nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-09-19 04:59:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Remove redundant setup steps

Browse Source 
- Essential modules enable their own services properly.  There is no need to do
  them as part of common setup.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This commit is contained in:
Sunil Mohan Adapa 2017-08-31 16:48:00 +05:30 committed by James Valleroy
parent c2cf591e1b
commit f5a5ee1f04
No known key found for this signature in database
GPG Key ID: 77C0C75E7B650808
1 changed files with 5 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
data/usr/lib/freedombox/first-run.d/90_firewall
View File

@ -50,56 +50,20 @@ set -x
# and 'internal' zones are managed. # and 'internal' zones are managed.
firewall-cmd --set-default-zone=external firewall-cmd --set-default-zone=external
# Setup firewall rules for all the services enabled by default. # Setup firewall rules for all the services enabled by default. Ideally all
# Ideally all non-essential services are enabled from Plinth which # essential services are enabled from Plinth which automatically takes care of
# automatically takes care of enabling appropirate firewall ports. The # enabling appropirate firewall ports.
# following is then for essential services and services that are not
# yet configurable from Plinth.
# HTTP (JWChat) # HTTP
firewall-cmd --zone=external --permanent --add-service=http firewall-cmd --zone=external --permanent --add-service=http
firewall-cmd --zone=internal --permanent --add-service=http firewall-cmd --zone=internal --permanent --add-service=http
# HTTPS (Plinth, JWChat) # HTTPS
firewall-cmd --zone=external --permanent --add-service=https firewall-cmd --zone=external --permanent --add-service=https
firewall-cmd --zone=internal --permanent --add-service=https firewall-cmd --zone=internal --permanent --add-service=https
# Tor
firewall-cmd --zone=internal --permanent --add-service=tor-socks
# NTP
firewall-cmd --zone=internal --permanent --add-service=ntp
# DNS # DNS
firewall-cmd --zone=internal --permanent --add-service=dns firewall-cmd --zone=internal --permanent --add-service=dns
# mDNS
firewall-cmd --zone=internal --permanent --add-service=mdns
# DHCP # DHCP
firewall-cmd --zone=internal --permanent --add-service=dhcp firewall-cmd --zone=internal --permanent --add-service=dhcp
# Bootp Server and Client (not enabled)
#firewall-cmd --zone=internal --permanent --add-port=67/tcp
#firewall-cmd --zone=internal --permanent --add-port=67/udp
#firewall-cmd --zone=internal --permanent --add-port=68/tcp
#firewall-cmd --zone=internal --permanent --add-port=68/udp
# LDAP (not enabled)
#firewall-cmd --zone=internal --permanent --add-service=ldap
#firewall-cmd --zone=internal --permanent --add-service=ldaps
# OpenVPN (not enabled)
#firewall-cmd --zone=external --permanent --add-service=openvpn
#firewall-cmd --zone=internal --permanent --add-service=openvpn
# Privoxy
firewall-cmd --zone=internal --permanent --add-service=privoxy
# XMPP
firewall-cmd --zone=external --permanent --add-service=xmpp-server
firewall-cmd --zone=internal --permanent --add-service=xmpp-server
firewall-cmd --zone=external --permanent --add-service=xmpp-client
firewall-cmd --zone=internal --permanent --add-service=xmpp-client
firewall-cmd --zone=external --permanent --add-service=xmpp-bosh
firewall-cmd --zone=internal --permanent --add-service=xmpp-bosh