| 183,7 → 183,7 |
|---|
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW -j ACCEPT |
| fi |
| |
| # Insertion de règles locales |
| 236,7 → 236,7 |
|---|
| |
| # Si le filtrage de domain est activé, blocage des IP de la BL |
| # If DNS filter is on, reject IP of BL |
| # Comment : loading time is too long and iptables should become oveloaded !!! |
| # Comment : loading time is too long and iptables should become oveloaded !!! should use "ipset" instead |
| #if [ $DNS_FILTERING = on ]; then |
| # cd $BL_IP_CAT |
| # for category in `ls -1 | cut -d"@" -f1` |
| 325,11 → 325,6 |
|---|
| ############################# |
| # OUTPUT # |
| ############################# |
| # SSHD rules if activate |
| if [ $SSH = on ] |
| then |
| $IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT |
| fi |
| # On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur |
| # Everything is allowed but traffic through outside network interface |
| $IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT |