diff options
| author | Ermal <eri@pfsense.org> | 2010-03-17 00:51:17 +0000 |
|---|---|---|
| committer | Ermal <eri@pfsense.org> | 2010-03-17 00:51:17 +0000 |
| commit | 2f27dffda9dbab1294334c7dc05244efa41e0d41 (patch) | |
| tree | c45389e936c3a6b4d1beaa702e4b96303f044b3a /etc/inc/captiveportal.inc | |
| parent | bbfc810e8597b45abe669176c964c0c68f356985 (diff) | |
| download | pfsense-2f27dffda9dbab1294334c7dc05244efa41e0d41.zip pfsense-2f27dffda9dbab1294334c7dc05244efa41e0d41.tar.gz | |
Use the ipfw(4) list functionality to reduce rules even more. Add allow rules for accessing pfSense webgui to not lock out operators behind the CP. Remove redundant rule regarding dns. Probably every dns request should be forwarded to the local dns server to not force clients to use the pfSense forwarder!
Diffstat (limited to 'etc/inc/captiveportal.inc')
| -rw-r--r-- | etc/inc/captiveportal.inc | 66 |
1 files changed, 38 insertions, 28 deletions
diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index a8e5fe9..c05b7af 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -378,37 +378,47 @@ add 1101 set 1 deny layer2 not mac-type ip EOD; $rulenum = 1150; - foreach ($cpiparray as $cpip) { - //# allow access to our DHCP server (which needs to be able to ping clients as well) - $cprules .= "add {$rulenum} set 1 pass udp from any 68 to 255.255.255.255 67 in \n"; - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass udp from any 68 to {$cpip} 67 in \n"; - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass udp from {$cpip} 67 to any 68 out \n"; - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass icmp from {$cpip} to any out icmptype 0\n"; - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass icmp from any to {$cpip} in icmptype 8 \n"; - $rulenum++; - //# allow access to our DNS forwarder - $cprules .= "add {$rulenum} set 1 pass udp from {$cpip} to any 53 in \n"; - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass udp from any to {$cpip} 53 in \n"; - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass udp from {$cpip} 53 to any out \n"; + $ips = "255.255.255.255 "; + foreach ($cpiparray as $cpip) + $ips .= "or {$cpip} "; + $ips = "{ {$ips} }"; + //# allow access to our DHCP server (which needs to be able to ping clients as well) + $cprules .= "add {$rulenum} set 1 pass udp from any 68 to {$ips} 67 in \n"; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass udp from any 68 to {$ips} 67 in \n"; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass udp from {$ips} 67 to any 68 out \n"; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass icmp from {$ips} to any out icmptype 0\n"; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass icmp from any to {$ips} in icmptype 8 \n"; + $rulenum++; + //# allow access to our DNS forwarder + $cprules .= "add {$rulenum} set 1 pass udp from any to {$ips} 53 in \n"; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass udp from {$ips} 53 to any out \n"; + $rulenum++; + # allow access to our web server + $cprules .= "add {$rulenum} set 1 pass tcp from any to {$ips} 8000 in \n"; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass tcp from {$ips} 8000 to any out \n"; + + if (isset($config['captiveportal']['httpslogin'])) { $rulenum++; - # allow access to our web server - $cprules .= "add {$rulenum} set 1 pass tcp from any to {$cpip} 8000 in \n"; + $cprules .= "add {$rulenum} set 1 pass tcp from any to {$ips} 8001 in \n"; $rulenum++; - $cprules .= "add {$rulenum} set 1 pass tcp from {$cpip} 8000 to any out \n"; - - if (isset($config['captiveportal']['httpslogin'])) { - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass tcp from any to {$cpip} 8001 in \n"; - $rulenum++; - $cprules .= "add {$rulenum} set 1 pass tcp from {$cpip} 8001 to any out \n"; - } + $cprules .= "add {$rulenum} set 1 pass tcp from {$ips} 8001 to any out \n"; } + if (!empty($config['system']['webgui']['port'])) + $port = $config['system']['webgui']['port']; + else if ($config['system']['webgui']['proto'] == "https") + $port = 443; + else + $port = 80; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass tcp from any to {$ips} {$port} in \n"; + $rulenum++; + $cprules .= "add {$rulenum} set 1 pass tcp from {$ips} {$port} to any out \n"; $rulenum++; if (isset($config['captiveportal']['peruserbw'])) { |
