
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# Private network addresses need to be blocked AFTER DHCP clients and
# BEFORE any service uses the "any/0" wildcard.
#
#-----------------------------------------------------------------------
# CHANGES
#-----------------------------------------------------------------------
#
# 2000-11-23  Jean-Sebastien Morisset <jsmoriss@jsm-mv.dyndns.org>
#             Initial module written for v5.1.
#
#-----------------------------------------------------------------------
# START OF MODULE CODE
#-----------------------------------------------------------------------

# Do NOT filter-out private IPs on DMZ *interfaces*. This would stop LAN
# traffic from reaching DMZ servers. Virtual interfaces are also excluded
# since they're not routed in the first place. :-)
#
if [ "$VIRTUAL" = "no" -a \
	"`echo \"$DMZ_INTERFACES\"|egrep -c \"(^| )$INTERFACE( |\$)\"`" -eq "0" ]
then
	echo "Deny/Reject $INTOPT <-> Private Networks (logged)"

	ipchains -A $INCHAIN  -j DENY -s $CLASS_A_PRIVATE -l
	ipchains -A $INCHAIN  -j DENY -d $CLASS_A_PRIVATE -l
	ipchains -A $OUTCHAIN -j REJECT -s $CLASS_A_PRIVATE -l
	ipchains -A $OUTCHAIN -j REJECT -d $CLASS_A_PRIVATE -l

	ipchains -A $INCHAIN  -j DENY -s $CLASS_B_PRIVATE -l
	ipchains -A $INCHAIN  -j DENY -d $CLASS_B_PRIVATE -l
	ipchains -A $OUTCHAIN -j REJECT -s $CLASS_B_PRIVATE -l
	ipchains -A $OUTCHAIN -j REJECT -d $CLASS_B_PRIVATE -l

	ipchains -A $INCHAIN  -j DENY -s $CLASS_C_PRIVATE -l
	ipchains -A $INCHAIN  -j DENY -d $CLASS_C_PRIVATE -l
	ipchains -A $OUTCHAIN -j REJECT -s $CLASS_C_PRIVATE -l
	ipchains -A $OUTCHAIN -j REJECT -d $CLASS_C_PRIVATE -l

	ipchains -A $INCHAIN  -j DENY -s $CLASS_E_RESERVED_NET -l
fi

