version 2.67, 2009/02/11 22:55:41 |
version 2.71, 2009/11/06 23:14:36 |
|
|
# Can be started by init or by hand. |
# Can be started by init or by hand. |
# |
# |
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk> |
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk> |
# Copyright (c) 2003-2006 Platon SDG, http://platon.sk/ |
# Copyright (c) 2003-2009 Platon Group, http://platon.sk/ |
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.66 2009-02-06 23:13:38 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.70 2009-07-01 12:28:07 nepto Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
|
|
done |
done |
print_info " done." |
print_info " done." |
fi |
fi |
|
if [ ! -z "$REAL_DROP_INPUT_TCP" ]; then |
|
print_info -en "Drop REAL all INPUT TCP connections for ALL interfaces on ports:" |
|
for port in $REAL_DROP_INPUT_TCP; do |
|
print_info -en " $port(ALL)" |
|
$IPTABLES -A INPUT -p TCP --dport $port -j DROP |
|
done |
|
print_info " done." |
|
fi |
|
if [ ! -z "$REAL_DROP_INPUT_UDP" ]; then |
|
print_info -en "Drop REAL all INPUT UDP connections for ALL interfaces on ports:" |
|
for port in $REAL_DROP_INPUT_UDP; do |
|
print_info -en " $port(ALL)" |
|
$IPTABLES -A INPUT -p UDP --dport $port -j DROP |
|
done |
|
print_info " done." |
|
fi |
} # }}} |
} # }}} |
|
|
reject_input() |
reject_input() |
|
|
done |
done |
print_info " done." |
print_info " done." |
fi |
fi |
|
if [ ! -z "$REAL_REJECT_INPUT_TCP" ]; then |
|
print_info -en "Reject REAL all INPUT TCP connections for ALL interfaces on ports:" |
|
for port in $REAL_REJECT_INPUT_TCP; do |
|
print_info -en " $port(ALL)" |
|
$IPTABLES -A INPUT -p TCP --dport $port -j REJECT --reject-with $REJECT_WITH |
|
done |
|
print_info " done." |
|
fi |
|
if [ ! -z "$REAL_REJECT_INPUT_UDP" ]; then |
|
print_info -en "Reject REAL all INPUT UDP connections for ALL interfaces on ports:" |
|
for port in $REAL_REJECT_INPUT_UDP; do |
|
for riface in $REAL_INTERFACES; do |
|
print_info -en " $port(ALL)" |
|
$IPTABLES -A INPUT -p UDP --dport $port -j REJECT --reject-with $REJECT_WITH |
|
done |
|
done |
|
print_info " done." |
|
fi |
} # }}} |
} # }}} |
|
|
allow_input() |
allow_input() |
{ # {{{ |
{ # {{{ |
|
|
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
print_info -en "Accepting ALL INPUT TCP connections on ports:" |
print_info -en "Accepting ALL INPUT TCP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_TCP; do |
for port in $ALL_ACCEPT_INPUT_TCP; do |
|
|
print_info " done." |
print_info " done." |
fi |
fi |
|
|
|
if [ ! -z "$REAL_ACCEPT_INPUT_TCP" ]; then |
|
print_info -en "Accepting REAL all INPUT TCP connections for ALL interfaces on ports:" |
|
for port in $REAL_ACCEPT_INPUT_TCP; do |
|
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
print_info -en " $port(ALL)"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
|
if [ -z "$src_ip" ]; then |
|
$IPTABLES -A INPUT -p TCP --dport $port -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -s $src_ip -p TCP --dport $port -j ACCEPT |
|
fi |
|
done |
|
print_info " done." |
|
fi |
|
if [ ! -z "$REAL_ACCEPT_INPUT_UDP" ]; then |
|
print_info -en "Accepting REAL all INPUT UDP connections for ALL interfaces on ports:" |
|
for port in $REAL_ACCEPT_INPUT_UDP; do |
|
src_ip="" |
|
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
print_info -en " $port(ALL)"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
|
if [ -z "$src_ip" ]; then |
|
$IPTABLES -A INPUT -p UDP --dport $port -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -s $src_ip -p UDP --dport $port -j ACCEPT |
|
fi |
|
done |
|
print_info " done." |
|
fi |
|
|
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
riface="IFname_$iface"; |
riface="IFname_$iface"; |
IPS="IP_$iface"; |
IPS="IP_$iface"; |
|
|
for port in $ACCEPT_INPUT_TCP; do |
for port in $ACCEPT_INPUT_TCP; do |
src_ip="" |
src_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
if [ -n "$src_ip" -a "$port" = "0" ]; then |
|
port="ALL"; |
|
fi |
print_info -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
print_info -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
if [ -z $src_ip ]; then |
if [ -z $src_ip ]; then |
$IPTABLES -A INPUT -i ${!riface} -d $ip -p TCP --dport $port -j ACCEPT |
$IPTABLES -A INPUT -i ${!riface} -d $ip -p TCP --dport $port -j ACCEPT |
else |
else |
$IPTABLES -A INPUT -i ${!riface} -s $src_ip -d $ip -p TCP --dport $port -j ACCEPT |
if [ "$port" = "ALL" ]; then |
|
$IPTABLES -A INPUT -i ${!riface} -s $src_ip -d $ip -p TCP -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -i ${!riface} -s $src_ip -d $ip -p TCP --dport $port -j ACCEPT |
|
fi |
fi |
fi |
done |
done |
done |
done |
|
|
for port in $ACCEPT_INPUT_UDP; do |
for port in $ACCEPT_INPUT_UDP; do |
src_ip="" |
src_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
if [ -n "$src_ip" -a "$port" = "0" ]; then |
|
port="ALL"; |
|
fi |
print_info -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
print_info -en " $port"`[ ! -z $src_ip ] && echo "[$src_ip]"` |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT |
|
|
if [ -z $src_ip ]; then |
if [ -z $src_ip ]; then |
$IPTABLES -A INPUT -i ${!riface} -d $ip -p UDP --dport $port -j ACCEPT |
$IPTABLES -A INPUT -i ${!riface} -d $ip -p UDP --dport $port -j ACCEPT |
else |
else |
$IPTABLES -A INPUT -i ${!riface} -s $src_ip -d $ip -p UDP --dport $port -j ACCEPT |
if [ "$port" = "ALL" ]; then |
|
$IPTABLES -A INPUT -i ${!riface} -s $src_ip -d $ip -p UDP -j ACCEPT |
|
else |
|
$IPTABLES -A INPUT -i ${!riface} -s $src_ip -d $ip -p UDP --dport $port -j ACCEPT |
|
fi |
fi |
fi |
done |
done |
done |
done |
Line 1180 map { printf "Mask_%s=\"%s\"; export Ma |
|
Line 1256 map { printf "Mask_%s=\"%s\"; export Ma |
|
map { printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", $_, $hwaddr{$_}, $_; } keys %hwaddr; |
map { printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", $_, $hwaddr{$_}, $_; } keys %hwaddr; |
map { printf "IPcount_%s=\"%s\"; export IPcount_%s;\n", $_, $ipcount{$_}, $_; } keys %ipcount; |
map { printf "IPcount_%s=\"%s\"; export IPcount_%s;\n", $_, $ipcount{$_}, $_; } keys %ipcount; |
map { printf "IFname_%s=\"%s\"; export IFname_%s;\n", $_, $ifname{$_}, $_; } keys %ifname; |
map { printf "IFname_%s=\"%s\"; export IFname_%s;\n", $_, $ifname{$_}, $_; } keys %ifname; |
printf "interfaces=\"%s\"; export interfaces;\n", join(" ", keys %ip); |
printf "interfaces=\"%s\"; export interfaces;\n", join(" ", sort keys %ip); |
'` |
'` |
eval "$parsed_interfaces"; |
eval "$parsed_interfaces"; |
#echo "$parsed_interfaces"; |
#echo "$parsed_interfaces"; |