version 2.13, 2005/01/16 11:06:10 |
version 2.19, 2005/03/01 23:17:11 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.12 2005/01/16 10:55:39 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.18 2005/03/01 21:47:20 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
Line 48 AWK="${AWK:=/usr/bin/awk}" |
|
Line 48 AWK="${AWK:=/usr/bin/awk}" |
|
LO_IFACE="${LO_IFACE:=lo}" |
LO_IFACE="${LO_IFACE:=lo}" |
LO_IP="IP_$LO_IFACE" |
LO_IP="IP_$LO_IFACE" |
|
|
# Which ports will be allowed on INPUT (TCP connections) |
# |
ALL_ACCEPT_INPUT_TCP="${ALL_ACCEPT_INPUT_TCP:=}" |
# CONSTANTS - Do not edit |
# interface eth0 |
# |
eth0_ACCEPT_INPUT_TCP="${eth0_ACCEPT_INPUT_TCP:=}" |
ANYWHERE="0.0.0.0/0" # Match any IP address |
# interface ppp0 |
BROADCAST_SRC="0.0.0.0" # Broadcast Source Address |
ppp0_ACCEPT_INPUT_TCP="${ppp0_ACCEPT_INPUT_TCP:=}" |
BROADCAST_DEST="255.255.255.255" # Broadcast Destination Address |
|
CLASS_A="10.0.0.0/8" # Class-A Private (RFC-1918) Networks |
# Which ports will be allowed on INPUT (UDP connections) |
CLASS_B="172.16.0.0/12" # Class-B Private (RFC-1918) Networks |
# interface eth0 |
CLASS_C="192.168.0.0/16" # Class-C Private (RFC-1918) Networks |
eth0_ACCEPT_INPUT_UDP="${eth0_ACCEPT_INPUT_UDP:=}" |
CLASS_D_MULTICAST="224.0.0.0/4" # Class-D Multicast Addresses |
# interface ppp0 |
CLASS_E_RESERVED_NET="240.0.0.0/5" # Class-E Reserved Addresses |
ppp0_ACCEPT_INPUT_UDP="${ppp0_ACCEPT_INPUT_UDP:=}" |
PRIVPORTS="0:1023" # Well-Known, Privileged Port Range |
|
UNPRIVPORTS="1024:65535" # Unprivileged Port Range |
|
TRACEROUTE_SRC_PORTS="32769:65535" # Traceroute Source Ports |
|
TRACEROUTE_DEST_PORTS="33434:33523" # Traceroute Destination Ports |
|
|
|
|
# allow some ICMP packets - needed for ping etc. |
# allow some ICMP packets - needed for ping etc. |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
|
|
|
|
# load necessary modules from $MODULES variable |
# load necessary modules from $MODULES variable |
load_modules() |
load_modules() |
{ # {{{ |
{ # {{{ |
|
|
for table in filter nat mangle; do |
for table in filter nat mangle; do |
$IPTABLES -t $table -F # clear all chains |
$IPTABLES -t $table -F # clear all chains |
$IPTABLES -t $table -X # remove all chains |
$IPTABLES -t $table -X # remove all chains |
|
$IPTABLES -t $table -Z # zero counts |
done |
done |
|
|
} # }}} |
} # }}} |
|
|
# all packets on loopback are accpted |
|
set_loopback() |
|
{ # {{{ |
|
$IPTABLES -A INPUT -j ACCEPT -i $LO_IFACE |
|
$IPTABLES -A OUTPUT -j ACCEPT -o $LO_IFACE |
|
} # }}} |
|
|
|
# DROP packages from nmap(1) |
# DROP packages from nmap(1) |
nmap_scan_filter() |
nmap_scan_filter() |
{ # {{{ |
{ # {{{ |
|
|
|
|
# alow packets from private subnet |
# alow packets from private subnet |
$IPTABLES -A FORWARD -s ! $localnet -i $NAT_SUBNET_IFACE -j DROP |
$IPTABLES -A FORWARD -s ! $localnet -i $NAT_SUBNET_IFACE -j DROP |
|
for client_ip in $NAT_CLIENT_DROP; do |
|
echo -en " !$client_ip"; |
|
$IPTABLES -A FORWARD -s $client_ip -i $NAT_SUBNET_IFACE -j DROP |
|
done |
|
|
for redirect in $NAT_TCP_PORT_REDIRECT; do |
for redirect in $NAT_TCP_PORT_REDIRECT; do |
eval `echo $redirect | awk -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
eval `echo $redirect | awk -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
|
|
#$IPTABLES -A FORWARD -p ICMP -j LOG --log-prefix "FWD ICMP: " |
#$IPTABLES -A FORWARD -p ICMP -j LOG --log-prefix "FWD ICMP: " |
echo " done." |
