verzia 2.39, 2006/02/28 17:50:00 |
verzia 2.47, 2006/09/24 16:17:10 |
Riadok 57 AWK="${AWK:=/usr/bin/awk}" |
|
Riadok 57 AWK="${AWK:=/usr/bin/awk}" |
|
|
|
# loopback interface |
# loopback interface |
LO_IFACE="${LO_IFACE:=lo}" |
LO_IFACE="${LO_IFACE:=lo}" |
|
# Hide NAT clients behind firewall |
|
NAT_SET_TTL="${NAT_SET_TTL:=no}" |
|
|
# |
# |
# CONSTANTS - Do not edit |
# CONSTANTS - Do not edit |
|
|
mkdir -p "$DEFAULT_CACHE_DIR"; |
mkdir -p "$DEFAULT_CACHE_DIR"; |
fi |
fi |
|
|
config=`cat $DEFAULT_FIREWALL_CONFIG`; |
config=`cat $DEFAULT_FIREWALL_CONFIG $0`; # config file and firewalling script |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{ print $1; }'`; |
md5key=`echo "config = '$config' parsed_interfaces ='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{ print $1; }'`; |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
|
|
|
|
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
|
|
# hide NAT clients behind firewall: - set TTL |
|
# XXX: warning: this breaks traceroute !!! |
|
if [ ! "a$NAT_SET_TTL" = "ano" ]; then |
|
echo "NAT: clients hidden behind firewall - setting TTL to $NAT_SET_TTL" |
|
$IPTABLES -t mangle -A POSTROUTING -o $NAT_LAN_IFACE -j TTL --ttl-set $NAT_SET_TTL |
|
fi |
|
|
|
|
fi |
fi |
} # }}} |
} # }}} |
|
|
|
|
$IPTABLES -A INPUT -s $client_ip -i $NAT_SUBNET_IFACE -j DROP |
$IPTABLES -A INPUT -s $client_ip -i $NAT_SUBNET_IFACE -j DROP |
done |
done |
fi |
fi |
|
if [ ! -z "$ALL_DROP_INPUT_TCP" ]; then |
|
echo -en "Drop ALL INPUT TCP connections on ports:" |
|
for port in $ALL_DROP_INPUT_TCP; do |
|
for iface in $INTERFACES; do |
|
echo -en " $port($iface)" |
|
IPS="IP_$iface"; |
|
for ip in ${!IPS}; do |
|
$IPTABLES -A INPUT -i $iface -d $ip -p TCP --dport $port -j DROP |
|
done |
|
done |
|
done |
|
echo " done." |
|
fi |
|
if [ ! -z "$ALL_DROP_INPUT_UDP" ]; then |
|
echo -en "Drop ALL INPUT UDP connections on ports:" |
|
for port in $ALL_DROP_INPUT_UDP; do |
|
for iface in $INTERFACES; do |
|
echo -en " $port($iface)" |
|
IPS="IP_$iface"; |
|
for ip in ${!IPS}; do |
|
$IPTABLES -A INPUT -i $iface -d $ip -p UDP --dport $port -j DROP |
|
done |
|
done |
|
done |
|
echo " done." |
|
fi |
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
echo -en "Accepting ALL INPUT TCP connections on ports:" |
echo -en "Accepting ALL INPUT TCP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_TCP; do |
for port in $ALL_ACCEPT_INPUT_TCP; do |
Riadok 713 log_forward_drop() |
|
Riadok 749 log_forward_drop() |
|
|
|
} # }}} |
} # }}} |
|
|
|
configure_special_rules() |
|
{ # {{{ |
|
|
|
echo -en "Loading special rules: " |
|
## |
|
## for DSL from Slovanet (Slovak DSL provider) and DSL modem DLINK DSL-360T you must add following rule for proper ssh connect to your machine |
|
## |
|
# echo -en "slovanet " |
|
# $IPTABLES -t mangle -A OUTPUT -s 0/0 -j DSCP --set-dscp 0 |
|
|
|
echo " done."; |
|
|
|
} # }}} |
|
|
do_ip_accounting() |
do_ip_accounting() |
{ # {{{ |
{ # {{{ |
|
|
|
|
nmap_scan_filter |
nmap_scan_filter |
invalid_packet_filter |
invalid_packet_filter |
anti_spoof_filter |
anti_spoof_filter |
syn_flood |
#syn_flood |
mangle_prerouting |
mangle_prerouting |
mangle_output |
mangle_output |
|
accept_related |
log_new_connections |
log_new_connections |
drop_output |
drop_output |
allow_input |
allow_input |
allow_output |
allow_output |
allow_icmp |
allow_icmp |
accept_related |
|
accept_loopback |
accept_loopback |
masquerade |
masquerade |
log_input_drop |
log_input_drop |
|
|
log_forward_drop |
log_forward_drop |
forward_on |
forward_on |
do_ip_accounting |
do_ip_accounting |
|
configure_special_rules |
$IPTABLES_SAVE -c > $CACHE_FILE |
$IPTABLES_SAVE -c > $CACHE_FILE |
;; |
;; |
|
|