version 2.38, 2006/01/15 15:07:45 |
version 2.52, 2008/01/16 23:45:08 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.30 2005/11/01 00:36:24 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.51 2007-12-12 23:30:10 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
# |
# |
|
|
|
umask 077 # security |
|
|
DESC="firewall" |
DESC="firewall" |
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin |
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin |
|
|
DEFAULT_FIREWALL_CONFIG="${DEFAULT_FIREWALL_CONFIG:=/etc/default/firewall}" |
DEFAULT_FIREWALL_CONFIG="${DEFAULT_FIREWALL_CONFIG:=/etc/default/firewall}" |
|
DEFAULT_FIREWALL_CONFIG_DIR="${DEFAULT_FIREWALL_CONFIG_DIR:=/etc/default/firewall.d}" |
DEFAULT_CACHE_DIR="${DEFAULT_CACHE_DIR:=/var/cache/firewall}" |
DEFAULT_CACHE_DIR="${DEFAULT_CACHE_DIR:=/var/cache/firewall}" |
|
|
if [ -f "$DEFAULT_FIREWALL_CONFIG" ]; then |
if [ -f "$DEFAULT_FIREWALL_CONFIG" ]; then |
Line 54 DEPMOD="${DEPMOD:=/sbin/depmod}" |
|
Line 57 DEPMOD="${DEPMOD:=/sbin/depmod}" |
|
MODPROBE="${MODPROBE:=/sbin/modprobe}" |
MODPROBE="${MODPROBE:=/sbin/modprobe}" |
RMMOD="${RMMOD:=/sbin/rmmod}" |
RMMOD="${RMMOD:=/sbin/rmmod}" |
AWK="${AWK:=/usr/bin/awk}" |
AWK="${AWK:=/usr/bin/awk}" |
|
PERL="${PERL:=/usr/bin/perl}" |
|
|
# loopback interface |
# loopback interface |
LO_IFACE="${LO_IFACE:=lo}" |
LO_IFACE="${LO_IFACE:=lo}" |
|
# Hide NAT clients behind firewall |
|
NAT_SET_TTL="${NAT_SET_TTL:=no}" |
|
|
# |
# |
# CONSTANTS - Do not edit |
# CONSTANTS - Do not edit |
Line 89 get_first_ip_addr() |
|
Line 95 get_first_ip_addr() |
|
print_first `echo ${!varname} | sort -g` |
print_first `echo ${!varname} | sort -g` |
} # }}} |
} # }}} |
|
|
|
read_config_ips() |
|
{ # {{{ |
|
PARSE_CONFIG=$1 perl -ne 'if (m/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/(\d+)$/g) { print; } elsif ($_ !~ m/^\s*#/ && $_ !~ m/^\s*$/ ) { print STDERR "ERROR: $ENV{PARSE_CONFIG}:$.: ignored string $_\n"; }' $1 |
|
} # }}} |
|
|
# load necessary modules from $MODULES variable |
# load necessary modules from $MODULES variable |
load_modules() |
load_modules() |
{ # {{{ |
{ # {{{ |
|
|
mkdir -p "$DEFAULT_CACHE_DIR"; |
mkdir -p "$DEFAULT_CACHE_DIR"; |
fi |
fi |
|
|
config=`cat $DEFAULT_FIREWALL_CONFIG`; |
config=`cat $DEFAULT_FIREWALL_CONFIG $0 $DEFAULT_FIREWALL_CONFIG_DIR/deploy-servers.list $DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf `; # config file and firewalling script |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | awk '{ print $1; }'`; |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{ print $1; }'`; |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
|
|
#echo "CACHE_FILE=$CACHE_FILE" |
#echo "CACHE_FILE=$CACHE_FILE" |
|
|
done |
done |
|
|
for redirect in $NAT_TCP_PORT_REDIRECT; do |
for redirect in $NAT_TCP_PORT_REDIRECT; do |
eval `echo $redirect | awk -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
#eval `echo $redirect | $AWK -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
echo -en " $remote_port:$local_port" |
eval `echo $redirect | \ |
|
$AWK -v FS=: ' (NF == 2) { remote_ip = "$lan_ip"; remote_port = $1; local_port = $2; } \ |
|
(NF == 3) { remote_ip = $2; remote_port = $1; local_port = $3; } \ |
|
END { printf "remote_ip=%s; remote_port=%s; local_port=%s;", remote_ip, remote_port, local_port; }'` |
|
echo -en " $remote_port>>$remote_ip:$local_port(udp)" |
$IPTABLES -t nat -A PREROUTING -p TCP \ |
$IPTABLES -t nat -A PREROUTING -p TCP \ |
-i ! $NAT_LAN_IFACE -d ! $lan_ip \ |
-i ! $NAT_LAN_IFACE -d ! $lan_ip \ |
--dport $remote_port -j REDIRECT --to-port $local_port |
--dport $remote_port -j REDIRECT --to-port $local_port |
done |
done |
|
for redirect in $NAT_UDP_PORT_REDIRECT; do |
|
#eval `echo $redirect | $AWK -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
|
eval `echo $redirect | \ |
|
$AWK -v FS=: ' (NF == 2) { dnat = "no" ; remote_ip = "X"; remote_port = $1; local_port = $2; } \ |
|
(NF == 3) { dnat = "yes" ; remote_ip = $2; remote_port = $1; local_port = $3; } \ |
|
END { printf "dnat=%s; remote_ip=%s; remote_port=%s; local_port=%s;", dnat, remote_ip, remote_port, local_port; }'` |
|
echo -en " $remote_port>>$remote_ip:$local_port(udp)" |
|
if [ "x$dnat" = "xyes" ]; then |
|
$IPTABLES -t nat -A PREROUTING -p UDP -i $NAT_SUBNET_IFACE -d ! $ip \ |
|
--dport $local_port -j DNAT --to $remote_ip:$remote_port |
|
$IPTABLES -A FORWARD -p UDP -i $NAT_SUBNET_IFACE -d ! $ip --dport $local_port -j ACCEPT |
|
else |
|
$IPTABLES -t nat -A PREROUTING -p UDP \ |
|
-i ! $NAT_LAN_IFACE -d ! $lan_ip \ |
|
--dport $remote_port -j REDIRECT --to-port $local_port |
|
fi |
|
done |
|
|
#$IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE |
#$IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE |
$IPTABLES -t nat -A POSTROUTING -o $NAT_LAN_IFACE -j MASQUERADE |
$IPTABLES -t nat -A POSTROUTING -o $NAT_LAN_IFACE -j MASQUERADE |
|
|
|
|
# Port forwarding to local machines |
# Port forwarding to local machines |
if [ ! -z "$NAT_TCP_PORT_FORWARD" ]; then |
if [ ! -z "$NAT_TCP_PORT_FORWARD" ]; then |
echo -en "\tForwarding ports to local machines:" |
echo -en "\tForwarding TCP ports to local machines:" |
for redirect in $NAT_TCP_PORT_FORWARD; do |
for redirect in $NAT_TCP_PORT_FORWARD; do |
eval `echo $redirect | awk -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
eval `echo $redirect | $AWK -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
echo -en " $src_port -> $local_machine:$dest_port" |
echo -en " $src_port -> $local_machine:$dest_port" |
$IPTABLES -t nat -A PREROUTING -p TCP -i $NAT_LAN_IFACE -d $lan_ip \ |
$IPTABLES -t nat -A PREROUTING -p TCP -i $NAT_LAN_IFACE -d $lan_ip \ |
--dport $src_port -j DNAT --to $local_machine:$dest_port |
--dport $src_port -j DNAT --to $local_machine:$dest_port |
|
|
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
if [ ! -z "$NAT_UDP_PORT_FORWARD" ]; then |
|
echo -en "\tForwarding UDP ports to local machines:" |
|
for redirect in $NAT_UDP_PORT_FORWARD; do |
|
eval `echo $redirect | $AWK -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
|
echo -en " $src_port -> $local_machine:$dest_port" |
|
$IPTABLES -t nat -A PREROUTING -p UDP -i $NAT_LAN_IFACE -d $lan_ip \ |
|
--dport $src_port -j DNAT --to $local_machine:$dest_port |
|
$IPTABLES -A FORWARD -p UDP -i $NAT_LAN_IFACE -d $local_machine --dport $dest_port -j ACCEPT |
|
done |
|
echo " done." |
|
fi |
|
|
# Keep state of connections from private subnets |
# Keep state of connections from private subnets |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
|
|
# hide NAT clients behind firewall: - set TTL |
|
# XXX: warning: this breaks traceroute !!! |
|
if [ ! "a$NAT_SET_TTL" = "ano" ]; then |
|
echo "NAT: clients hidden behind firewall - setting TTL to $NAT_SET_TTL" |
|
$IPTABLES -t mangle -A POSTROUTING -o $NAT_LAN_IFACE -j TTL --ttl-set $NAT_SET_TTL |
|
fi |
|
|
|
|
fi |
fi |
} # }}} |
} # }}} |
|
|
Line 493 bann_ip_adresses() |
|
Line 544 bann_ip_adresses() |
|
#IP address is: 146.48.97.11 146.48.97.13 |
#IP address is: 146.48.97.11 146.48.97.13 |
# User Agent: "UbiCrawler/v0.4beta (http://ubi.iit.cnr.it/projects/ubicrawler/)" |
# User Agent: "UbiCrawler/v0.4beta (http://ubi.iit.cnr.it/projects/ubicrawler/)" |
# |
# |
|
cf="$DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf" |
|
if [ -f $cf ]; then |
|
BANNED_IP="$BANNED_IP `read_config_ips $cf`" |
|
fi |
if [ ! -z "$BANNED_IP" ]; then |
if [ ! -z "$BANNED_IP" ]; then |
echo -en "Dropping ALL packets from IP:" |
echo -en "Dropping ALL packets from IP:" |
for banned_ip in $BANNED_IP; do |
for banned_ip in $BANNED_IP; do |
Line 518 allow_accept_all() |
|
Line 573 allow_accept_all() |
|
fi |
fi |
} # }}} |
} # }}} |
|
|
allow_input() |
drop_input() |
{ # {{{ |
{ # {{{ |
|
|
if [ ! -z "$NAT_LAN_IFACE" ]; then |
if [ ! -z "$NAT_LAN_IFACE" ]; then |
for client_ip in $NAT_CLIENT_DROP; do |
for client_ip in $NAT_CLIENT_DROP; do |
echo -en " !$client_ip"; |
echo -en " !$client_ip"; |
$IPTABLES -A INPUT -s $client_ip -i $NAT_SUBNET_IFACE -j DROP |
$IPTABLES -A INPUT -s $client_ip -i $NAT_SUBNET_IFACE -j DROP |
done |
done |
fi |
fi |
|
if [ ! -z "$ALL_DROP_INPUT_TCP" ]; then |
|
echo -en "Drop ALL INPUT TCP connections on ports:" |
|
for port in $ALL_DROP_INPUT_TCP; do |
|
for iface in $INTERFACES; do |
|
echo -en " $port($iface)" |
|
$IPTABLES -A INPUT -i $iface -p TCP --dport $port -j DROP |
|
done |
|
done |
|
echo " done." |
|
fi |
|
if [ ! -z "$ALL_DROP_INPUT_UDP" ]; then |
|
echo -en "Drop ALL INPUT UDP connections on ports:" |
|
for port in $ALL_DROP_INPUT_UDP; do |
|
for iface in $INTERFACES; do |
|
echo -en " $port($iface)" |
|
$IPTABLES -A INPUT -i $iface -p UDP --dport $port -j DROP |
|
done |
|
done |
|
echo " done." |
|
fi |
|
} # }}} |
|
|
|
reject_input() |
|
{ # {{{ |
|
if [ ! -z "$ALL_REJECT_INPUT_TCP" ]; then |
|
echo -en "Reject ALL INPUT TCP connections on ports:" |
|
for port in $ALL_REJECT_INPUT_TCP; do |
|
for iface in $INTERFACES; do |
|
echo -en " $port($iface)" |
|
$IPTABLES -A INPUT -i $iface -p TCP --dport $port -j REJECT --reject-with icmp-port-unreachable |
|
done |
|
done |
|
echo " done." |
|
fi |
|
if [ ! -z "$ALL_REJECT_INPUT_UDP" ]; then |
|
echo -en "Reject ALL INPUT UDP connections on ports:" |
|
for port in $ALL_REJECT_INPUT_UDP; do |
|
for iface in $INTERFACES; do |
|
echo -en " $port($iface)" |
|
$IPTABLES -A INPUT -i $iface -p UDP --dport $port -j REJECT --reject-with icmp-port-unreachable |
|
done |
|
done |
|
echo " done." |
|
fi |
|
} # }}} |
|
|
|
allow_input() |
|
{ # {{{ |
|
|
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
echo -en "Accepting ALL INPUT TCP connections on ports:" |
echo -en "Accepting ALL INPUT TCP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_TCP; do |
for port in $ALL_ACCEPT_INPUT_TCP; do |
|
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
echo -en " $port($iface)" |
echo -en " $port($iface)"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
IPS="IP_$iface"; |
IPS="IP_$iface"; |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j ACCEPT |
if [ -z "$src_ip" ]; then |
|
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -i $iface -s $src_ip -d $ip -p TCP --dport $port -j ACCEPT |
|
fi |
done |
done |
done |
done |
done |
done |
|
|
if [ ! -z "$ALL_ACCEPT_INPUT_UDP" ]; then |
if [ ! -z "$ALL_ACCEPT_INPUT_UDP" ]; then |
echo -en "Accepting ALL INPUT UDP connections on ports:" |
echo -en "Accepting ALL INPUT UDP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_UDP; do |
for port in $ALL_ACCEPT_INPUT_UDP; do |
|
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
echo -en " $port($iface)" |
echo -en " $port($iface)"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
IPS="IP_$iface"; |
IPS="IP_$iface"; |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j ACCEPT |
if [ -z "$src_ip" ]; then |
|
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -i $iface -s $src_ip -d $ip -p UDP --dport $port -j ACCEPT |
|
fi |
done |
done |
done |
done |
done |
done |
|
|
redirect_udp="${iface}_REDIRECT_UDP" |
redirect_udp="${iface}_REDIRECT_UDP" |
REDIRECT_UDP="${!redirect_udp}" |
REDIRECT_UDP="${!redirect_udp}" |
|
|
|
reject_input_tcp="${iface}_REJECT_INPUT_TCP" |
|
REJECT_INPUT_TCP="${!reject_input_tcp}" |
|
reject_input_udp="${iface}_REJECT_INPUT_UDP" |
|
REJECT_INPUT_UDP="${!reject_input_udp}" |
|
|
accept_input_tcp="${iface}_ACCEPT_INPUT_TCP" |
accept_input_tcp="${iface}_ACCEPT_INPUT_TCP" |
ACCEPT_INPUT_TCP="${!accept_input_tcp}" |
ACCEPT_INPUT_TCP="${!accept_input_tcp}" |
accept_input_udp="${iface}_ACCEPT_INPUT_UDP" |
accept_input_udp="${iface}_ACCEPT_INPUT_UDP" |
|
|
ip="`get_first_ip_addr IP_$iface`"; |
ip="`get_first_ip_addr IP_$iface`"; |
for redirect in $REDIRECT_TCP; do |
for redirect in $REDIRECT_TCP; do |
eval `echo $redirect | \ |
eval `echo $redirect | \ |
awk -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
$AWK -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
echo -en " $remote_ip:$from_port->$to_port" |
echo -en " $remote_ip:$from_port->$to_port" |
|
|
ip="`get_first_ip_addr IP_$iface`"; |
ip="`get_first_ip_addr IP_$iface`"; |
for redirect in $REDIRECT_UDP; do |
for redirect in $REDIRECT_UDP; do |
eval `echo $redirect | \ |
eval `echo $redirect | \ |
awk -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
$AWK -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
echo -en " $remote_ip:$from_port->$to_port" |
echo -en " $remote_ip:$from_port->$to_port" |
|
|
echo " done." |
echo " done." |
fi |
fi |
|
|
|
# REJECT {{{ |
|
if [ ! -z "$REJECT_INPUT_TCP" ]; then |
|
echo -en "$iface: Rejecting INPUT TCP connections on ports:" |
|
for port in $REJECT_INPUT_TCP; do |
|
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
echo -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
|
for ip in ${!IPS}; do |
|
if [ -z $src_ip ]; then |
|
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j REJECT --reject-with icmp-port-unreachable |
|
else |
|
$IPTABLES -A INPUT -i $iface -s $src_ip -d $ip -p TCP --dport $port -j REJECT --reject-with icmp-port-unreachable |
|
fi |
|
done |
|
done |
|
echo " done." |
|
fi |
|
|
|
if [ ! -z "$REJECT_INPUT_UDP" ]; then |
|
echo -en "$iface: Rejecting INPUT UDP connections on ports:" |
|
for port in $REJECT_INPUT_UDP; do |
|
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
