Subversion Repositories ALCASAR

Rev

Rev 2994 | Rev 3016 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2994 Rev 2995
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
#
 2 
#
3 
# $Id: alcasar-iptables-local.sh 2994 2022-03-08 23:02:14Z rexy $
 3 
# $Id: alcasar-iptables-local.sh 2995 2022-03-09 18:35:06Z rexy $
4 
#
 4 
#
5 
# Custom rules for ALCASAR firewall
 5 
# Custom rules for ALCASAR firewall
6 
#
 6 
#
7 
# Examples:
 7 
# Examples:
8 
# 	- Local MAC addresses filtering (MAC are in '/usr/local/etc/alcasar-iptables-local-mac-filtered'. Format : aa:09:23:2f:4d:ee)
 8 
# 	- Local MAC addresses filtering (MAC are in '/usr/local/etc/alcasar-iptables-local-mac-filtered'. Format : aa:09:23:2f:4d:ee)
Line 41... Line 41...
41 
#protectedNetworks='10.0.0.0/8,172.16.0.0/12,192.168.0.0/16' # (RFC 1918)
 41 
#protectedNetworks='10.0.0.0/8,172.16.0.0/12,192.168.0.0/16' # (RFC 1918)
42 
#[ -n "$TUNIF" ] && consultationIF=$TUNIF || consultationIF=$INTIF
 42 
#[ -n "$TUNIF" ] && consultationIF=$TUNIF || consultationIF=$INTIF
43 
#$IPTABLES -A FORWARD -i $consultationIF -d $protectedNetworks -j DROP
 43 
#$IPTABLES -A FORWARD -i $consultationIF -d $protectedNetworks -j DROP
44 
#$IPTABLES -A FORWARD -o $consultationIF -s $protectedNetworks -j DROP
 44 
#$IPTABLES -A FORWARD -o $consultationIF -s $protectedNetworks -j DROP
45 
 
 45 
 
46 
# On autorise ALCASAR a accéder à un serveur MAIL (envoie de rapports, alertes, inscription d'utilisateurs, etc.)
 46 
# On autorise ALCASAR à contacter un serveur MAIL externe (envoie de rapports, alertes, inscription d'utilisateurs, etc.)
47 
# Allow ALCASAR to connect to a mail server (send reports, alerts, users registration, etc.)
 47 
# Allow ALCASAR to connect to a mail server (send reports, alerts, users registration, etc.)
48 
#SMTP_IP='192.168.111.5'
 48 
#SMTP_IP='192.168.111.5'
49 
#SMTP_PORT=25
 49 
#SMTP_PORT=25
50 
#$IPTABLES -A OUTPUT -p tcp -d $SMTP_IP --dport $SMTP_PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 50 
#$IPTABLES -A OUTPUT -p tcp -d $SMTP_IP --dport $SMTP_PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
51 
#$IPTABLES -A INPUT  -p tcp -s $SMTP_IP --sport $SMTP_PORT -m conntrack --ctstate ESTABLISHED     -j ACCEPT
 51 
#$IPTABLES -A INPUT  -p tcp -s $SMTP_IP --sport $SMTP_PORT -m conntrack --ctstate ESTABLISHED     -j ACCEPT
Line 63... Line 63...
63 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p tcp -d $PUBLIC_IP --dport 11222 -j DNAT --to 192.168.182.10:22
 63 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p tcp -d $PUBLIC_IP --dport 11222 -j DNAT --to 192.168.182.10:22
64 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p udp -d $PUBLIC_IP --dport 11222 -j DNAT --to 192.168.182.10:22
 64 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p udp -d $PUBLIC_IP --dport 11222 -j DNAT --to 192.168.182.10:22
65 
#$IPTABLES -A FORWARD -p tcp -d 192.168.182.10 --dport 22 -j ACCEPT
 65 
#$IPTABLES -A FORWARD -p tcp -d 192.168.182.10 --dport 22 -j ACCEPT
66 
#$IPTABLES -A FORWARD -p udp -d 192.168.182.10 --dport 22 -j ACCEPT
 66 
#$IPTABLES -A FORWARD -p udp -d 192.168.182.10 --dport 22 -j ACCEPT
67 
 
 67 
 
68 
# On autorise l'accès depuis Internet (multiports) vers un équipement du LAN (qui doit être en IP fixe)
 68 
# On autorise l'accès depuis Internet (en multiports) vers un équipement du LAN (qui doit être en IP fixe)
69 
# Access is allowed from Internet (multiports) to a LAN equipment (which must be in static IP)
 69 
# Access is allowed from Internet (multiports) to a LAN equipment (which must be in static IP)
70 
#ext_ports=11223:11323; int_ports=12000:12100
 70 
#ext_ports=11223:11323; int_ports=12000:12100
71 
#to_ip=192.168.182.7
 71 
#to_ip=192.168.182.7
72 
#int_ports_dnat=`echo $int_ports|tr : -`
 72 
#int_ports_dnat=`echo $int_ports|tr : -`
73 
#ext_ports_dnat=`echo $ext_ports|tr : -`
 73 
#ext_ports_dnat=`echo $ext_ports|tr : -`
- 
 
 74 
#first_ext_port=`echo $ext_ports|cut -d":" -f1`
74 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p tcp -d $PUBLIC_IP -m multiport --dports $ext_ports -j DNAT --to $to_ip:$int_ports_dnat
 75 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p tcp -d $PUBLIC_IP --dport $ext_ports -j DNAT --to $to_ip:$int_ports_dnat/$first_ext_port
75 
#$IPTABLES -A FORWARD -i $EXTIF -p tcp -d $to_ip -m multiport --dports $int_ports -j ACCEPT
 76 
#$IPTABLES -A FORWARD -i $EXTIF -p tcp -d $to_ip -m multiport --dports $int_ports -j ACCEPT
76 
#$IPTABLES -A PREROUTING -i $INTIF -t nat -p tcp -s $to_ip -m multiport --sports $int_ports -j DNAT --to :$ext_ports_dnat
 - 
 
77 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p udp -d $PUBLIC_IP -m multiport --dports $ext_ports -j DNAT --to $to_ip:$int_ports_dnat
 77 
#$IPTABLES -A PREROUTING -i $EXTIF -t nat -p udp -d $PUBLIC_IP --dport $ext_ports -j DNAT --to $to_ip:$int_ports_dnat/$first_ext_port
78 
#$IPTABLES -A FORWARD -i $EXTIF -p udp -d $to_ip -m multiport --dports $int_ports -j ACCEPT
 78 
#$IPTABLES -A FORWARD -i $EXTIF -p udp -d $to_ip -m multiport --dports $int_ports -j ACCEPT
79 
#$IPTABLES -A PREROUTING -i $INTIF -t nat -p udp -s $to_ip -m multiport --sports $int_ports -j DNAT --to :$ext_ports_dnat
 - 
 
80 
 
 79