version 2.33, 2006/01/09 23:24:45 |
version 2.41, 2006/03/04 02:43:23 |
|
|
# Can be started by init or by hand. |
# Can be started by init or by hand. |
# |
# |
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk> |
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk> |
# Copyright (c) 2003-2005 Platon SDG, http://platon.sk/ |
# Copyright (c) 2003-2006 Platon SDG, http://platon.sk/ |
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
Line 78 TRACEROUTE_DEST_PORTS="33434:33523" # Tr |
|
Line 78 TRACEROUTE_DEST_PORTS="33434:33523" # Tr |
|
# allow some ICMP packets - needed for ping etc. |
# allow some ICMP packets - needed for ping etc. |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
|
|
|
print_first() |
|
{ # {{{ |
|
echo $1 |
|
} # }}} |
|
|
|
get_first_ip_addr() |
|
{ # {{{ |
|
varname="$1" |
|
print_first `echo ${!varname} | sort -g` |
|
} # }}} |
|
|
# load necessary modules from $MODULES variable |
# load necessary modules from $MODULES variable |
load_modules() |
load_modules() |
|
|
fi |
fi |
|
|
config=`cat $DEFAULT_FIREWALL_CONFIG`; |
config=`cat $DEFAULT_FIREWALL_CONFIG`; |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | awk '{ print $1; }'`; |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{ print $1; }'`; |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
|
|
#echo "CACHE_FILE=$CACHE_FILE" |
#echo "CACHE_FILE=$CACHE_FILE" |
Line 132 print_iface_status() |
|
Line 142 print_iface_status() |
|
# Print interfaces: |
# Print interfaces: |
echo "# iface | IP addr | Gateway | broadcast | netmask | HW addr" |
echo "# iface | IP addr | Gateway | broadcast | netmask | HW addr" |
for iface in $interfaces; do |
for iface in $interfaces; do |
IP="IP_$iface"; Gateway="Gateway_$iface"; Bcast="Bcast_$iface"; Mask="Mask_$iface"; HWaddr="HWaddr_$iface"; |
IPS="IP_$iface"; |
echo "$iface | ${!IP} | ${!Gateway} | ${!Bcast} | ${!Mask} | ${!HWaddr}" |
for IP in ${!IPS}; do |
|
Gateway="Gateway_$iface"; Bcast="Bcast_$iface"; Mask="Mask_$iface"; HWaddr="HWaddr_$iface"; |
|
echo "$iface | ${IP} | ${!Gateway} | ${!Bcast} | ${!Mask} | ${!HWaddr}" |
|
done |
done |
done |
} # }}} |
} # }}} |
|
|
|
|
echo " done." |
echo " done." |
echo -en "NAT: Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE" |
echo -en "NAT: Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE" |
|
|
ip="IP_$NAT_SUBNET_IFACE"; |
ip="`get_first_ip_addr IP_$NAT_SUBNET_IFACE`" |
netmask="Mask_$NAT_SUBNET_IFACE" |
netmask="Mask_$NAT_SUBNET_IFACE" |
localnet="${!ip}/${!netmask}" |
localnet="$ip/${!netmask}" |
|
|
lan_ip="IP_$NAT_LAN_IFACE" |
lan_ip="`get_first_ip_addr IP_$NAT_LAN_IFACE`" |
|
|
# alow packets from private subnet |
# alow packets from private subnet |
$IPTABLES -A FORWARD -s ! $localnet -i $NAT_SUBNET_IFACE -j DROP |
$IPTABLES -A FORWARD -s ! $localnet -i $NAT_SUBNET_IFACE -j DROP |
|
|
done |
done |
|
|
for redirect in $NAT_TCP_PORT_REDIRECT; do |
for redirect in $NAT_TCP_PORT_REDIRECT; do |
eval `echo $redirect | awk -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
eval `echo $redirect | $AWK -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
echo -en " $remote_port:$local_port" |
echo -en " $remote_port:$local_port" |
$IPTABLES -t nat -A PREROUTING -p TCP \ |
$IPTABLES -t nat -A PREROUTING -p TCP \ |
-i ! $NAT_LAN_IFACE -d ! ${!lan_ip} \ |
