| 42,6 → 42,8 |
|---|
| TMP_ip_gw_save="/tmp/ipset_ip_gw_save" # tmp file for already connected ips |
| SSH=`grep ^SSH= $CONF_FILE|cut -d"=" -f2` # sshd active (on/off) |
| SSH=${SSH:=off} |
| SSH_PORT=`grep ^SSH_WAN= $CONF_FILE|cut -d"=" -f2` #ssh WAN port |
| SSH_PORT=${SSH_PORT:=0} |
| SSH_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2` |
| SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"} # WAN IP address to reduce ssh access (all ip allowed on LAN side) |
| IPTABLES="/sbin/iptables" |
| 51,6 → 53,9 |
|---|
| PROXY=`grep ^PROXY= $CONF_FILE|cut -d"=" -f2` |
| PROXY_IP=`grep ^PROXY_IP= $CONF_FILE|cut -d"=" -f2` |
| nb_gw=`grep ^WAN $CONF_FILE|wc -l` |
| HOST=`grep ^HOSTNAME= $CONF_FILE|cut -d"=" -f2` |
| DOM=`grep ^DOMAIN= $CONF_FILE|cut -d"=" -f2` |
| DOMAIN="$HOST.$DOM" |
| |
| # Allow requests to internal DNS if activated |
| if [ "$INT_DNS_ACTIVE" = "on" ] |
| 392,8 → 397,11 |
|---|
| then |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m conntrack --ctstate NEW -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-LAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m conntrack --ctstate NEW --syn -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-WAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m conntrack --ctstate NEW -j ACCEPT |
| if [ $SSH_PORT -gt 0 ] |
| then |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_PORT -m conntrack --ctstate NEW --syn -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-WAN -- ACCEPT" |
| $IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_PORT -m conntrack --ctstate NEW -j ACCEPT |
| fi |
| fi |
| |
| # Insertion de règles locales |