3 Copyright 2003-2005, CyberTAN Inc. All Rights Reserved
5 This is UNPUBLISHED PROPRIETARY SOURCE CODE of CyberTAN Inc.
6 the contents of this file may not be disclosed to third parties,
7 copied or duplicated in any form without the prior written
8 permission of CyberTAN Inc.
10 This software should be used as a reference only, and it not
11 intended for production use!
13 THIS SOFTWARE IS OFFERED "AS IS", AND CYBERTAN GRANTS NO WARRANTIES OF ANY
14 KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. CYBERTAN
15 SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
16 FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE
21 Modified for Tomato Firmware
22 Portions, Copyright (C) 2006-2009 Jonathan Zarate
29 #include <arpa/inet.h>
32 char wanface
[IFNAMSIZ
];
33 char lanface
[IFNAMSIZ
];
34 char lan_cclass
[sizeof("xxx.xxx.xxx.")];
35 char wanaddr
[sizeof("xxx.xxx.xxx.xxx")];
36 static int web_lanport
;
39 static int debug_only
= 0;
42 static int gateway_mode
;
43 static int remotemanage
;
46 const char *chain_in_drop
;
47 const char *chain_in_accept
;
48 const char *chain_out_drop
;
49 const char *chain_out_accept
;
50 const char *chain_out_reject
;
52 const char ipt_fname
[] = "/etc/iptables";
61 // -----------------------------------------------------------------------------
64 void enable_ip_forward(void)
68 0 - disabled (default)
71 Forward Packets between interfaces.
73 This variable is special, its change resets all configuration
74 parameters to their default state (RFC1122 for hosts, RFC1812
77 f_write_string("/proc/sys/net/ipv4/ip_forward", "1", 0, 0);
81 // -----------------------------------------------------------------------------
84 static int ip2cclass(char *ipaddr, char *new, int count)
88 if (sscanf(ipaddr,"%d.%d.%d.%d",&ip[0],&ip[1],&ip[2],&ip[3]) != 4) return 0;
89 return snprintf(new, count, "%d.%d.%d.",ip[0],ip[1],ip[2]);
94 static int dmz_dst(char *s
)
100 if (nvram_get_int("dmz_enable") <= 0) return 0;
102 p
= nvram_safe_get("dmz_ipaddr");
103 if ((ia
.s_addr
= inet_addr(p
)) == (in_addr_t
)-1) {
104 if (((n
= atoi(p
)) <= 0) || (n
>= 255)) return 0;
105 if (s
) sprintf(s
, "%s%d", lan_cclass
, n
);
109 if (s
) strcpy(s
, inet_ntoa(ia
));
113 static void ipt_source(const char *s
, char *src
)
117 if ((*s
) && (strlen(s
) < 32))
119 if (sscanf(s
, "%[0-9.]-%[0-9.]", p
, p
) == 2)
120 sprintf(src
, "-m iprange --src-range %s", s
);
122 sprintf(src
, "-s %s", s
);
129 static void get_src(const char *nv, char *src)
133 if (((p = nvram_get(nv)) != NULL) && (*p) && (strlen(p) < 32)) {
134 sprintf(src, "-%s %s", strchr(p, '-') ? "m iprange --src-range" : "s", p);
142 void ipt_write(const char *format
, ...)
