])) {
@ -1485,30 +1491,8 @@ function filter_rules_spoofcheck_generate($ifname, $if, $sa, $sn, $log) {
$ipfrules = "antispoof for " . $if . "\n";
return $ipfrules; /* testing above. once works get rid above below.*/
if (is_array($config['staticroutes']['route']) && count($config['staticroutes']['route'])) {
/* count rules */
$n = 1;
foreach ($config['staticroutes']['route'] as $route) {
if ($route['interface'] == $ifname)
$n++;
}
/* output skip rules */
foreach ($config['staticroutes']['route'] as $route) {
if ($route['interface'] == $ifname) {
//$ipfrules .= "skip $n in on $if from {$route['network']} to any\n";
$n--;
}
}
$ipfrules .= "#skip 1 in on $if from $sa/$sn to any\n";
$ipfrules .= "#block in $log quick on $if all\n";
} else {
$ipfrules .= "#block in $log quick on $if from ! $sa/$sn to any\n";
}
return $ipfrules;
}
?>

6
etc/rc
View File

@ -67,9 +67,6 @@ cd /var/run && cp /dev/null utmp && chmod 644 utmp
# let the PHP-based configuration subsystem set up the system now
/etc/rc.bootup
/sbin/pfctl -f /tmp/rules.debug
/sbin/pfctl -e
echo Starting INETD for FTP-PROXY...
/usr/sbin/inetd -wW -C 60
@ -81,9 +78,6 @@ echo Starting USB...
/usr/sbin/cron 2>>/tmp/bootup_messages
sleep 10
/sbin/pfctl -f /tmp/rules.debug
for FILE in /usr/local/etc/rc.d/*.sh; do
if [ -e $FILE ]; then
echo "Starting ${FILE}..."

15
etc/rc.bootup
View File

@ -65,9 +65,6 @@
if (!in_array($g['platform'], $g['nopccard_platforms']))
system_pccard_start();
/* establish pf and altq ruleset */
filter_configure();
/* configure loopback interface */
interfaces_loopback_configure();
@ -83,15 +80,15 @@
/* set up Optional interfaces */
interfaces_optional_configure();
/* start pflog */
filter_pflog_start();
/* setup altq + pf */
filter_configure();
/* start OpenVPN server & clients */
ovpn_configure();
/* resync ipfilter */
filter_resync();
/* start ipmon */
filter_ipmon_start();
/* set up static routes */
system_routing_configure();