how to unset firewall array

[Patrick]

Reminds me… On variable initialization generally…

bash scripts - set -o nounset / -n versus -v

The style… [ -n "$VARNAME" ] || VARNAME="xxx" in Whonix source code served well but is not the most ideal. The following would be a bit better. [[ -v VARNAME ]] || VARNAME="xxx" That is because then scripts could be improved and use: set -o nounset

---

whonix-gateway-firewall currently only using this style:

   ## Socks Ports for per application circuits.
   ## SOCKS_PORT_TOR_DEFAULT
   INTERNAL_OPEN_PORTS+=" 9050 "
   ## SOCKS_PORT_TB
   INTERNAL_OPEN_PORTS+=" 9100 "
   ## SOCKS_PORT_IRC
   INTERNAL_OPEN_PORTS+=" 9101 "

I liked that style because nobody was asking how to remove any such ports ever and because then each port could be easily commented.

It’s run in function variables_defaults. But function source_config_folder runs before that. Therefore you cannot unset it in config but no worries you can do it another way. On top of it there is:

   if [ ! "$WORKSTATION_ALLOW_SOCKSIFIED" = "1" ]; then
      return 0
   fi

So in the gateway firewall config just set:

WORKSTATION_ALLOW_SOCKSIFIED=0

In result, no INTERNAL_OPEN_PORTS will be set at all. Then it would be up to the user to configure INTERNAL_OPEN_PORTS or not use any of these ports.

How does that sound?

@nyxnor

If you are afraid someone will close all their internal firewall ports, then I suggest a new variable INTERNAL_CLOSE_ALL=[0|1].

WORKSTATION_ALLOW_SOCKSIFIED=0 already has the same purpose, good?

@nyxnor

So people will be recommended to use that instead of INTERNAL_OPEN_PORT="" that will reset everything because there is no plug sign.

Then we’d have to check if that variable is unset versus set to "" (empty). Would also be an interesting. Contributions welcome.

@nyxnor

But anyway, maybe it is important to inform in the firewall message that an option to close all ports was set, even if that option is overriden by the next option that includes some ports.

If WORKSTATION_ALLOW_SOCKSIFIED=0 is set for sure would be good to have an info message for that.

@nyxnor

This is targeted to single use Workstations that should only have access to the internet if a socksport is specified to the application.

Disable Transparent Proxying?