### Copyright (C) 1997 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: defaultinetpolicy.template,v 2.10 1999-04-09 19:25:46-07 jhardin Exp $


proc defaultinetpolicy {} {
    # Placeholder

    Desc "Default Internet Policy generator placeholder"

    ShortDesc "Default Internet Policy"

    Label label1 -text "This screen is just a placeholder for some code generation functions."

    Save {
      global IPFWADM
      global ISPPort
      global LocalNetIP
      global DialdPort
      if {$IPFWADM == "" || $ISPPort == ""} {
        # nothing
      } else {
        set TraceroutePorts "33434:33523"
	if { ${general@outboundtraceroute} } {
	  # allow outbound traceroute UDP packets on the internet interface
	  print "# allow traceroute to send packets to the Internet"
          print $IPFWADM "-O -a accept \$INET -P udp -S \$INET_IP -D \$ANY $TraceroutePorts"
          if {${isp@on_internet}} {
	    if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
              print $IPFWADM "-F -a accept \$INET -P udp -S \$LNET -D \$ANY $TraceroutePorts"
              print $IPFWADM "-O -a accept \$INET -P udp -S \$LNET -D \$ANY $TraceroutePorts"
            }
          }
	}
	if { ${general@inboundtraceroute} } {
	  # allow inbound traceroute UDP packets on the internet interface
	  print "# allow traceroute packets in from the Internet - SECURITY RISK"
          print $IPFWADM "-I -a accept \$INET -P udp -S \$ANY -D \$INET_IP $TraceroutePorts"
          if {${isp@on_internet}} {
	    if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
              print $IPFWADM "-I -a accept \$INET -P udp -S \$ANY -D \$LNET $TraceroutePorts"
              print $IPFWADM "-F -a accept \$LETH -P udp -S \$ANY -D \$LNET $TraceroutePorts"
            }
          }
	}
        print ""
        if { [set general@defaultpolicy(index)] == 1 } {
          # default policy is accept.
	  if { ${general@blockinettcp} } {
	    # deny TCP on the internet interface
	    print "# default block TCP to/from the Internet"
            print $IPFWADM "-I -a deny -o \$INET -P tcp"
            print $IPFWADM "-O -a reject \$INET -P tcp"
	  }
	  if { ${general@blockinetudp} } {
	    # deny UDP on the internet interface
	    print "# default block UDP to/from the Internet"
            print $IPFWADM "-I -a deny -o \$INET -P udp"
            print $IPFWADM "-O -a reject \$INET -P udp"
	  }
          # default policy is accept. open things up.
          print "\n# Default policy: allow all traffic unless explicitly blocked"
          print $IPFWADM "-I -p accept"
          print $IPFWADM "-O -p accept"
          if {${masq@masquerade} == 0 && ${isp@on_internet}} {
            print $IPFWADM "-F -p accept"
          }
        } else {
	  print "# Default policy is DENY"
	  print "# Allow all local-net traffic in via the local network interface"
	  print "# Use \"Local Network Access To Firewall\" options above to control"
	  print "# local-network host access to the firewall itself"
          print $IPFWADM "-I -a accept \$LETH -S \$LNET"
          print $IPFWADM "-O -a accept \$LETH -D \$LNET"
	  print "# Allow all loopback traffic"
          print $IPFWADM "-I -a accept -W lo"
          print $IPFWADM "-O -a accept -W lo"
	  if {$DialdPort != ""} {
	    print "# Diald in use - allow all sl0 traffic"
            print $IPFWADM "-I -a accept -W sl0"
            print $IPFWADM "-O -a accept -W sl0"
          }
	  print "# Allow ICMP traffic (important to network operation)"
	  print "# Block echo requests explicitly somewhere above if you don't like PING"
          print $IPFWADM "-I -a accept -P icmp"
          print $IPFWADM "-F -a accept -P icmp"
          print $IPFWADM "-O -a accept -P icmp"
	  print "# deny everything else (done here so it will be logged)"
	  print "# deny inbound from Internet quietly to impede scans, etc."
          print $IPFWADM "-I -a deny -o \$INET"
	  print "# reject everything else with an error message to aid debugging"
          print $IPFWADM "-I -a reject -o"
          print $IPFWADM "-F -a reject -o"
          print $IPFWADM "-O -a reject -o"
        }
      }

      print "#"
      print "# End of Firewall Configuration"
    }
}