146 va_start(args
, format
);
147 vfprintf(ipt_file
, format
, args
);
151 // -----------------------------------------------------------------------------
154 int ipt_ipp2p(const char *v
, char *opt
)
163 strcpy(opt
, "-m ipp2p ");
164 if ((n
& 0xFFF) == 0xFFF) {
165 strcat(opt
, "--ipp2p");
169 if (n
& 0x0001) strcat(opt
, "--apple ");
170 if (n
& 0x0002) strcat(opt
, "--ares ");
171 if (n
& 0x0004) strcat(opt
, "--bit ");
172 if (n
& 0x0008) strcat(opt
, "--dc ");
173 if (n
& 0x0010) strcat(opt
, "--edk ");
174 if (n
& 0x0020) strcat(opt
, "--gnu ");
175 if (n
& 0x0040) strcat(opt
, "--kazaa ");
176 if (n
& 0x0080) strcat(opt
, "--mute ");
177 if (n
& 0x0100) strcat(opt
, "--soul ");
178 if (n
& 0x0200) strcat(opt
, "--waste ");
179 if (n
& 0x0400) strcat(opt
, "--winmx ");
180 if (n
& 0x0800) strcat(opt
, "--xdcc ");
183 modprobe("ipt_ipp2p");
188 // -----------------------------------------------------------------------------
193 // This L7 matches inbound traffic, caches the results, then the L7 outbound
194 // should read the cached result and set the appropriate marks -- zzz
195 void ipt_layer7_inbound(void)
200 if (!layer7_in
) return;
202 en
= nvram_match("nf_l7in", "1");
206 "-A FORWARD -i %s -j L7in\n",
212 if (en
) ipt_write("-A L7in %s -j RETURN\n", *p
);
220 int ipt_layer7(const char *v
, char *opt
)
226 if (*v
== 0) return 0;
227 if (strlen(v
) > 32) return -1;
229 path
= "/etc/l7-extra";
230 sprintf(s
, "%s/%s.pat", path
, v
);
232 path
= "/etc/l7-protocols";
233 sprintf(s
, "%s/%s.pat", path
, v
);
235 syslog(LOG_ERR
, "L7 %s was not found", v
);
240 sprintf(opt
, "-m layer7 --l7dir %s --l7proto %s", path
, v
);
242 if (nvram_match("nf_l7in", "1")) {
243 if (!layer7_in
) layer7_in
= calloc(51, sizeof(char *));
249 if (strcmp(*p
, opt
) == 0) return 1;
252 if (((p
- layer7_in
) / sizeof(char *)) < 50) *p
= strdup(opt
);
257 modprobe("xt_layer7");
259 modprobe("ipt_layer7");
265 // -----------------------------------------------------------------------------
267 static void save_webmon(void)
269 system("cp /proc/webmon_recent_domains /var/webmon/domain");
270 system("cp /proc/webmon_recent_searches /var/webmon/search");
273 static void ipt_webmon(void)
277 if (!nvram_get_int("log_wm")) return;
278 wmtype
= nvram_get_int("log_wmtype");
282 "-A FORWARD -o %s -j monitor\n",
286 "-A monitor -m webmon "
287 "--max_domains %d --max_searches %d %s%s "
288 "--search_load_file /var/webmon/search "
289 "--domain_load_file /var/webmon/domain\n",
290 nvram_get_int("log_wmdmax") ? : 1, nvram_get_int("log_wmsmax") ? : 1,
291 wmtype
== 1 ? "--include_ips " : wmtype
== 2 ? "--exclude_ips " : "",
292 wmtype
== 0 ? "" : nvram_safe_get("log_wmip"));
294 modprobe("ipt_webmon");
298 // -----------------------------------------------------------------------------
300 // -----------------------------------------------------------------------------
302 static void mangle_table(void)
309 ":PREROUTING ACCEPT [0:0]\n"
310 ":OUTPUT ACCEPT [0:0]\n");
315 ttl
= nvram_get_int("nf_ttl");
326 "-I PREROUTING -i %s -j TTL --ttl-%sc %d\n"
327 "-I POSTROUTING -o %s -j TTL --ttl-%sc %d\n",
333 ipt_write("COMMIT\n");
338 // -----------------------------------------------------------------------------
340 // -----------------------------------------------------------------------------
342 static void nat_table(void)
352 ":PREROUTING ACCEPT [0:0]\n"
353 ":POSTROUTING ACCEPT [0:0]\n"
354 ":OUTPUT ACCEPT [0:0]\n");
356 strlcpy(lanaddr
, nvram_safe_get("lan_ipaddr"), sizeof(lanaddr
));
357 strlcpy(lanmask
, nvram_safe_get("lan_netmask"), sizeof(lanmask
));
359 // Drop incoming packets which destination IP address is to our LAN side directly
360 ipt_write("-A PREROUTING -i %s -d %s/%s -j DROP\n",
362 lanaddr
, lanmask
); // note: ipt will correct lanaddr
365 if (nvram_match("dns_intcpt", "1")) {
366 ipt_write("-A PREROUTING -p udp -s %s/%s ! -d %s/%s --dport 53 -j DNAT --to-destination %s\n",
372 // ICMP packets are always redirected to INPUT chains
373 ipt_write("-A PREROUTING -p icmp -d %s -j DNAT --to-destination %s\n", wanaddr
, lanaddr
);
376 strlcpy(t
, nvram_safe_get("rmgt_sip"), sizeof(t
));
379 if ((c
= strchr(p
, ',')) != NULL
) *c
= 0;
383 ipt_write("-A PREROUTING -p tcp -m tcp %s -d %s --dport %s -j DNAT --to-destination %s:%d\n",
385 wanaddr
, nvram_safe_get("http_wanport"),
386 lanaddr
, web_lanport
);
388 if (nvram_get_int("sshd_remote")) {
389 ipt_write("-A PREROUTING %s -p tcp -m tcp -d %s --dport %s -j DNAT --to-destination %s:%s\n",
391 wanaddr
, nvram_safe_get("sshd_rport"),
392 lanaddr
, nvram_safe_get("sshd_port"));
399 ipt_forward(IPT_TABLE_NAT
);
400 ipt_triggered(IPT_TABLE_NAT
);
403 if (nvram_get_int("upnp_enable") & 3) {
404 ipt_write(":upnp - [0:0]\n");
406 // ! for loopback (all) to work
407 ipt_write("-A PREROUTING -d %s -j upnp\n", wanaddr
);
410 ipt_write("-A PREROUTING -i %s -j upnp\n", wanface
);
416 strlcpy(t
, nvram_safe_get("dmz_sip"), sizeof(t
));
419 if ((c
= strchr(p
, ',')) != NULL
) *c
= 0;
421 ipt_write("-A PREROUTING %s -d %s -j DNAT --to-destination %s\n", src
, wanaddr
, dst
);
428 if ((!wanup
) || (nvram_get_int("net_snat") != 1)) {
429 ipt_write("-A POSTROUTING -o %s -j MASQUERADE\n", wanface
);
432 ipt_write("-A POSTROUTING -o %s -j SNAT --to-source %s\n", wanface
, wanaddr
);
435 switch (nvram_get_int("nf_loopback")) {
436 case 1: // 1 = forwarded-only
437 case 2: // 2 = disable
439 default: // 0 = all (same as block_loopback=0)
440 ipt_write("-A POSTROUTING -o %s -s %s/%s -d %s/%s -j SNAT --to-source %s\n",
448 ipt_write("COMMIT\n");
451 // -----------------------------------------------------------------------------
453 // -----------------------------------------------------------------------------
455 static void filter_input(void)
465 if ((nvram_get_int("nf_loopback") != 0) && (wanup
)) { // 0 = all
466 ipt_write("-A INPUT -i %s -d %s -j DROP\n", lanface
, wanaddr
);
470 "-A INPUT -m state --state INVALID -j %s\n"
471 "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n",
475 strlcpy(s
, nvram_safe_get("ne_shlimit"), sizeof(s
));
476 if ((vstrsep(s
, ",", &en
, &hit
, &sec
) == 3) && ((n
= atoi(en
) & 3) != 0)) {
478 ? what if the user uses the start button in GUI ?
479 if (nvram_get_int("telnetd_eas"))
480 if (nvram_get_int("sshd_eas"))
483 modprobe("xt_recent");
485 modprobe("ipt_recent");
490 "-A shlimit -m recent --set --name shlimit\n"
491 "-A shlimit -m recent --update --hitcount %s --seconds %s --name shlimit -j DROP\n",
494 if (n
& 1) ipt_write("-A INPUT -p tcp --dport %s -m state --state NEW -j shlimit\n", nvram_safe_get("sshd_port"));
495 if (n
& 2) ipt_write("-A INPUT -p tcp --dport %s -m state --state NEW -j shlimit\n", nvram_safe_get("telnetd_port"));
499 strlcpy(s
, nvram_safe_get("ftp_limit"), sizeof(s
));
500 if ((vstrsep(s
, ",", &en
, &hit
, &sec
) == 3) && (atoi(en
)) && (nvram_get_int("ftp_enable") == 1)) {
502 modprobe("xt_recent");
504 modprobe("ipt_recent");
509 "-A ftplimit -m recent --set --name ftp\n"
510 "-A ftplimit -m recent --update --hitcount %s --seconds %s --name ftp -j DROP\n",
512 ipt_write("-A INPUT -p tcp --dport %s -m state --state NEW -j ftplimit\n", nvram_safe_get("ftp_port"));
517 "-A INPUT -i %s -j ACCEPT\n"
518 "-A INPUT -i lo -j ACCEPT\n",
521 // ICMP request from WAN interface
522 if (nvram_match("block_wan", "0")) {
523 ipt_write("-A INPUT -p icmp -j %s\n", chain_in_accept
);
524 // allow udp traceroute packets
525 ipt_write("-A INPUT -p udp -m udp --dport 33434:33534 -j %s\n", chain_in_accept
);
528 /* Accept incoming packets from broken dhcp servers, which are sending replies
529 * from addresses other than used for query. This could lead to a lower level
530 * of security, so allow to disable it via nvram variable.
532 if (nvram_invmatch("dhcp_pass", "0")) {
533 switch (get_wan_proto()) {
535 if (nvram_get_int("pptp_dhcp") == 0)
540 ipt_write("-A INPUT -p udp --sport 67 --dport 68 -j %s\n", chain_in_accept
);
547 strlcpy(t
, nvram_safe_get("rmgt_sip"), sizeof(t
));
550 if ((c
= strchr(p
, ',')) != NULL
) *c
= 0;
555 ipt_write("-A INPUT -p tcp %s -m tcp -d %s --dport %d -j %s\n",
556 s
, nvram_safe_get("lan_ipaddr"), web_lanport
, chain_in_accept
);
559 if (nvram_get_int("sshd_remote")) {
560 ipt_write("-A INPUT -p tcp %s -m tcp -d %s --dport %s -j %s\n",
561 s
, nvram_safe_get("lan_ipaddr"), nvram_safe_get("sshd_port"), chain_in_accept
);
569 #ifdef TCONFIG_FTP // !!TB - FTP Server
570 if (nvram_match("ftp_enable", "1")) { // FTP WAN access enabled
571 strlcpy(t
, nvram_safe_get("ftp_sip"), sizeof(t
));
574 if ((c
= strchr(p
, ',')) != NULL
) *c
= 0;
577 ipt_write("-A INPUT -p tcp %s -m tcp --dport %s -j %s\n",
578 s
, nvram_safe_get("ftp_port"), chain_in_accept
);
586 // IGMP query from WAN interface
587 if (nvram_match("multicast_pass", "1")) {
588 ipt_write("-A INPUT -p igmp -j ACCEPT\n");
591 // Routing protocol, RIP, accept
592 if (nvram_invmatch("dr_wan_rx", "0")) {
593 ipt_write("-A INPUT -p udp -m udp --dport 520 -j ACCEPT\n");
597 if (*chain_in_drop
== 'l') {
598 ipt_write( "-A INPUT -j %s\n", chain_in_drop
);
601 // default policy: DROP
604 // clamp TCP MSS to PMTU of WAN interface
605 static void clampmss(void)
608 ipt_write("-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu\n");
610 int rmtu
= nvram_get_int("wan_run_mtu");
611 ipt_write("-A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss %d: -j TCPMSS ", rmtu
- 39);
613 ipt_write("--clamp-mss-to-pmtu\n");
616 ipt_write("--set-mss %d\n", rmtu
- 40);
621 static void filter_forward(void)
629 "-A FORWARD -i %s -o %s -j ACCEPT\n" // accept all lan to lan
630 "-A FORWARD -m state --state INVALID -j DROP\n", // drop if INVALID state
633 // clamp tcp mss to pmtu
638 ipt_layer7_inbound();
646 "-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT\n" // already established or related (via helper)
647 "-A FORWARD -i %s -j wanin\n" // generic from wan
648 "-A FORWARD -o %s -j wanout\n" // generic to wan
649 "-A FORWARD -i %s -j %s\n", // from lan
650 wanface
, wanface
, lanface
, chain_out_accept
);
652 if (nvram_get_int("upnp_enable") & 3) {
655 "-A FORWARD -i %s -j upnp\n",
660 if (nvram_match("multicast_pass", "1")) {
661 ipt_write("-A wanin -p udp -m udp -d 224.0.0.0/4 -j %s\n", chain_in_accept
);
663 ipt_triggered(IPT_TABLE_FILTER
);
664 ipt_forward(IPT_TABLE_FILTER
);
667 strlcpy(t
, nvram_safe_get("dmz_sip"), sizeof(t
));
670 if ((c
= strchr(p
, ',')) != NULL
) *c
= 0;
672 ipt_write("-A FORWARD -o %s %s -d %s -j %s\n", lanface
, src
, dst
, chain_in_accept
);
680 // default policy: DROP
683 static void filter_table(void)
690 ":INPUT DROP [0:0]\n"
691 ":OUTPUT ACCEPT [0:0]\n"
694 n
= nvram_get_int("log_limit");
695 if ((n
