Merge pull request #1067 from pi-hole/fix/firewall_redux

Fix/firewall redux

.idea/codeStyleSettings.xml

@@ -15,8 +15,11 @@
             <option name="USE_RELATIVE_INDENTS" value="false" />
           </value>
         </option>
+        <MarkdownNavigatorCodeStyleSettings>
+          <option name="RIGHT_MARGIN" value="72" />
+        </MarkdownNavigatorCodeStyleSettings>
       </value>
     </option>
     <option name="USE_PER_PROJECT_SETTINGS" value="true" />
   </component>
-</project>
+</project>

automated install/basic-install.sh

@@ -887,11 +887,17 @@ configureFirewall() {
     echo "::: Configuring FirewallD for httpd and dnsmasq.."
     firewall-cmd --permanent --add-port=80/tcp --add-port=53/tcp --add-port=53/udp
     firewall-cmd --reload
-  elif modinfo ip_tables &> /dev/null && iptables -S INPUT | head -n1 | grep -v "ACCEPT" &> /dev/null ; then
-    echo "::: Configuring iptables for httpd and dnsmasq.."
-    iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-    iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-    iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT
+  # Check for proper kernel modules to prevent failure
+  elif modinfo ip_tables &> /dev/null; then
+    # If chain Policy is not ACCEPT or last Rule is not ACCEPT
+    # then check and insert our Rules above the DROP/REJECT Rule.
+    if iptables -S INPUT | head -n1 | grep -qv '^-P.*ACCEPT$' || iptables -S INPUT | tail -n1 | grep -qv '^-\(A\|P\).*ACCEPT$'; then
+      # Check chain first, otherwise a new rule will duplicate old ones
+      echo "::: Configuring iptables for httpd and dnsmasq.."
+      iptables -C INPUT -p tcp -m tcp --dport 80 -j ACCEPT &> /dev/null || iptables -I INPUT 1 -p tcp -m tcp --dport 80 -j ACCEPT
+      iptables -C INPUT -p tcp -m tcp --dport 53 -j ACCEPT &> /dev/null || iptables -I INPUT 1 -p tcp -m tcp --dport 53 -j ACCEPT
+      iptables -C INPUT -p udp -m udp --dport 53 -j ACCEPT &> /dev/null || iptables -I INPUT 1 -p udp -m udp --dport 53 -j ACCEPT
+    fi
   else
     echo "::: No active firewall detected.. skipping firewall configuration."
   fi