-i ! $NAT_LAN_IFACE -d ! $lan_ip \ |
--dport $remote_port -j REDIRECT --to-port $local_port |
--dport $remote_port -j REDIRECT --to-port $local_port |
done |
done |
|
|
|
|
if [ ! -z "$NAT_TCP_PORT_FORWARD" ]; then |
if [ ! -z "$NAT_TCP_PORT_FORWARD" ]; then |
echo -en "\tForwarding ports to local machines:" |
echo -en "\tForwarding ports to local machines:" |
for redirect in $NAT_TCP_PORT_FORWARD; do |
for redirect in $NAT_TCP_PORT_FORWARD; do |
eval `echo $redirect | awk -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
eval `echo $redirect | $AWK -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
echo -en " $src_port -> $local_machine:$dest_port" |
echo -en " $src_port -> $local_machine:$dest_port" |
$IPTABLES -t nat -A PREROUTING -p TCP -i $NAT_LAN_IFACE -d ${!lan_ip} \ |
$IPTABLES -t nat -A PREROUTING -p TCP -i $NAT_LAN_IFACE -d $lan_ip \ |
--dport $src_port -j DNAT --to $local_machine:$dest_port |
--dport $src_port -j DNAT --to $local_machine:$dest_port |
$IPTABLES -A FORWARD -p TCP -i eth0 -d $local_machine --dport $dest_port -j ACCEPT |
$IPTABLES -A FORWARD -p TCP -i $NAT_LAN_IFACE -d $local_machine --dport $dest_port -j ACCEPT |
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
|
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
|
|
# hide NAT clients behind firewall: - set TTL |
|
# XXX: warning: this breaks traceroute !!! |
|
if [ "e$NAT_SET_TTL" = "eyes" ]; then |
|
echo "NAT: clients hidden behind firewall - setting TTL" |
|
$IPTABLES -t mangle -A POSTROUTING -o $NAT_LAN_IFACE -j TTL --ttl-set 64 |
|
fi |
|
|
|
|
fi |
fi |
} # }}} |
} # }}} |
|
|
|
|
{ # {{{ |
{ # {{{ |
|
|
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
|
drop_output_tcp="${iface}_DROP_OUTPUT_TCP" |
drop_output_tcp="${iface}_DROP_OUTPUT_TCP" |
DROP_OUTPUT_TCP="${!drop_output_tcp}" |
DROP_OUTPUT_TCP="${!drop_output_tcp}" |
drop_output_udp="${iface}_DROP_OUTPUT_UDP" |
drop_output_udp="${iface}_DROP_OUTPUT_UDP" |
|
|
echo -en "Accepting ALL INPUT TCP connections on ports:" |
echo -en "Accepting ALL INPUT TCP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_TCP; do |
for port in $ALL_ACCEPT_INPUT_TCP; do |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
|
echo -en " $port($iface)" |
echo -en " $port($iface)" |
$IPTABLES -A INPUT -i $iface -d ${!ip} -p TCP --dport $port -j ACCEPT |
IPS="IP_$iface"; |
|
for ip in ${!IPS}; do |
|
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j ACCEPT |
|
done |
done |
done |
done |
done |
echo " done." |
echo " done." |
|
|
echo -en "Accepting ALL INPUT UDP connections on ports:" |
echo -en "Accepting ALL INPUT UDP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_UDP; do |
for port in $ALL_ACCEPT_INPUT_UDP; do |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
|
echo -en " $port($iface)" |
echo -en " $port($iface)" |
$IPTABLES -A INPUT -i $iface -p UDP --dport $port -j ACCEPT |
IPS="IP_$iface"; |
|
for ip in ${!IPS}; do |
|
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j ACCEPT |
|
done |
done |
done |
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
|
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
IPS="IP_$iface"; |
|
|
|
redirect_tcp="${iface}_REDIRECT_TCP" |
|
REDIRECT_TCP="${!redirect_tcp}" |
|
redirect_udp="${iface}_REDIRECT_UDP" |
|
REDIRECT_UDP="${!redirect_udp}" |
|
|
accept_input_tcp="${iface}_ACCEPT_INPUT_TCP" |
accept_input_tcp="${iface}_ACCEPT_INPUT_TCP" |
ACCEPT_INPUT_TCP="${!accept_input_tcp}" |
ACCEPT_INPUT_TCP="${!accept_input_tcp}" |
accept_input_udp="${iface}_ACCEPT_INPUT_UDP" |
accept_input_udp="${iface}_ACCEPT_INPUT_UDP" |
ACCEPT_INPUT_UDP="${!accept_input_udp}" |
ACCEPT_INPUT_UDP="${!accept_input_udp}" |
|
|
|
if [ ! -z "$REDIRECT_TCP" ]; then |
|
echo -en "$iface: redirecting TCP connections:" |
|
ip="`get_first_ip_addr IP_$iface`"; |
|
for redirect in $REDIRECT_TCP; do |
|
eval `echo $redirect | \ |
|
$AWK -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
|
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
|
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
|
echo -en " $remote_ip:$from_port->$to_port" |
|
$IPTABLES -t nat -A PREROUTING -p TCP -i $iface -s $remote_ip -d $ip --dport $from_port -j REDIRECT --to-port $to_port |
|
done |
|
echo " done." |
|
fi |
|
|
|
if [ ! -z "$REDIRECT_UDP" ]; then |
|
echo -en "$iface: redirecting UDP connections:" |
|
ip="`get_first_ip_addr IP_$iface`"; |
|
for redirect in $REDIRECT_UDP; do |
|
eval `echo $redirect | \ |
|
$AWK -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
|
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
|
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
|
echo -en " $remote_ip:$from_port->$to_port" |
|
$IPTABLES -t nat -A PREROUTING -p UDP -i $iface -s $remote_ip -d $ip --dport $from_port -j REDIRECT --to-port $to_port |
|
done |
|
echo " done." |
|
fi |
|
|
if [ ! -z "$ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ACCEPT_INPUT_TCP" ]; then |
echo -en "$iface: Accepting INPUT TCP connections on ports:" |
echo -en "$iface: Accepting INPUT TCP connections on ports:" |
for port in $ACCEPT_INPUT_TCP; do |
for port in $ACCEPT_INPUT_TCP; do |
echo -en " $port" |
echo -en " $port" |
$IPTABLES -A INPUT -i $iface -d ${!ip} -p TCP --dport $port -j ACCEPT |
for ip in ${!IPS}; do |
|
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j ACCEPT |
|
done |
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
|
echo -en " $port" |
echo -en " $port" |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
$IPTABLES -A INPUT -i $iface -p UDP --dport $port -j ACCEPT |
for ip in ${!IPS}; do |
|
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j ACCEPT |
|
done |
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
|
|
|
# Enable outgoing TRACEROUTE requests (required e.g. by Skype, http://www.skype.com) |
# Enable outgoing TRACEROUTE requests (required e.g. by Skype, http://www.skype.com) |
if [ ! -z "$TRACEROUTE_IFACE" ]; then |
if [ ! -z "$TRACEROUTE_IFACE" ]; then |
ip="IP_$ANTISPOOF_IFACE"; |
ip="`get_first_ip_addr IP_$ANTISPOOF_IFACE`"; |
echo -en "Accepting traceroute:" |
echo -en "Accepting traceroute:" |
|
|
$IPTABLES -A OUTPUT -o $ANTISPOOF_IFACE -p UDP \ |
$IPTABLES -A OUTPUT -o $ANTISPOOF_IFACE -p UDP \ |
--sport $TRACEROUTE_SRC_PORTS --dport $TRACEROUTE_DEST_PORTS \ |
--sport $TRACEROUTE_SRC_PORTS --dport $TRACEROUTE_DEST_PORTS \ |
-s ${!ip} -d $ANYWHERE -j ACCEPT |
-s $ip -d $ANYWHERE -j ACCEPT |
|
|
for iface in $TRACEROUTE_IFACE; do |
for iface in $TRACEROUTE_IFACE; do |
$IPTABLES -A FORWARD -p UDP -i $iface --sport $TRACEROUTE_SRC_PORTS \ |
$IPTABLES -A FORWARD -p UDP -i $iface --sport $TRACEROUTE_SRC_PORTS \ |
|
|
# Povolíme odchozí pakety, které mají naše IP adresy |
# Povolíme odchozí pakety, které mají naše IP adresy |
echo -en "Accepting OUTPUT packets from" |
echo -en "Accepting OUTPUT packets from" |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
IPS="IP_$iface"; |
echo -en " ${!ip}($iface)" |
for ip in ${!IPS}; do |
$IPTABLES -A OUTPUT -o $iface -s ${!ip} -j ACCEPT |
echo -en " $ip($iface)" |
|
$IPTABLES -A OUTPUT -o $iface -s $ip -j ACCEPT |
|
done |
done; |
done; |
echo " done."; |
echo " done."; |
|
|
|
|
for type in $ACCEPT_ICMP_PACKETS; do |
for type in $ACCEPT_ICMP_PACKETS; do |
echo -en " $type" |
echo -en " $type" |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
IPS="IP_$iface"; |
$IPTABLES -A INPUT -i $iface -d ${!ip} -p ICMP --icmp-type $type -j ACCEPT |
for ip in ${!IPS}; do |
|
$IPTABLES -A INPUT -i $iface -d $ip -p ICMP --icmp-type $type -j ACCEPT |
|
done |
done |
done |
done |
done |
#$IPTABLES_LOG -A INPUT -p ICMP -j LOG --log-prefix "IN ICMP: " |
#$IPTABLES_LOG -A INPUT -p ICMP -j LOG --log-prefix "IN ICMP: " |
Line 669 do_ip_accounting() |
|
Line 735 do_ip_accounting() |
|
$IPTABLES -N $IPACCT_OUT_NAME # upload: from client to server |
$IPTABLES -N $IPACCT_OUT_NAME # upload: from client to server |
$IPTABLES -A $IPACCT_OUT_NAME |
$IPTABLES -A $IPACCT_OUT_NAME |
|
|
ip="IP_$NAT_SUBNET_IFACE"; |
ip="`get_first_ip_addr IP_$NAT_SUBNET_IFACE`"; |
netmask="Mask_$NAT_SUBNET_IFACE" |
netmask="Mask_$NAT_SUBNET_IFACE" |
localnet="${!ip}/${!netmask}" |
localnet="$ip/${!netmask}" |
|
|
$IPTABLES -I INPUT -i $NAT_LAN_IFACE -j $IPACCT_IN_NAME |
$IPTABLES -I INPUT -i $NAT_LAN_IFACE -j $IPACCT_IN_NAME |
$IPTABLES -I OUTPUT -o $NAT_LAN_IFACE -j $IPACCT_OUT_NAME |
$IPTABLES -I OUTPUT -o $NAT_LAN_IFACE -j $IPACCT_OUT_NAME |
Line 684 do_ip_accounting() |
|
Line 750 do_ip_accounting() |
|
$IPTABLES -A $IPACCT_NAME -d $client_ip |
$IPTABLES -A $IPACCT_NAME -d $client_ip |
done |
done |
|
|
|
if [ ! "x$DO_LOCAL_IP_ACCOUNTING" = "xno" ]; then |
|
accountig_ports=`echo "$NAT_TCP_PORT_REDIRECT " | $AWK -v RS=' ' -v FS=: '{ print $2; }' | sort -u -r -g ` |
|
for port in $accountig_ports; do |
|
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p TCP --dport $port -j $IPACCT_NAME |
|
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p UDP --dport $port -j $IPACCT_NAME |
|
$IPTABLES -I OUTPUT -o $NAT_SUBNET_IFACE -p TCP --sport $port -j $IPACCT_NAME |
|
$IPTABLES -I OUTPUT -o $NAT_SUBNET_IFACE -p UDP --sport $port -j $IPACCT_NAME |
|
done |
|
fi |
|
|
$IPTABLES -A $IPACCT_NAME -s $localnet |
$IPTABLES -A $IPACCT_NAME -s $localnet |
$IPTABLES -A $IPACCT_NAME -d $localnet |
$IPTABLES -A $IPACCT_NAME -d $localnet |
|
|
Line 697 accept_related() |
|
Line 773 accept_related() |
|
|
|
echo -en "Accepting ESTABLISHED, RELATED packets for IP:" |
echo -en "Accepting ESTABLISHED, RELATED packets for IP:" |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
IPS="IP_$iface"; |
echo -en " ${!ip}($iface)" |
for ip in ${!IPS}; do |
|
echo -en " $ip($iface)" |
|
done |
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
done |
done |
Line 723 parse_ifconfig() |
|
Line 801 parse_ifconfig() |
|
{ # {{{ |
{ # {{{ |
# Parse output from ifconfig: |
# Parse output from ifconfig: |
parsed_interfaces=`$IFCONFIG | \ |
