verzia 2.11, 2005/01/13 13:31:54 |
verzia 2.14, 2005/01/16 11:06:46 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.10 2005/01/04 23:56:23 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.13 2005/01/16 11:06:10 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
Riadok 37 LOG_LIMIT="${LOG_LIMIT:=-m limit --limit |
|
Riadok 37 LOG_LIMIT="${LOG_LIMIT:=-m limit --limit |
|
|
|
# Paths: |
# Paths: |
#IPTABLES=":" # for testing only - does nothing |
#IPTABLES=":" # for testing only - does nothing |
IPTABLES="${IPTABLES:=/sbin/iptables}" |
IPTABLES="${IPTABLES:=$DEBUG/sbin/iptables}" |
IFCONFIG="${IFCONFIG:=/sbin/ifconfig}" |
IFCONFIG="${IFCONFIG:=/sbin/ifconfig}" |
DEPMOD="${DEPMOD:=/sbin/depmod}" |
DEPMOD="${DEPMOD:=/sbin/depmod}" |
MODPROBE="${MODPROBE:=/sbin/modprobe}" |
MODPROBE="${MODPROBE:=/sbin/modprobe}" |
Riadok 48 AWK="${AWK:=/usr/bin/awk}" |
|
Riadok 48 AWK="${AWK:=/usr/bin/awk}" |
|
LO_IFACE="${LO_IFACE:=lo}" |
LO_IFACE="${LO_IFACE:=lo}" |
LO_IP="IP_$LO_IFACE" |
LO_IP="IP_$LO_IFACE" |
|
|
# Which ports will be allowed on INPUT (TCP connections) |
|
ALL_ACCEPT_INPUT_TCP="${ALL_ACCEPT_INPUT_TCP:=}" |
|
# interface eth0 |
|
eth0_ACCEPT_INPUT_TCP="${eth0_ACCEPT_INPUT_TCP:=}" |
|
# interface ppp0 |
|
ppp0_ACCEPT_INPUT_TCP="${ppp0_ACCEPT_INPUT_TCP:=}" |
|
|
|
# Which ports will be allowed on INPUT (UDP connections) |
|
# interface eth0 |
|
eth0_ACCEPT_INPUT_UDP="${eth0_ACCEPT_INPUT_UDP:=}" |
|
# interface ppp0 |
|
ppp0_ACCEPT_INPUT_UDP="${ppp0_ACCEPT_INPUT_UDP:=}" |
|
|
|
# allow some ICMP packets - needed for ping etc. |
# allow some ICMP packets - needed for ping etc. |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
|
|
|
|
echo -en " $type" |
echo -en " $type" |
$IPTABLES -A FORWARD -p ICMP --icmp-type $type -j ACCEPT |
$IPTABLES -A FORWARD -p ICMP --icmp-type $type -j ACCEPT |
done |
done |
|
#$IPTABLES -A FORWARD -p ICMP -j LOG --log-prefix "FWD ICMP: " |
echo " done." |
echo " done." |
|
|
# Keep state of connections from private subnets |
# Keep state of connections from private subnets |
|
|
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
if [ ! -z "$ALL_ACCEPT_INPUT_UDP" ]; then |
|
echo -en "Accepting ALL INPUT UDP connections on ports:" |
|
for port in $ALL_ACCEPT_INPUT_UDP; do |
|
for iface in $INTERFACES; do |
|
ip="IP_$iface"; |
|
echo -en " $port($iface)" |
|
$IPTABLES -A INPUT -i $iface -p UDP --dport $port -j ACCEPT |
|
done |
|
done |
|
echo " done." |
|
fi |
|
|
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
ip="IP_$iface"; |
|
|
$IPTABLES -A INPUT -i $iface -d ${!ip} -p ICMP --icmp-type $type -j ACCEPT |
$IPTABLES -A INPUT -i $iface -d ${!ip} -p ICMP --icmp-type $type -j ACCEPT |
done |
done |
done |
done |
|
#$IPTABLES -A INPUT -p ICMP -j LOG --log-prefix "IN ICMP: " |
|
#$IPTABLES -A OUTPUT -p ICMP -j LOG --log-prefix "OUT ICMP: " |
echo " done." |
echo " done." |
|
|
} # }}} |
} # }}} |