## firehol.conf IFUPDOWN_COMPATIBLE_FIREHOL_CONFIG_FILE example

version 6

FIREHOLCONF_DEBUG="NO"

if [ "$FIREHOLCONF_DEBUG" = "YES" -o -n "$IF_IFUPDOWN_FIREHOL_MAINT_DEBUG" ]; then
cat <<-EOF >> /tmp/firehol.log
	$(date): dumping variables
	IFACE:     ${IFACE}
	LOGICAL:   ${LOGICAL}
	ADDRFAM:   ${ADDRFAM}
	CLASS:     ${CLASS}
	METHOD:    ${METHOD}
	MODE:      ${MODE}
	PHASE:     ${PHASE}
	VERBOSITY: ${VERBOSITY}
	PATH:      ${PATH}
	------------------------------
	EOF
fi

##[ "${ADDRFAM}" = "meta" ] && exit 0

if [ -z "${MODE}" ]; then
	if [ -n "${COMMAND}" ]; then
		case "${COMMAND}" in
			start)
				MODE=start
				;;
			stop)
				MODE=stop
				;;
			*)
				;;
		esac
	fi
fi

fireholconf_firewall_generic() {
	local my_iface=${1:-gieth0}
#	local my_lww=${2:-'10.0.0.0/24'}
#	local my_variant=${3:-none}
#	local my_subnetprefix=${my_lww%.*}

	/usr/bin/logger -t firehol "generic firewall"

	## Interface: World Wide Generic Interface
	interface ${my_iface} WWGI src4 not "${RESERVED_IPS} ${my_lww}" src6 not "${RESERVED_IPS}"
		policy drop
		protection strong
		client dns   accept
		client ntp   accept user "ntpsec"
		client smtp  accept user "Debian-exim"
		client ssh   accept
		client http  accept
		client https accept
		client rsync accept

}

fireholconf_firewall_office() {
	local my_iface=${1:-wlan0}
	local my_lww=${2:-'10.0.0.0/24'}
	local my_variant=${3:-none}
#	local my_subnetprefix=${my_lww%.*}

	/usr/bin/logger -t firehol "office firewall"

	## Interface: World Wide Office Interface
	interface ${my_iface} WWOI src4 not "${RESERVED_IPS} ${my_lww}" src6 not "${RESERVED_IPS}"
		policy drop
		protection strong
		server icmp  accept
		client dhcp  accept
		client icmp  accept
		client dns   accept
		client ntp   accept user "ntpsec"
		client smtp  accept user "Debian-exim"
		client ssh   accept

	## Interface: Local Wide Office Interface
	interface4 ${my_iface} LWOI src4 "${my_lww}"
		policy reject
		protection strong
		#server icmp  accept
		client dhcp  accept
		client dns   accept
		client ssh   accept
		case ${my_variant} in
			with_printer)
				client cupss accept user "lp"
				;;
			*)
				;;
		esac

}

fireholconf_firewall_default() {
	local my_iface=${1:-any}

	/usr/bin/logger -t firehol "default firewall"

	interface4 $my_iface world
		policy drop
		protection strong
		client dhcp accept

}

fireholconf_preamble() {
	/usr/bin/logger -t firehol "preamble"
	}

fireholconf_postamble() {
	/usr/bin/logger -t firehol "postamble"
	}

fireholconf_preup() {

	if [ "${IFACE:=undefined}" = "gieth0" -o "${IFACE:=undefined}" = "wlan0" ]; then

		/usr/bin/logger -t firehol "firewall (${IFACE}=${LOGICAL}): ${MODE} <${IFACE}>"

		case "${LOGICAL}" in
			office_a)
				fireholconf_firewall_office ${IFACE} "192.168.0.0/24"
				;;
			office_b)
				fireholconf_firewall_office ${IFACE} "10.6.0.0/24" "with_printer"
				;;
			gieth0|generic)
				fireholconf_firewall_generic ${IFACE}
				;;
			*)
				fireholconf_firewall_default ${IFACE}
				;;
		esac

	else

		/usr/bin/logger -t firehol "firewall (${IFACE}=${LOGICAL}): ${MODE} <${IFACE}> (UNKNOWN)"

		fireholconf_firewall_default

	fi

	}

fireholconf_postdown() {

	if [ "${IFACE:=undefined}" = "gieth0" -o "${IFACE:=undefined}" = "wlan0" ]; then

		/usr/bin/logger -t firehol "firewall (${IFACE}=${LOGICAL}): ${MODE} <${IFACE}>"

		fireholconf_firewall_default ${IFACE}

	else

		/usr/bin/logger -t firehol "firewall (${IFACE}=${LOGICAL}): ${MODE} <${IFACE}> (UNKNOWN)"

		fireholconf_firewall_default

	fi

	}

case "$ADDRFAM" in
	meta)
		case "$MODE" in
			start) fireholconf_preamble ;;
			stop) fireholconf_postamble ;;
			*) ;;
		esac
		;;
	*)
		case "$PHASE" in
			pre-up) fireholconf_preup ;;
			post-down) fireholconf_postdown ;;
			*) ;;
		esac
		;;
esac

## vim:syntax=sh
