verzia 2.41, 2006/03/04 02:43:23 |
verzia 2.45, 2006/08/09 16:38:13 |
Riadok 57 AWK="${AWK:=/usr/bin/awk}" |
|
Riadok 57 AWK="${AWK:=/usr/bin/awk}" |
|
|
|
# loopback interface |
# loopback interface |
LO_IFACE="${LO_IFACE:=lo}" |
LO_IFACE="${LO_IFACE:=lo}" |
|
# Hide NAT clients behind firewall |
|
NAT_SET_TTL="${NAT_SET_TTL:=no}" |
|
|
# |
# |
# CONSTANTS - Do not edit |
# CONSTANTS - Do not edit |
|
|
mkdir -p "$DEFAULT_CACHE_DIR"; |
mkdir -p "$DEFAULT_CACHE_DIR"; |
fi |
fi |
|
|
config=`cat $DEFAULT_FIREWALL_CONFIG`; |
config=`cat $DEFAULT_FIREWALL_CONFIG $0`; # config file and firewalling script |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{ print $1; }'`; |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{ print $1; }'`; |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
|
|
|
|
|
|
# hide NAT clients behind firewall: - set TTL |
# hide NAT clients behind firewall: - set TTL |
# XXX: warning: this breaks traceroute !!! |
# XXX: warning: this breaks traceroute !!! |
if [ "e$NAT_SET_TTL" = "eyes" ]; then |
if [ ! "a$NAT_SET_TTL" = "ano" ]; then |
echo "NAT: clients hidden behind firewall - setting TTL" |
echo "NAT: clients hidden behind firewall - setting TTL to $NAT_SET_TTL" |
$IPTABLES -t mangle -A POSTROUTING -o $NAT_LAN_IFACE -j TTL --ttl-set 64 |
$IPTABLES -t mangle -A POSTROUTING -o $NAT_LAN_IFACE -j TTL --ttl-set $NAT_SET_TTL |
fi |
fi |
|
|
|
|
Riadok 721 log_forward_drop() |
|
Riadok 723 log_forward_drop() |
|
|
|
} # }}} |
} # }}} |
|
|
|
configure_special_rules() |
|
{ # {{{ |
|
|
|
echo -en "Loading special rules: " |
|
## |
|
## for DSL from Slovanet (Slovak DSL provider) and DSL modem DLINK DSL-360T you must add following rule for proper ssh connect to your machine |
|
## |
|
# echo -en "slovanet " |
|
# $IPTABLES -t mangle -A OUTPUT -s 0/0 -j DSCP --set-dscp 0 |
|
|
|
echo " done."; |
|
|
|
} # }}} |
|
|
do_ip_accounting() |
do_ip_accounting() |
{ # {{{ |
{ # {{{ |
|
|
|
|
log_forward_drop |
log_forward_drop |
forward_on |
forward_on |
do_ip_accounting |
do_ip_accounting |
|
configure_special_rules |
$IPTABLES_SAVE -c > $CACHE_FILE |
$IPTABLES_SAVE -c > $CACHE_FILE |
;; |
;; |
|
|