version 2.83, 2011/11/18 23:49:00 |
version 2.84, 2011/11/18 23:58:33 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.82 2011-11-18 23:26:18 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.83 2011-11-18 23:49:00 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
|
|
if [ ! -z "$ALL_DROP_INPUT_TCP" ]; then |
if [ ! -z "$ALL_DROP_INPUT_TCP" ]; then |
print_info -en "Drop ALL INPUT TCP connections on ports:" |
print_info -en "Drop ALL INPUT TCP connections on ports:" |
for port in $ALL_DROP_INPUT_TCP; do |
for port in $ALL_DROP_INPUT_TCP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
for riface in $REAL_INTERFACES; do |
for riface in $REAL_INTERFACES; do |
print_info -en " $port($riface)" |
print_info -en " $port($riface)" |
$IPTABLES -A INPUT -i $riface -p TCP --dport $port -j DROP |
$IPTABLES -A INPUT -i $riface -p TCP $port_rule -j DROP |
done |
done |
done |
done |
print_info " done." |
print_info " done." |
|
|
if [ ! -z "$ALL_DROP_INPUT_UDP" ]; then |
if [ ! -z "$ALL_DROP_INPUT_UDP" ]; then |
print_info -en "Drop ALL INPUT UDP connections on ports:" |
print_info -en "Drop ALL INPUT UDP connections on ports:" |
for port in $ALL_DROP_INPUT_UDP; do |
for port in $ALL_DROP_INPUT_UDP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
for riface in $REAL_INTERFACES; do |
for riface in $REAL_INTERFACES; do |
print_info -en " $port($riface)" |
print_info -en " $port($riface)" |
$IPTABLES -A INPUT -i $riface -p UDP --dport $port -j DROP |
$IPTABLES -A INPUT -i $riface -p UDP $port_rule -j DROP |
done |
done |
done |
done |
print_info " done." |
print_info " done." |
|
|
if [ ! -z "$REAL_DROP_INPUT_TCP" ]; then |
if [ ! -z "$REAL_DROP_INPUT_TCP" ]; then |
print_info -en "Drop REAL all INPUT TCP connections for ALL interfaces on ports:" |
print_info -en "Drop REAL all INPUT TCP connections for ALL interfaces on ports:" |
for port in $REAL_DROP_INPUT_TCP; do |
for port in $REAL_DROP_INPUT_TCP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
print_info -en " $port(ALL)" |
print_info -en " $port(ALL)" |
$IPTABLES -A INPUT -p TCP --dport $port -j DROP |
$IPTABLES -A INPUT -p TCP $port_rule -j DROP |
done |
done |
print_info " done." |
print_info " done." |
fi |
fi |
if [ ! -z "$REAL_DROP_INPUT_UDP" ]; then |
if [ ! -z "$REAL_DROP_INPUT_UDP" ]; then |
print_info -en "Drop REAL all INPUT UDP connections for ALL interfaces on ports:" |
print_info -en "Drop REAL all INPUT UDP connections for ALL interfaces on ports:" |
for port in $REAL_DROP_INPUT_UDP; do |
for port in $REAL_DROP_INPUT_UDP; do |
|
echo $port | grep -q , |
|
multiport="$?"; |
|
if [ "$multiport" -eq 0 ]; then |
|
port_rule="--match multiport --dports $port" |
|
else |
|
port_rule="--dport $port" |
|
fi |
print_info -en " $port(ALL)" |
print_info -en " $port(ALL)" |
$IPTABLES -A INPUT -p UDP --dport $port -j DROP |
$IPTABLES -A INPUT -p UDP $port_rule -j DROP |
done |
done |
print_info " done." |
print_info " done." |
fi |
fi |