>= 1) && (n
<= 9999)) {
696 sprintf(limit
, "-m limit --limit %d/m", n
);
702 if ((*chain_in_drop
== 'l') || (*chain_out_drop
== 'l')) {
705 "-A logdrop -m state --state NEW %s -j LOG --log-prefix \"DROP \" --log-tcp-options --log-ip-options\n"
706 "-A logdrop -j DROP\n"
707 ":logreject - [0:0]\n"
708 "-A logreject %s -j LOG --log-prefix \"REJECT \" --log-tcp-options --log-ip-options\n"
709 "-A logreject -p tcp -j REJECT --reject-with tcp-reset\n",
712 if ((*chain_in_accept
== 'l') || (*chain_out_accept
== 'l')) {
714 ":logaccept - [0:0]\n"
715 "-A logaccept -m state --state NEW %s -j LOG --log-prefix \"ACCEPT \" --log-tcp-options --log-ip-options\n"
716 "-A logaccept -j ACCEPT\n",
722 if ((gateway_mode
) || (nvram_match("wk_mode_x", "1"))) {
723 ipt_write(":FORWARD DROP [0:0]\n");
727 ipt_write(":FORWARD ACCEPT [0:0]\n");
731 ipt_write("COMMIT\n");
735 // -----------------------------------------------------------------------------
737 int start_firewall(void)
740 struct dirent
*dirent
;
746 simple_lock("firewall");
747 simple_lock("restrictions");
749 wanproto
= get_wan_proto();
750 wanup
= check_wanup();
754 block obviously spoofed IP addresses
757 1 - do source validation by reversed path, as specified in RFC1812
758 Recommended option for single homed hosts and stub network
759 routers. Could cause troubles for complicated (not loop free)
760 networks running a slow unreliable protocol (sort of RIP),
761 or using static routes.
762 0 - No source validation.
764 if ((dir
= opendir("/proc/sys/net/ipv4/conf")) != NULL
) {
765 while ((dirent
= readdir(dir
)) != NULL
) {
766 sprintf(s
, "/proc/sys/net/ipv4/conf/%s/rp_filter", dirent
->d_name
);
767 f_write_string(s
, "1", 0, 0);
772 f_write_string("/proc/sys/net/ipv4/tcp_syncookies", nvram_get_int("ne_syncookies") ? "1" : "0", 0, 0);
774 /* NAT performance tweaks
775 * These values can be overriden later if needed via firewall script
777 f_write_string("/proc/sys/net/core/netdev_max_backlog", "3072", 0, 0);
778 f_write_string("/proc/sys/net/core/somaxconn", "3072", 0, 0);
779 f_write_string("/proc/sys/net/ipv4/tcp_max_syn_backlog", "8192", 0, 0);
780 f_write_string("/proc/sys/net/ipv4/tcp_fin_timeout", "30", 0, 0);
781 f_write_string("/proc/sys/net/ipv4/tcp_keepalive_intvl", "24", 0, 0);
782 f_write_string("/proc/sys/net/ipv4/tcp_keepalive_probes", "3", 0, 0);
783 f_write_string("/proc/sys/net/ipv4/tcp_keepalive_time", "1800", 0, 0);
784 f_write_string("/proc/sys/net/ipv4/tcp_retries2", "5", 0, 0);
785 f_write_string("/proc/sys/net/ipv4/tcp_syn_retries", "3", 0, 0);
786 f_write_string("/proc/sys/net/ipv4/tcp_synack_retries", "3", 0, 0);
787 f_write_string("/proc/sys/net/ipv4/tcp_tw_recycle", "1", 0, 0);
788 f_write_string("/proc/sys/net/ipv4/tcp_tw_reuse", "1", 0, 0);
790 /* DoS-related tweaks */
791 f_write_string("/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses", "1", 0, 0);
792 f_write_string("/proc/sys/net/ipv4/tcp_rfc1337", "1", 0, 0);