echo " done." |
|
|
|
# Port forwarding to local machines |
|
if [ ! -z "$NAT_TCP_PORT_FORWARD" ]; then |
|
echo -en "\tForwarding ports to local machines:" |
|
for redirect in $NAT_TCP_PORT_FORWARD; do |
|
eval `echo $redirect | awk -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
|
echo -en " $src_port -> $local_machine:$dest_port" |
|
$IPTABLES -t nat -A PREROUTING -p TCP -i $NAT_LAN_IFACE -d ${!lan_ip} \ |
|
--dport $src_port -j DNAT --to $local_machine:$dest_port |
|
$IPTABLES -A FORWARD -p TCP -i eth0 -d $local_machine --dport $dest_port -j ACCEPT |
|
done |
|
echo " done." |
|
fi |
|
|
# Keep state of connections from private subnets |
# Keep state of connections from private subnets |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
|
|
|
|
} # }}} |
} # }}} |
|
|
allow_input() |
allow_accept_all() |
{ # {{{ |
{ # {{{ |
|
|
if [ ! -z "$IFACE_ACCEPT_ALL" ]; then |
if [ ! -z "$IFACE_ACCEPT_ALL" ]; then |
echo -en "Accepting ALL packets on interfaces:" |
echo -en "Accepting ALL packets on interfaces:" |
for iface in $IFACE_ACCEPT_ALL; do |
for iface in $IFACE_ACCEPT_ALL; do |
|
|
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
} # }}} |
|
|
|
allow_input() |
|
{ # {{{ |
|
|
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
echo -en "Accepting ALL INPUT TCP connections on ports:" |
echo -en "Accepting ALL INPUT TCP connections on ports:" |
|
|
fi |
fi |
done |
done |
|
|
|
# Enable outgoing TRACEROUTE requests (required e.g. by Skype, http://www.skype.com) |
|
if [ ! -z "$TRACEROUTE_IFACE" ]; then |
|
ip="IP_$ANTISPOOF_IFACE"; |
|
echo -en "Accepting traceroute:" |
|
|
|
$IPTABLES -A OUTPUT -o $ANTISPOOF_IFACE -p UDP \ |
|
--sport $TRACEROUTE_SRC_PORTS --dport $TRACEROUTE_DEST_PORTS \ |
|
-s ${!ip} -d $ANYWHERE -j ACCEPT |
|
|
|
for iface in $TRACEROUTE_IFACE; do |
|
$IPTABLES -A FORWARD -p UDP -i $iface --sport $TRACEROUTE_SRC_PORTS \ |
|
--dport $TRACEROUTE_DEST_PORTS -j ACCEPT |
|
done |
|
echo " done." |
|
fi |
|
|
} # }}} |
} # }}} |
|
|
# ACCEPT all packets from our IP address |
# ACCEPT all packets from our IP address |
Line 594 parse_ifconfig() |
|
Line 629 parse_ifconfig() |
|
parse_ifconfig |
parse_ifconfig |
print_iface_status |
print_iface_status |
|
|
# $interfaces - all interfaces |
# |
|
# Split interfaces into 2 groups: |
|
# |
|
# $INTERFACES_ACCEPT_ALL - interfaces withouth restrictions |
|
# |
# $INTERFACES - all interfaces withouth loopback |
# $INTERFACES - all interfaces withouth loopback |
|
# and devices without restrictions (e.g. tun0 tun1 tap0 ...) |
|
# |
|
# list of all interfaces is in $interfaces variable |
|
# |
INTERFACES="" |
INTERFACES="" |
|
INTERFACES_ACCEPT_ALL="" |
|
regexp='^\('`echo $IFACE_ACCEPT_ALL | sed 's/ /\\\|/g; s/+/.*/g;'`'\)$' |
for iface in $interfaces; do |
for iface in $interfaces; do |
if [ "o$iface" = "olo" ]; then continue; fi |
#if [ "o$iface" = "olo" ]; then continue; fi |
INTERFACES="$INTERFACES $iface"; |
echo $iface | grep -q -e "$regexp" |
|
if [ $? = 0 ] || [ "o$iface" = "olo" ]; then # lo interface is always here |
|
INTERFACES_ACCEPT_ALL="$INTERFACES_ACCEPT_ALL $iface"; |
|
else |
|
INTERFACES="$INTERFACES $iface"; |
|
fi |
done |
done |
|
|
|
|
|
|
# |
# |
# (un)commnet next lines as needed |
# (un)commnet next lines as needed |
# |
# |
set_loopback |
allow_accept_all |
nmap_scan_filter |
nmap_scan_filter |
invalid_packet_filter |
invalid_packet_filter |
anti_spoof_filter |
anti_spoof_filter |