parsed_interfaces=`$IFCONFIG | \ |
$AWK 'BEGIN { interfaces=""; } |
$AWK ' |
/^[a-zA-Z0-9]+[ \t]+/ { # Linux |
BEGIN { |
iface=$1; |
iface_count = 0; |
interfaces = sprintf("%s %s", interfaces, iface); |
} |
printf "\nIFACE_%s=\"%s\"; export IFACE_%s;\n", iface, iface, iface; |
|
printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", iface, $5, iface; |
/^[a-zA-Z0-9:]+[ \t]+/ { # Linux interface |
} |
split($1, fields, ":"); |
/^[ \t]+inet addr:/ { # Linux |
iface = fields[1]; |
split($0, fields, "[ \t:]+"); |
ipcount[iface]++; |
printf "IP_%s=\"%s\"; export IP_%s;\n", iface, fields[4], iface; |
hwaddr[iface] = $NF; |
printf "Bcast_%s=\"%s\"; export Bcast_%s;\n", iface, fields[6], iface; |
iface_count++; |
printf "Mask_%s=\"%s\"; export Mask_%s;\n", iface, fields[8], iface; |
} |
} |
|
/^[a-zA-Z0-9]+:/ { # FreeBSD |
/^[ \t]+inet addr:/ { # Linux IP address |
iface = $1; |
split($0, fields, "[ \t:]+"); |
sub(":", "", iface); |
ip[iface, ipcount[iface]] = fields[4]; |
interfaces = sprintf("%s %s", interfaces, iface); |
bcast[iface] = fields[6]; # bad for loopback interface, but we don t need this |
printf "\nIFACE_%s=\"%s\"; export IFACE_%s;\n", iface, iface, iface; |
# try to upgrade gawk (3.1.4-2.0.1 => 3.1.5-1) if you experience problem on the next line |
} |
# awk: cmd. line:17: (FILENAME=- FNR=2) fatal: attempt to use array "fields" in a scalar context |
/^[ \t]+inet [0-9]+/ { # FreeBSD |
idx = length(fields); |
printf "IP_%s=\"%s\"; export IP_%s;\n", iface, $2, iface; |
mask[iface] = fields[idx]; |
printf "Bcast_%s=\"%s\"; export Bcast_%s;\n", iface, $6, iface; |
} |
printf "Mask_%s=\"%s\"; export Mask_%s;\n", iface, $4, iface; |
|
} |
/^[ \t]+inet6 addr:/ { # Linux IPv6 address |
/^[ \t]+ether/ { # FreeBSD |
split($0, fields, "[ \t]+"); |
printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", iface, $2, iface; |
ip6[iface] = fields[4]; |
} |
scope6[iface] = fields[5]; |
END { printf "\ninterfaces=\"%s\"; export interfaces;\n", interfaces; } |
} |
|
|
|
END { |
|
for (i in ip6) { printf "IFACE_6_%s=\"%s\"; export IFACE_6_%s;\n", i, ip6[i], i; } |
|
for (i in scope6) { printf "SCOPE_6_%s=\"%s\"; export SCOPE_6_%s;\n", i, scope6[i], i; } |
|
for (i in bcast) { printf "Bcast_%s=\"%s\"; export Bcast_%s;\n", i, bcast[i], i; } |
|
for (i in mask) { printf "Mask_%s=\"%s\"; export Mask_%s;\n", i, mask[i], i; } |
|
for (i in hwaddr) { printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", i, hwaddr[i], i; } |
|
for (i in ipcount) { printf "IPcount_%s=\"%s\"; export IPcount_%s;\n", i, ipcount[i], i; } |
|
for (i in ipcount) { |
|
printf "IP_%s=\"", i; |
|
for (n = 1; n <= ipcount[i]; n++) { |
|
printf "%s ", ip[i, n]; |
|
} |
|
printf "\"; export IP_%s;\n", i; |
|
} |
|
printf "interfaces=\""; |
|
for (i in ipcount) { printf "%s ", i; } |
|
printf "\"; export interfaces;\n"; |
|
} |
'` |
'` |
eval "$parsed_interfaces"; |
eval "$parsed_interfaces"; |
|
|
|
|
syn_flood |
syn_flood |
mangle_prerouting |
mangle_prerouting |
mangle_output |
mangle_output |
|
accept_related |
log_new_connections |
log_new_connections |
drop_output |
drop_output |
allow_input |
allow_input |
allow_output |
allow_output |
allow_icmp |
allow_icmp |
accept_related |
|
accept_loopback |
accept_loopback |
masquerade |
masquerade |
log_input_drop |
log_input_drop |