echo -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
|
for ip in ${!IPS}; do |
|
if [ -z $src_ip ]; then |
|
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j REJECT --reject-with icmp-port-unreachable |
|
else |
|
$IPTABLES -A INPUT -i $iface -s $src_ip -d $ip -p UDP --dport $port -j REJECT --reject-with icmp-port-unreachable |
|
fi |
|
done |
|
done |
|
echo " done." |
|
fi |
|
# }}} |
|
|
|
# ACCEPT {{{ |
if [ ! -z "$ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ACCEPT_INPUT_TCP" ]; then |
echo -en "$iface: Accepting INPUT TCP connections on ports:" |
echo -en "$iface: Accepting INPUT TCP connections on ports:" |
for port in $ACCEPT_INPUT_TCP; do |
for port in $ACCEPT_INPUT_TCP; do |
echo -en " $port" |
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
echo -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j ACCEPT |
if [ -z $src_ip ]; then |
|
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -i $iface -s $src_ip -d $ip -p TCP --dport $port -j ACCEPT |
|
fi |
done |
done |
done |
done |
echo " done." |
echo " done." |
|
|
if [ ! -z "$ACCEPT_INPUT_UDP" ]; then |
if [ ! -z "$ACCEPT_INPUT_UDP" ]; then |
echo -en "$iface: Accepting INPUT UDP connections on ports:" |
echo -en "$iface: Accepting INPUT UDP connections on ports:" |
for port in $ACCEPT_INPUT_UDP; do |
for port in $ACCEPT_INPUT_UDP; do |
echo -en " $port" |
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
echo -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j ACCEPT |
if [ -z $src_ip ]; then |
|
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -i $iface -s $src_ip -d $ip -p UDP --dport $port -j ACCEPT |
|
fi |
done |
done |
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
# }}} |
done |
done |
|
|
# Enable outgoing TRACEROUTE requests (required e.g. by Skype, http://www.skype.com) |
# Enable outgoing TRACEROUTE requests (required e.g. by Skype, http://www.skype.com) |
Line 713 log_forward_drop() |
|
Line 883 log_forward_drop() |
|
|
|
} # }}} |
} # }}} |
|
|
|
configure_special_rules() |
|
{ # {{{ |
|
|
|
echo -en "Loading special rules: " |
|
## |
|
## for DSL from Slovanet (Slovak DSL provider) and DSL modem DLINK DSL-360T you must add following rule for proper ssh connect to your machine |
|
## |
|
# echo -en "slovanet " |
|
# $IPTABLES -t mangle -A OUTPUT -s 0/0 -j DSCP --set-dscp 0 |
|
|
|
echo " done."; |
|
|
|
} # }}} |
|
|
do_ip_accounting() |
do_ip_accounting() |
{ # {{{ |
{ # {{{ |
|
|
Line 743 do_ip_accounting() |
|
Line 927 do_ip_accounting() |
|
done |
done |
|
|
if [ ! "x$DO_LOCAL_IP_ACCOUNTING" = "xno" ]; then |
if [ ! "x$DO_LOCAL_IP_ACCOUNTING" = "xno" ]; then |
accountig_ports=`echo "$NAT_TCP_PORT_REDIRECT " | awk -v RS=' ' -v FS=: '{ print $2; }' | sort -u -r -g ` |
accountig_ports=`echo "$NAT_TCP_PORT_REDIRECT " | $AWK -v RS=' ' -v FS=: '{ print $2; }' | sort -u -r -g ` |
for port in $accountig_ports; do |
for port in $accountig_ports; do |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p TCP --dport $port -j $IPACCT_NAME |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p TCP --dport $port -j $IPACCT_NAME |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p UDP --dport $port -j $IPACCT_NAME |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p UDP --dport $port -j $IPACCT_NAME |
Line 787 accept_loopback() |
|
Line 971 accept_loopback() |
|
|
|
} # }}} |
} # }}} |
|
|
|
add_banned_ip() |
|
{ # {{{ |
|
echo "# `date '+%Y-%m-%d %X' ` - ${SSH_CLIENT:=local}" >> $DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf |
|
TMPFILE=`mktemp -t fw-universal.sh-XXXXXX` || exit 1 |
|
trap 'rm -f $TMPFILE' 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
|
if [ -z "$*" ]; then |
|
echo "Reading banned IP's from STDIN:" |
|
cat >> $TMPFILE |
|
else |
|
for IP in $*; do |
|
echo $i >> $TMPFILE; |
|
done |
|
fi |
|
read_config_ips $TMPFILE >> $DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf |
|
rm -f $TMPFILE |
|
} # }}} |
|
|
|
deploy_block() |
|
{ # {{{ |
|
if [ -z "$*" ]; then |
|
echo "Usage: $0 deploy-block IP1/netmask1 IP2/netmask2 ..." |
|
exit 1; |
|
fi |
|
echo "Deploying to local rules ..." |
|
add_banned_ip $* |
|
# start the some script twice to refresh rules (new blocked IP's) |
|
$0 start |
|
TMPFILE=`mktemp -t fw-universal.sh-XXXXXX` || exit 1 |
|
trap 'rm -f $TMPFILE' 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
|
echo TMPFILE=$TMPFILE |
|
for i in $*; do |
|
echo $i >> $TMPFILE; |
|
done |
|
while read conn keyfile |
|
do |
|
case "$conn" in |
|
""|\#*) |
|
continue |
|
;; |
|
esac |
|
echo "Deploying to $conn ..."; |
|
cat $TMPFILE | ssh -i $keyfile $conn $0 block |
|
done < $DEFAULT_FIREWALL_CONFIG_DIR/deploy-servers.list |
|
rm -f $TMPFILE |
|
} # }}} |
|
|
# Parse output from ifconfig: - tested on Linux and FreeBSD |
# Parse output from ifconfig: - tested on Linux and FreeBSD |
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh |
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh |
parse_ifconfig() |
parse_ifconfig() |
{ # {{{ |
{ # {{{ |
# Parse output from ifconfig: |
# Parse output from ifconfig: |
parsed_interfaces=`$IFCONFIG | \ |
parsed_interfaces=`$IFCONFIG | \ |
$AWK ' |
$PERL -e ' |
BEGIN { |
my $iface_count = 0; |
iface_count = 0; |
my $iface; |
} |
my (%ip6, %scope6, %bcast, %mask, %hwaddr, %ipcount); |
|
|
/^[a-zA-Z0-9:]+[ \t]+/ { # Linux interface |
while (my $line = <STDIN>) { |
split($1, fields, ":"); |
chomp $line; |
iface = fields[1]; |
if ($line =~ m/^([a-z0-9:]+)\s+.*?([a-z0-9:]+)\s*$/i) { # Linux interface |
ipcount[iface]++; |
$iface = $1; |
hwaddr[iface] = $NF; |
my $iface_hwaddr = $2; |
iface_count++; |
$iface = [ $iface =~ m/^([a-z0-9]+)/i ]->[0]; # convert "eth0:0" --> "eth0" |
} |
$ipcount{$iface}++; |
|
$hwaddr{$iface} = $iface_hwaddr; |
/^[ \t]+inet addr:/ { # Linux IP address |
$iface_count++; |
split($0, fields, "[ \t:]+"); |
} |
ip[iface, ipcount[iface]] = fields[4]; |
elsif ($line =~ m/^[ \t]+inet addr:/) { # Linux IP address |
bcast[iface] = fields[6]; # bad for loopback interface, but we don t need this |
die unless defined $iface; |
idx = length(fields); |
my @fields = split(/[\s:]+/, $line); |
mask[iface] = fields[idx]; |
push @{$ip{$iface}}, $fields[3]; |
} |
$bcast{$iface} = $fields[5] || ""; # invalid for loopback interface lo, but we don t need this |
|
$mask{$iface} = $fields[7] || $fields[5]; # for loopback interface lo |
|
} |
|
elsif($line =~ m/^[ \t]+inet6 addr:/) { # Linux IPv6 address |
|
die unless defined $iface; |
|
my @fields = split(/\s+/, $line); |
|
push @{$ip6{$iface}}, $fields[3]; |
|
$scope6{$iface} = [ $fields[4] =~ m/Scope:(.*)$/i ]->[0]; |
|
} |
|
|
/^[ \t]+inet6 addr:/ { # Linux IPv6 address |
|
split($0, fields, "[ \t]+"); |
|
ip6[iface] = fields[4]; |
|
scope6[iface] = fields[5]; |
|
} |
} |
|
|
END { |
map { printf "IP_%s=\"%s\"; export IP_%s;\n", $_, join(" ", @{$ip{$_}}), $_; } keys %ip; |
for (i in ip6) { printf "IFACE_6_%s=\"%s\"; export IFACE_6_%s;\n", i, ip6[i], i; } |
map { printf "IFACE_6_%s=\"%s\"; export IFACE_6_%s;\n", $_, join(" ", @{$ip6{$_}}), $_; } keys %ip6; |
for (i in scope6) { printf "SCOPE_6_%s=\"%s\"; export SCOPE_6_%s;\n", i, scope6[i], i; } |
map { printf "SCOPE_6_%s=\"%s\"; export SCOPE_6_%s;\n", $_, $scope6{$_}, $_; } keys %scope6; |
for (i in bcast) { printf "Bcast_%s=\"%s\"; export Bcast_%s;\n", i, bcast[i], i; } |
map { printf "Bcast_%s=\"%s\"; export Bcast_%s;\n", $_, $bcast{$_}, $_; } keys %bcast; |
for (i in mask) { printf "Mask_%s=\"%s\"; export Mask_%s;\n", i, mask[i], i; } |
map { printf "Mask_%s=\"%s\"; export Mask_%s;\n", $_, $mask{$_}, $_; } keys %mask; |
for (i in hwaddr) { printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", i, hwaddr[i], i; } |
map { printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", $_, $hwaddr{$_}, $_; } keys %hwaddr; |
for (i in ipcount) { printf "IPcount_%s=\"%s\"; export IPcount_%s;\n", i, ipcount[i], i; } |
map { printf "IPcount_%s=\"%s\"; export IPcount_%s;\n", $_, $ipcount{$_}, $_; } keys %ipcount; |
for (i in ipcount) { |
printf "interfaces=\"%s\"; export interfaces;\n", join(" ", keys %ip); |
printf "IP_%s=\"", i; |
|
for (n = 1; n <= ipcount[i]; n++) { |
|
printf "%s ", ip[i, n]; |
|
} |
|
printf "\"; export IP_%s;\n", i; |
|
} |
|
printf "interfaces=\""; |
|
for (i in ipcount) { printf "%s ", i; } |
|
printf "\"; export interfaces;\n"; |
|
} |
|
'` |
'` |
eval "$parsed_interfaces"; |
eval "$parsed_interfaces"; |
|
|
parsed_routes=`perl -e ' |
parsed_routes=`$PERL -e ' |
$\ = "\n"; |
$\ = "\n"; |
open(FILE, "/proc/net/route") or die "Can not open /proc/net/route: $!"; |
open(FILE, "/proc/net/route") or die "Can not open /proc/net/route: $!"; |
my @columns = split(/\s+/, <FILE>); |
my @columns = split(/\s+/, <FILE>); |
|
|
nmap_scan_filter |
nmap_scan_filter |
invalid_packet_filter |
invalid_packet_filter |
anti_spoof_filter |
anti_spoof_filter |
syn_flood |
#syn_flood |
mangle_prerouting |
mangle_prerouting |
mangle_output |
mangle_output |
|
accept_related |
log_new_connections |
log_new_connections |
drop_output |
drop_output |
|
drop_input |
|
reject_input |
allow_input |
allow_input |
allow_output |
allow_output |
allow_icmp |
allow_icmp |
accept_related |
|
accept_loopback |
accept_loopback |
masquerade |
masquerade |
log_input_drop |
log_input_drop |
|
|
log_forward_drop |
log_forward_drop |
forward_on |
forward_on |
do_ip_accounting |
do_ip_accounting |
|
configure_special_rules |
$IPTABLES_SAVE -c > $CACHE_FILE |
$IPTABLES_SAVE -c > $CACHE_FILE |
;; |
;; |
|
|
|
|
purge) |
purge) |
find $DEFAULT_CACHE_DIR -type f -ls -exec rm -f {} \; |
find $DEFAULT_CACHE_DIR -type f -ls -exec rm -f {} \; |
;; |
;; |
|
block) |
|
shift; |
|
add_banned_ip $*; |
|
# start the some script twice to refresh rules (new blocked IP's) |
|
$0 start; |
|
;; |
|
deploy-block) |
|
shift; |
|
deploy_block $*; |
|
;; |
*) |
*) |
echo "Usage: $0 {start|stop|really-off|status|purge}" >&2 |
echo "Usage: $0 {start|stop|really-off|status|purge|block|deploy-block}" >&2 |
exit 1 |
exit 1 |
;; |
;; |
esac |
esac |