05-isolatedlans

#!/bin/bash

# Source networking configuration.
. /etc/clearos/network.conf

# Bail if not ipv4
if [ "$FW_PROTO" != 'ipv4' ]; then
    return 0
fi

if [ -n "$LANIF" ]; then

    # Add isolation rules
    for iLAN in $LANIF; do
        for oLAN in $LANIF; do
            if [ "$iLAN" != "$oLAN" ]; then
                $IPTABLES -I FORWARD -i $iLAN -o $oLAN -j DROP
            fi
        done
    done

fi

# Really all the above should be inserted below the existing "RELATED,ESTABLISHED" rule
#  but this is a dirty fix. Delete the existing and add a new one.
$IPTABLES -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT