/usr/lib/freedombox/first-run.d/90_firewall is in plinth 0.8.1-1.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 | #!/bin/sh
#
# This file is part of Plinth.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# Enable tracing to see the commands in
# /var/log/freedombox-first-run.log
set -x
# Set the default firewall zone. When network connections are
# configured outside of FreedomBox/Plinth, they will not be able to
# serve the Plinth web interface. This is because all such interfaces
# will fall in the default firewall zone and that is, by default,
# 'public'. On 'public' zone we don't allow Plinth web interface as
# this zone is not managed.
#
# Configuration of network connections happen outside for
# FreedomBox/Plinth for various reasons:
#
# - Existing network connections before installation of
# freedombox-setup
#
# - Connections configured in /etc/network/interfaces
#
# - Connections manually configured using nmtui
#
# - Connections created using GUI environments such as GNOME
#
# Rather then clearing out /etc/network/interfaces during setup and
# expecting the connections not to be created outside of Plinth,
# setting the default firewall zone is a better approach. This
# default zone selection fits with the main purpose of FreedomBox to
# be a router which is also reflected by the fact that only 'external'
# and 'internal' zones are managed.
firewall-cmd --set-default-zone=external
# Setup firewall rules for all the services enabled by default.
# Ideally all non-essential services are enabled from Plinth which
# automatically takes care of enabling appropirate firewall ports. The
# following is then for essential services and services that are not
# yet configurable from Plinth.
# HTTP (JWChat, ownCloud)
firewall-cmd --zone=external --permanent --add-service=http
firewall-cmd --zone=internal --permanent --add-service=http
# HTTPS (Plinth, JWChat, ownCloud)
firewall-cmd --zone=external --permanent --add-service=https
firewall-cmd --zone=internal --permanent --add-service=https
# Tor
firewall-cmd --zone=internal --permanent --add-service=tor-socks
# NTP
firewall-cmd --zone=internal --permanent --add-service=ntp
# DNS
firewall-cmd --zone=internal --permanent --add-service=dns
# mDNS
firewall-cmd --zone=internal --permanent --add-service=mdns
# DHCP
firewall-cmd --zone=internal --permanent --add-service=dhcp
# Bootp Server and Client (not enabled)
#firewall-cmd --zone=internal --permanent --add-port=67/tcp
#firewall-cmd --zone=internal --permanent --add-port=67/udp
#firewall-cmd --zone=internal --permanent --add-port=68/tcp
#firewall-cmd --zone=internal --permanent --add-port=68/udp
# LDAP (not enabled)
#firewall-cmd --zone=internal --permanent --add-service=ldap
#firewall-cmd --zone=internal --permanent --add-service=ldaps
# OpenVPN (not enabled)
#firewall-cmd --zone=external --permanent --add-service=openvpn
#firewall-cmd --zone=internal --permanent --add-service=openvpn
# Privoxy
firewall-cmd --zone=internal --permanent --add-service=privoxy
# XMPP
firewall-cmd --zone=external --permanent --add-service=xmpp-server
firewall-cmd --zone=internal --permanent --add-service=xmpp-server
firewall-cmd --zone=external --permanent --add-service=xmpp-client
firewall-cmd --zone=internal --permanent --add-service=xmpp-client
firewall-cmd --zone=external --permanent --add-service=xmpp-bosh
firewall-cmd --zone=internal --permanent --add-service=xmpp-bosh
|