verzia 2.6, 2005/01/02 02:37:12 |
verzia 2.7, 2005/01/02 13:31:46 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.5 2005/01/02 01:49:01 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.6 2005/01/02 02:37:12 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2004-11-14 - created |
# 2004-11-14 - created |
Riadok 276 mangle_output() |
|
Riadok 276 mangle_output() |
|
masquerade() |
masquerade() |
{ # {{{ |
{ # {{{ |
if [ ! -z "$NAT_LAN_IFACE" ]; then |
if [ ! -z "$NAT_LAN_IFACE" ]; then |
echo -en "Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE" |
echo -en "NAT: Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE" |
|
|
ip="IP_$NAT_SUBNET_IFACE"; |
ip="IP_$NAT_SUBNET_IFACE"; |
netmask="Mask_$NAT_SUBNET_IFACE" |
netmask="Mask_$NAT_SUBNET_IFACE" |
|
|
|
|
$IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE |
$IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE |
|
|
|
echo " done." |
|
|
# don't forward Miscrosoft protocols - NOT RFC compliant packets |
# don't forward Miscrosoft protocols - NOT RFC compliant packets |
if [ ! -z "$NAT_FORWARD_MICROSOFT" ]; then |
if [ ! -z "$NAT_FORWARD_MICROSOFT" ]; then |
if [ "x$NAT_FORWARD_MICROSOFT" = "xno" ]; then |
if [ "x$NAT_FORWARD_MICROSOFT" = "xno" ]; then |
|
|
fi |
fi |
|
|
if [ ! -z "$NAT_FORWARD_TCP_PORTS" ]; then |
if [ ! -z "$NAT_FORWARD_TCP_PORTS" ]; then |
echo -en "Accepting FORWARD TCP ports:" |
echo -en "\tAccepting FORWARD TCP ports:" |
for port in $NAT_FORWARD_TCP_PORTS; do |
for port in $NAT_FORWARD_TCP_PORTS; do |
echo -en " $port" |
echo -en " $port" |
$IPTABLES -A FORWARD -p TCP --dport $port -m state --state NEW -j ACCEPT |
$IPTABLES -A FORWARD -p TCP --dport $port -m state --state NEW -j ACCEPT |
|
|
fi |
fi |
|
|
if [ ! -z "$NAT_FORWARD_UDP_PORTS" ]; then |
if [ ! -z "$NAT_FORWARD_UDP_PORTS" ]; then |
echo -en "Accepting FORWARD UDP ports:" |
echo -en "\tAccepting FORWARD UDP ports:" |
for port in $NAT_FORWARD_UDP_PORTS; do |
for port in $NAT_FORWARD_UDP_PORTS; do |
echo -en " $port" |
echo -en " $port" |
$IPTABLES -A FORWARD -p UDP --dport $port -m state --state NEW -j ACCEPT |
$IPTABLES -A FORWARD -p UDP --dport $port -m state --state NEW -j ACCEPT |
|
|
echo " done." |
echo " done." |
fi |
fi |
|
|
|
echo -en "\tAccepting ICMP packets:" |
|
for type in $ACCEPT_ICMP_PACKETS; do |
|
echo -en " $type" |
|
$IPTABLES -A FORWARD -p ICMP --icmp-type $type -j ACCEPT |
|
done |
|
echo " done." |
|
|
# Keep state of connections from private subnets |
# Keep state of connections from private subnets |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
|
echo " done." |
|
|
|
fi |
fi |
} # }}} |
} # }}} |
|
|
|
|
$IPTABLES -A INPUT -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server |
$IPTABLES -A INPUT -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server |
|
|
# accept only allowed ICMP packets |
# accept only allowed ICMP packets |
for type in echo-reply destination-unreachable echo-request time-exceeded; do |
for type in $ACCEPT_ICMP_PACKETS; do |
echo -en " $type" |
echo -en " $type" |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
ip="IP_$iface"; |