793 f_write_string("/proc/sys/net/ipv4/ip_local_port_range", "1024 65535", 0, 0);
795 n
= nvram_get_int("log_in");
796 chain_in_drop
= (n
& 1) ? "logdrop" : "DROP";
797 chain_in_accept
= (n
& 2) ? "logaccept" : "ACCEPT";
799 n
= nvram_get_int("log_out");
800 chain_out_drop
= (n
& 1) ? "logdrop" : "DROP";
801 chain_out_reject
= (n
& 1) ? "logreject" : "REJECT --reject-with tcp-reset";
802 chain_out_accept
= (n
& 2) ? "logaccept" : "ACCEPT";
804 // if (nvram_match("nf_drop_reset", "1")) chain_out_drop = chain_out_reject;
806 strlcpy(lanface
, nvram_safe_get("lan_ifname"), IFNAMSIZ
);
808 if ((wanproto
== WP_PPTP
) || (wanproto
== WP_L2TP
) || (wanproto
== WP_PPPOE
)) {
809 strcpy(wanface
, "ppp+");
812 strlcpy(wanface
, nvram_safe_get("wan_ifname"), sizeof(wanface
));
815 strlcpy(wanaddr
, get_wanip(), sizeof(wanaddr
));
817 strlcpy(s
, nvram_safe_get("lan_ipaddr"), sizeof(s
));
818 if ((c
= strrchr(s
, '.')) != NULL
) *(c
+ 1) = 0;
819 strlcpy(lan_cclass
, s
, sizeof(lan_cclass
));
821 gateway_mode
= !nvram_match("wk_mode", "router");
823 /* Remote management */
824 if (nvram_match("remote_management", "1") && nvram_invmatch("http_wanport", "") &&
825 nvram_invmatch("http_wanport", "0")) remotemanage
= 1;
826 else remotemanage
= 0;
828 if (nvram_match("remote_mgt_https", "1")) {
829 web_lanport
= nvram_get_int("https_lanport");
830 if (web_lanport
<= 0) web_lanport
= 443;
833 web_lanport
= nvram_get_int("http_lanport");
834 if (web_lanport
<= 0) web_lanport
= 80;
839 if ((ipt_file
= fopen(ipt_fname
, "w")) == NULL
) {
840 syslog(LOG_CRIT
, "Unable to create iptables restore file");
841 simple_unlock("firewall");
854 simple_unlock("firewall");
855 simple_unlock("restrictions");
862 if (nvram_get_int("upnp_enable") & 3) {
863 f_write("/etc/upnp/save", NULL
, 0, 0, 0);
864 if (killall("miniupnpd", SIGUSR2
) == 0) {
865 f_wait_notexists("/etc/upnp/save", 5);
869 if (eval("iptables-restore", (char *)ipt_fname
) == 0) {
873 sprintf(s
, "%s.error", ipt_fname
);
874 rename(ipt_fname
, s
);
875 syslog(LOG_CRIT
, "Error while loading rules. See %s file.", s
);
882 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
883 -A INPUT -i br0 -j ACCEPT
887 -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
888 -A FORWARD -i br0 -j ACCEPT
893 if (nvram_get_int("upnp_enable") & 3) {
894 f_write("/etc/upnp/load", NULL
, 0, 0, 0);
895 killall("miniupnpd", SIGUSR2
);
898 simple_unlock("restrictions");
899 sched_restrictions();
902 led(LED_DMZ
, dmz_dst(NULL
));
905 modprobe_r("xt_layer7");
907 modprobe_r("ipt_layer7");
909 modprobe_r("ipt_ipp2p");
910 modprobe_r("ipt_web");
911 modprobe_r("ipt_TTL");
912 modprobe_r("ipt_webmon");
914 unlink("/var/webmon/domain");
915 unlink("/var/webmon/search");
917 #ifdef TCONFIG_OPENVPN
918 run_vpn_firewall_scripts();
920 run_nvscript("script_fire", NULL
, 1);
922 simple_unlock("firewall");
926 int stop_firewall(void)
933 void create_test_iptfile(void)