Platon Technologies
not logged in Login Registration
EnglishSlovak
open source software development celebrating 10 years of open source development! Tuesday, March 19, 2024

Diff for scripts/shell/firewall/fw-universal.sh between version 2.6 and 2.7

version 2.6, 2005/01/02 02:37:12 version 2.7, 2005/01/02 13:31:46
Line 9 
Line 9 
 # Licensed under terms of GNU General Public License.  # Licensed under terms of GNU General Public License.
 # All rights reserved.  # All rights reserved.
 #  #
 # $Platon: scripts/shell/firewall/fw-universal.sh,v 2.5 2005/01/02 01:49:01 rajo Exp $  # $Platon: scripts/shell/firewall/fw-universal.sh,v 2.6 2005/01/02 02:37:12 rajo Exp $
 #  #
 # Changelog:  # Changelog:
 # 2004-11-14 - created  # 2004-11-14 - created
Line 276  mangle_output()
Line 276  mangle_output()
 masquerade()  masquerade()
 { # {{{  { # {{{
         if [ ! -z "$NAT_LAN_IFACE" ]; then          if [ ! -z "$NAT_LAN_IFACE" ]; then
                 echo -en "Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE"                  echo -en "NAT: Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE"
   
                 ip="IP_$NAT_SUBNET_IFACE";                  ip="IP_$NAT_SUBNET_IFACE";
                 netmask="Mask_$NAT_SUBNET_IFACE"                  netmask="Mask_$NAT_SUBNET_IFACE"
Line 297  masquerade()
Line 297  masquerade()
   
                 $IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE                  $IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE
   
                   echo " done."
   
                 # don't forward Miscrosoft protocols - NOT RFC compliant packets                  # don't forward Miscrosoft protocols - NOT RFC compliant packets
                 if [ ! -z "$NAT_FORWARD_MICROSOFT" ]; then                  if [ ! -z "$NAT_FORWARD_MICROSOFT" ]; then
                         if [ "x$NAT_FORWARD_MICROSOFT" = "xno" ]; then                          if [ "x$NAT_FORWARD_MICROSOFT" = "xno" ]; then
Line 310  masquerade()
Line 312  masquerade()
                 fi                  fi
   
                 if [ ! -z "$NAT_FORWARD_TCP_PORTS" ]; then                  if [ ! -z "$NAT_FORWARD_TCP_PORTS" ]; then
                         echo -en "Accepting FORWARD TCP ports:"                          echo -en "\tAccepting FORWARD TCP ports:"
                         for port in $NAT_FORWARD_TCP_PORTS; do                          for port in $NAT_FORWARD_TCP_PORTS; do
                                 echo -en " $port"                                  echo -en " $port"
                                 $IPTABLES -A FORWARD -p TCP --dport $port -m state --state NEW -j ACCEPT                                  $IPTABLES -A FORWARD -p TCP --dport $port -m state --state NEW -j ACCEPT
Line 319  masquerade()
Line 321  masquerade()
                 fi                  fi
   
                 if [ ! -z "$NAT_FORWARD_UDP_PORTS" ]; then                  if [ ! -z "$NAT_FORWARD_UDP_PORTS" ]; then
                         echo -en "Accepting FORWARD UDP ports:"                          echo -en "\tAccepting FORWARD UDP ports:"
                         for port in $NAT_FORWARD_UDP_PORTS; do                          for port in $NAT_FORWARD_UDP_PORTS; do
                                 echo -en " $port"                                  echo -en " $port"
                                 $IPTABLES -A FORWARD -p UDP --dport $port -m state --state NEW -j ACCEPT                                  $IPTABLES -A FORWARD -p UDP --dport $port -m state --state NEW -j ACCEPT
Line 327  masquerade()
Line 329  masquerade()
                         echo " done."                          echo " done."
                 fi                  fi
   
                   echo -en "\tAccepting ICMP packets:"
                   for type in $ACCEPT_ICMP_PACKETS; do
                           echo -en " $type"
                           $IPTABLES -A FORWARD -p ICMP --icmp-type $type -j ACCEPT
                   done
                   echo " done."
   
                 # Keep state of connections from private subnets                  # Keep state of connections from private subnets
                 $IPTABLES -A OUTPUT  -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT                  $IPTABLES -A OUTPUT  -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT
                 #$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT                  #$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT
                 $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT                  $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
   
                 echo " done."  
   
         fi          fi
 } # }}}  } # }}}
   
Line 463  allow_icmp()
Line 470  allow_icmp()
         $IPTABLES -A INPUT -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server          $IPTABLES -A INPUT -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server
   
         # accept only allowed ICMP packets          # accept only allowed ICMP packets
         for type in echo-reply destination-unreachable echo-request time-exceeded; do          for type in $ACCEPT_ICMP_PACKETS; do
                 echo -en " $type"                  echo -en " $type"
                 for iface in $INTERFACES; do                  for iface in $INTERFACES; do
                         ip="IP_$iface";                          ip="IP_$iface";

Legend:
Removed from v.2.6  
changed lines
  Added in v.2.7

Platon Group <platon@platon.org> http://platon.org/
Copyright © 2002-2006 Platon Group
Site powered by Metafox CMS
Go to Top