Results 1 to 4 of 4

Thread: How often are your firewall rules flushed?

  1. #1

    How often are your firewall rules flushed?

    Hi,

    I've noticed that every time my WAN ip is renewed my firewall rules are flushed even if the ip didn't change.

    The dhcp client is configured to run the /usr/share/udhcpc/default.script after every dhcp event. It passes the argument "renew" or "bound" to reflect the reason of the invocation. In the end of this script the firewall script is invoked.

    Snippet from /usr/share/udhcpc/default.script
    Code:
    # Invoke NAT and Firewall
    . /etc/linuxigd/FirewallConfig
    if [ "$DmzEnable" = 1 ] && [ "$DmzDevices" != None ]; then
            /init/firewall $interface $ip br0 $IPRouters br1 $DmzIP
    else
            /init/firewall $interface $ip br0 $IPRouters
    fi
    
    # 2003/09/23 by Joey
    # nvram set wan_ifname=eth1
    nvram set wan_ipaddr=$ip
    Now, the /init/firewall script will start by clearing all settings. During this time packets are dropped (at least if that is your default target). By the way, could this be related to the reported dead wan interface? During a short period of time you firewall rules will not be in place. To me this happens every 30 minutes.

    Since the ip adress is the only parameter of the /init/firewall script that can be changed by the dhcp client (not really true, dns adress as well, but you get the picture) wouldn't it be better to flush the firewall rules only if there is a change in the parameters?

    I'm thinkin something like:

    Code:
    if [ "$wan_ipaddr" != $ip ] || [ "$1" != "renew" ]; then
       # Invoke NAT and Firewall
       . /etc/linuxigd/FirewallConfig
       if [ "$DmzEnable" = 1 ] && [ "$DmzDevices" != None ]; then
          /init/firewall $interface $ip br0 $IPRouters br1 $DmzIP
       else
          /init/firewall $interface $ip br0 $IPRouters
       fi
       # 2003/09/23 by Joey
       # nvram set wan_ifname=eth1
       nvram set wan_ipaddr=$ip
    fi
    This way, the firewall rules are only flushed if the wan ip is changed by the dchp client or if the reason was not a renewal of the ip.

    What do you think?

    Cheers!

    (I'm running Oleg's 1.7.5.9-5 firmware)
    Last edited by sesamebike; 02-09-2004 at 10:05. Reason: Forgot the firmware version.

  2. #2
    Join Date
    Dec 2003
    Location
    Russian Federation
    Posts
    8,353
    Just check for "bound" event and do not run for "renew". Otherwise you will probably get problems with initial value for wan_ipaddr.

  3. #3
    Hi Oleg,

    What happens if you actually got a new ip adress from the dhcp server then? You will probably want to update your firewall rules then.

    I say, run only if b) the event is not "renew" OR a) the ip adress has changed.

    if [ "$wan_ipaddr" != $ip ] || [ "$1" != "renew" ]; then

    The initial situation is covered by the event being "bound" instead of renew. Probably the ip adress check will fail as well since the $wan_ipaddr is not defined.

    Would you consider adding this to your next firmware release? I can see a potential security problem where for a brief second your firewall rules are not present and the firewall either a) drops packages of ongoning connections or b) allows new incoming sessions which would have been blocked had the firewall rules been in place.

    Thanks for your response.

    Cheers!

  4. #4
    Ok, I think I see your point. Ignore my last post.

    If indeed we got a new ip adress the argument to the script wouldn't be renew but bound and thus your comment is perfectly valid.

    We'll have to verify this somehow before it's being implemented. Unfortunately I get the same IP every time so I don't have an easy setup for testing this.

    Cheers!

Similar Threads

  1. Some ground rules
    By Antiloop in forum WL-500g Q&A
    Replies: 2
    Last Post: 08-07-2006, 15:57
  2. Bad forwarding rules at the firewall
    By unaiur in forum WL-500g Custom Development
    Replies: 15
    Last Post: 11-10-2005, 04:23
  3. Strange PREROUTING rules
    By joozju in forum WL-500g Q&A
    Replies: 6
    Last Post: 07-07-2005, 18:25
  4. Firewall rules - pls advice
    By jolae in forum WL-500g Q&A
    Replies: 1
    Last Post: 13-06-2005, 20:42
  5. 1.7.5.9-4 Firewall/Filter rules bug ?
    By psylockex in forum WL-500g Custom Development
    Replies: 0
    Last Post: 23-08-2004, 09:29

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •