| 55,7 → 55,7 |
|---|
| |
| # Insertion de règles de blocage (Devel) |
| # Here, we add block rules (Devel) |
| if [ -s /usr/local/etc/alcasar-iptables-block ]; then |
| if [ -s /usr/local/etc/alcasar-ip-blocked ]; then |
| while read ip_line |
| do |
| ip_on=`echo $ip_line|cut -b1` |
| 65,18 → 65,17 |
|---|
| $IPTABLES -A FORWARD -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT " |
| $IPTABLES -A FORWARD -d $ip_blocked -j REJECT |
| fi |
| done < /usr/local/etc/alcasar-iptables-block |
| done < /usr/local/etc/alcasar-ip-blocked |
| fi |
| |
| # SSHD rules if activate |
| if [ $SSH = on ] |
| then |
| $IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-LAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ACCEPT |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-WAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW -j ACCEPT |
| fi |
| |
| # Insertion de règles locales |
| # Here, we add local rules (i.e. VPN from Internet) |
| if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then |
| 96,17 → 95,12 |
|---|
| $IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 0 -j ACCEPT |
| $IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 8 -j ACCEPT |
| |
| # On ajoute ici les règles spécifiques de filtrage réseau (accès exterieur ...) |
| if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then |
| . /usr/local/etc/alcasar-iptables-local.sh |
| fi |
| |
| # On autorise les retours de connexions légitimes par FORWARD |
| # Conntrack on forward |
| $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT |
| |
| # On autorise les demandes de connexions sortantes |
| $IPTABLES -A FORWARD -i $INTIF -m state --state NEW -j ULOG --ulog-prefix "RULE Transfert -- ACCEPT " |
| $IPTABLES -A FORWARD -i $INTIF -m state --state NEW -j NFLOG --nflog-prefix "RULE Transfert -- ACCEPT " |
| $IPTABLES -A FORWARD -i $INTIF -m state --state NEW -j ACCEPT |
| |
| # On autorise les flux entrant ntp et dns via INTIF |
| 117,8 → 111,8 |
|---|
| $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT |
| |
| # On interdit et on log le reste sur les 2 interfaces d'accès |
| $IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE rej-int -- REJECT " |
| $IPTABLES -A INPUT -i $EXTIF -j ULOG --ulog-prefix "RULE rej-ext -- REJECT " |
| $IPTABLES -A INPUT -i $INTIF -j NFLOG --nflog-prefix "RULE rej-int -- REJECT " |
| $IPTABLES -A INPUT -i $EXTIF -j NFLOG --nflog-prefix "RULE rej-ext -- REJECT " |
| $IPTABLES -A INPUT -p tcp -j REJECT --reject-with tcp-reset |
| $IPTABLES -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable |
| |