verzia 2.37, 2006/01/13 18:32:36 |
verzia 2.41, 2006/03/04 02:43:23 |
|
|
fi |
fi |
|
|
config=`cat $DEFAULT_FIREWALL_CONFIG`; |
config=`cat $DEFAULT_FIREWALL_CONFIG`; |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | awk '{ print $1; }'`; |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{ print $1; }'`; |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
|
|
#echo "CACHE_FILE=$CACHE_FILE" |
#echo "CACHE_FILE=$CACHE_FILE" |
|
|
|
|
ip="`get_first_ip_addr IP_$NAT_SUBNET_IFACE`" |
ip="`get_first_ip_addr IP_$NAT_SUBNET_IFACE`" |
netmask="Mask_$NAT_SUBNET_IFACE" |
netmask="Mask_$NAT_SUBNET_IFACE" |
localnet="${!ip}/${!netmask}" |
localnet="$ip/${!netmask}" |
|
|
lan_ip="`get_first_ip_addr IP_$NAT_LAN_IFACE`" |
lan_ip="`get_first_ip_addr IP_$NAT_LAN_IFACE`" |
|
|
|
|
done |
done |
|
|
for redirect in $NAT_TCP_PORT_REDIRECT; do |
for redirect in $NAT_TCP_PORT_REDIRECT; do |
eval `echo $redirect | awk -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
eval `echo $redirect | $AWK -v FS=: '{ printf "remote_port=%s; local_port=%s;", $1, $2; }'` |
echo -en " $remote_port:$local_port" |
echo -en " $remote_port:$local_port" |
$IPTABLES -t nat -A PREROUTING -p TCP \ |
$IPTABLES -t nat -A PREROUTING -p TCP \ |
-i ! $NAT_LAN_IFACE -d ! ${!lan_ip} \ |
-i ! $NAT_LAN_IFACE -d ! $lan_ip \ |
--dport $remote_port -j REDIRECT --to-port $local_port |
--dport $remote_port -j REDIRECT --to-port $local_port |
done |
done |
|
|
|
|
if [ ! -z "$NAT_TCP_PORT_FORWARD" ]; then |
if [ ! -z "$NAT_TCP_PORT_FORWARD" ]; then |
echo -en "\tForwarding ports to local machines:" |
echo -en "\tForwarding ports to local machines:" |
for redirect in $NAT_TCP_PORT_FORWARD; do |
for redirect in $NAT_TCP_PORT_FORWARD; do |
eval `echo $redirect | awk -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
eval `echo $redirect | $AWK -v FS=: '{ printf "src_port=%s; local_machine=%s; dest_port=%s;", $1, $2, $3; }'` |
echo -en " $src_port -> $local_machine:$dest_port" |
echo -en " $src_port -> $local_machine:$dest_port" |
$IPTABLES -t nat -A PREROUTING -p TCP -i $NAT_LAN_IFACE -d ${!lan_ip} \ |
$IPTABLES -t nat -A PREROUTING -p TCP -i $NAT_LAN_IFACE -d $lan_ip \ |
--dport $src_port -j DNAT --to $local_machine:$dest_port |
--dport $src_port -j DNAT --to $local_machine:$dest_port |
$IPTABLES -A FORWARD -p TCP -i $NAT_LAN_IFACE -d $local_machine --dport $dest_port -j ACCEPT |
$IPTABLES -A FORWARD -p TCP -i $NAT_LAN_IFACE -d $local_machine --dport $dest_port -j ACCEPT |
done |
done |
|
|
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
|
|
# hide NAT clients behind firewall: - set TTL |
|
# XXX: warning: this breaks traceroute !!! |
|
if [ "e$NAT_SET_TTL" = "eyes" ]; then |
|
echo "NAT: clients hidden behind firewall - setting TTL" |
|
$IPTABLES -t mangle -A POSTROUTING -o $NAT_LAN_IFACE -j TTL --ttl-set 64 |
|
fi |
|
|
|
|
fi |
fi |
} # }}} |
} # }}} |
|
|
|
|
ip="`get_first_ip_addr IP_$iface`"; |
ip="`get_first_ip_addr IP_$iface`"; |
for redirect in $REDIRECT_TCP; do |
for redirect in $REDIRECT_TCP; do |
eval `echo $redirect | \ |
eval `echo $redirect | \ |
awk -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
$AWK -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
echo -en " $remote_ip:$from_port->$to_port" |
echo -en " $remote_ip:$from_port->$to_port" |
|
|
ip="`get_first_ip_addr IP_$iface`"; |
ip="`get_first_ip_addr IP_$iface`"; |
for redirect in $REDIRECT_UDP; do |
for redirect in $REDIRECT_UDP; do |
eval `echo $redirect | \ |
eval `echo $redirect | \ |
awk -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
$AWK -v FS=: ' (NF == 2) { remote_ip = "0.0.0.0/0"; from_port = $1; to_port = $2; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
(NF == 3) { remote_ip = $1; from_port = $2; to_port = $3; } \ |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
END { printf "remote_ip=%s; from_port=%s; to_port=%s;", remote_ip, from_port, to_port; }'` |
echo -en " $remote_ip:$from_port->$to_port" |
echo -en " $remote_ip:$from_port->$to_port" |
Riadok 729 do_ip_accounting() |
|
Riadok 737 do_ip_accounting() |
|
|
|
ip="`get_first_ip_addr IP_$NAT_SUBNET_IFACE`"; |
ip="`get_first_ip_addr IP_$NAT_SUBNET_IFACE`"; |
netmask="Mask_$NAT_SUBNET_IFACE" |
netmask="Mask_$NAT_SUBNET_IFACE" |
localnet="${!ip}/${!netmask}" |
localnet="$ip/${!netmask}" |
|
|
$IPTABLES -I INPUT -i $NAT_LAN_IFACE -j $IPACCT_IN_NAME |
$IPTABLES -I INPUT -i $NAT_LAN_IFACE -j $IPACCT_IN_NAME |
$IPTABLES -I OUTPUT -o $NAT_LAN_IFACE -j $IPACCT_OUT_NAME |
$IPTABLES -I OUTPUT -o $NAT_LAN_IFACE -j $IPACCT_OUT_NAME |
Riadok 743 do_ip_accounting() |
|
Riadok 751 do_ip_accounting() |
|
done |
done |
|
|
if [ ! "x$DO_LOCAL_IP_ACCOUNTING" = "xno" ]; then |
if [ ! "x$DO_LOCAL_IP_ACCOUNTING" = "xno" ]; then |
accountig_ports=`echo "$NAT_TCP_PORT_REDIRECT " | awk -v RS=' ' -v FS=: '{ print $2; }' | sort -u -r -g ` |
accountig_ports=`echo "$NAT_TCP_PORT_REDIRECT " | $AWK -v RS=' ' -v FS=: '{ print $2; }' | sort -u -r -g ` |
for port in $accountig_ports; do |
for port in $accountig_ports; do |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p TCP --dport $port -j $IPACCT_NAME |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p TCP --dport $port -j $IPACCT_NAME |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p UDP --dport $port -j $IPACCT_NAME |
$IPTABLES -I INPUT -i $NAT_SUBNET_IFACE -p UDP --dport $port -j $IPACCT_NAME |
|
|
split($0, fields, "[ \t:]+"); |
split($0, fields, "[ \t:]+"); |
ip[iface, ipcount[iface]] = fields[4]; |
ip[iface, ipcount[iface]] = fields[4]; |
bcast[iface] = fields[6]; # bad for loopback interface, but we don t need this |
bcast[iface] = fields[6]; # bad for loopback interface, but we don t need this |
|
# try to upgrade gawk (3.1.4-2.0.1 => 3.1.5-1) if you experience problem on the next line |
|
# awk: cmd. line:17: (FILENAME=- FNR=2) fatal: attempt to use array "fields" in a scalar context |
idx = length(fields); |
idx = length(fields); |
mask[iface] = fields[idx]; |
mask[iface] = fields[idx]; |
} |
} |
|
|
syn_flood |
syn_flood |
mangle_prerouting |
mangle_prerouting |
mangle_output |
mangle_output |
|
accept_related |
log_new_connections |
log_new_connections |
drop_output |
drop_output |
allow_input |
allow_input |
allow_output |
allow_output |
allow_icmp |
allow_icmp |
accept_related |
|
accept_loopback |
accept_loopback |
masquerade |
masquerade |
log_input_drop |
log_input_drop |