IPCop - Blocking PING on red interface

The above wasn't working on initial boot of IPCop because the ppp0 device doesn't exist at the time.

This works great together with the BlockOutTraffic MOD which flushes the CUSTOMINPUT chain when called.

If you aren using that MOD then you'll have to flush it yourself.

So I changed /etc/rc.d/rc.firewall.local to this:

-------------------------------- cut here -------------------------------- #!/bin/sh # Used for private firewall rules # # Drop pings coming in on the RED interface for stealth. # # CUSTOMINPUT is checked before the INPUT chains's default of ACCEPT #

eval $(/usr/local/bin/readhash /var/ipcop/ppp/settings) eval $(/usr/local/bin/readhash /var/ipcop/ethernet/settings) IFACE=`/bin/cat /var/ipcop/red/iface 2> /dev/null | /usr/bin/tr -d '\\012'` if [ -f /var/ipcop/red/device ]; then DEVICE=`/bin/cat /var/ipcop/red/device 2> /dev/null | /usr/bin/tr -d '\\012'` fi

LOGGER="/usr/bin/logger -p daemon.info -t rc.firewall.local -i"

iptables_red() { if [ "$IFACE" != "" ]; then if [ -f /var/ipcop/red/active ]; then # Interface exists and it is active $LOGGER "DROP ping on RED interface: $IFACE." /sbin/iptables -A CUSTOMINPUT -p icmp --icmp-type 8 -i $IFACE -j DROP else # Interface exists but not active, happens on a disconnect. $LOGGER "RED interface $IFACE exists but not active." fi else $LOGGER "RED interface not defined yet." fi }

# See how we were called. case "$1" in start) $LOGGER "Load custom rules" ## add your 'start' rules here #Added for BlockOutTraffic - BEGIN /usr/local/bin/setfwrules #Added for BlockOutTraffic - END iptables_red ;; stop) ## add your 'stop' rules here ;; reload) $LOGGER "Reload custom rules" ## add your 'reload' rules here # # /sbin/iptables -F CUSTOMINPUT # iptables_red # # BlockOutTraffic flushes the CUSTOMINPUT chain # so ust start the local rules again $0 start ;; *) echo "Usage: $0 {start|reload|stop}" esac

-------------------------------- cut here --------------------------------

Hope this helps someone else.

Bill