Non-conntrack udp DNS reply option

ChangeLog

@@ -1,3 +1,7 @@
+0.9.9  - Brielle Bruns <bruns@2mbit.com>
+	- Loadable module support during firewall loading
+	- More init script fixes.
+
 0.9.8a - Brielle Bruns <bruns@2mbit.com>
 	- Fixing executable file permission issues
 	- Use /bin/bash in initscript cause dash does not recognize

Makefile

@@ -1,4 +1,4 @@
-VERSION=0.9.8a
+VERSION=0.9.9
 TAR=/usr/bin/tar
 TARBALL="firewall-sosdg-$(VERSION).tar.bz2"
 

bin/firewall-sosdg

@@ -18,7 +18,7 @@
 #    You should have received a copy of the GNU General Public License
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-FW_VERSION="0.9.8"
+FW_VERSION="0.9.9"
 
 # These option is here to help pre-1.0 users easily upgrade, defines critical defaults
 # that would otherwise require remaking their options file.  I leave this on by default,
@@ -139,6 +139,28 @@ if [ "$TRUSTEDIP" ]; then
 	echo -ne "\n"
 fi
 
+if [ "$DNS_REQUESTS_OUT" ]; then
+	display_c YELLOW "Adding DNS reply allows for trusted DNS servers.."
+	for i in $DNS_REQUESTS_OUT; do
+		if [[ "$i" =~ "|" ]]; then
+			echo "Original variable: ${DNS_REQUESTS_OUT}"
+			IFS_OLD=${IFS};IFS=\|
+			DNSREQ=($i)
+			IFS=${IFS_OLD}
+			SRCIF=${DNSREQ[0]}
+			DNSIP_NUM=${#DNSREQ[@]}
+			DNSIP_COUNT_CURR=1
+			for ((i=$DNSIP_COUNT_CURR; i <= $DNSIP_NUM; i++)); do
+				if [ ${DNSREQ[$i]} ]; then
+					${IPTABLES} -A INPUT -i ${SRCIF} -p udp --sport 53 -s ${DNSREQ[$i]} --destination-port 1024:65535 -j ACCEPT
+				fi
+			done			
+		else
+			{$IPTABLES} -A INPUT -i $i -p udp --sport 53 --destination-port 1024:65535 -j ACCEPT
+		fi
+	done
+fi
+
 if [ -s "$BASEDIR/include/ipv4_custom_blockip" ]; then
 	display_c YELLOW "Loading custom ip block rules..."
 	. "$BASEDIR/include/ipv4_custom_blockip"

options.default

@@ -52,6 +52,11 @@ IPTABLES_MULTIPORT=auto
 #NF_MULTIPORT="xt_multiport"
 #NF_MULTIPORT_MAX_PORTS="7"
 
+# Allow outgoing DNS requests - important if you did not activate connection
+# tracking.  Set this to the interfaces you wish to use for outgoing requests
+# plus the IP addresses of your upstream servers (up to 3) if you need to.
+#DNS_REQUESTS_OUT="eth0|4.2.2.1|4.2.2.2|4.2.2.3 eth1"
+
 # TCP/UDP/Protocol to allow
 TCPPORTS="20 21 22 53 80 113 123 443"
 UDPPORTS="53"