WebSVN – ALCASAR – Diff – /scripts/alcasar-iptables.sh

 #!/bin/bash
-# $Id: alcasar-iptables.sh 1291 2014-01-10 17:49:15Z richard $
+# $Id: alcasar-iptables.sh 1294 2014-01-12 23:03:00Z richard $
 # Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 # This script write the netfilter rules for ALCASAR
 # Rexy - 3abtux - CPN
+#
 # Reminders
 # There are four channels for log :
-#	1 tracability with The 'Netflow' kernel module (iptables target = NETFLOW);
+#	1 tracability of the consultation equipment with The 'Netflow' kernel module (iptables target = NETFLOW);
 #	2 protection of ALCASAR with the Ulog group 1 (default group)
-#	3 SSH with the ulog group 2;
+#	3 SSH on ALCASAR with the Ulog group 2;
-#	4 extern access attempts with the ulog group 3.
+#	4 extern access attempts on ALCASAR with the Ulog group 3.
 # The bootps/dhcp (67) port is always open on tun0/eth1 by coova
 conf_file="/usr/local/etc/alcasar.conf"
 private_ip_mask=`grep PRIVATE_IP= $conf_file|cut -d"=" -f2`
 private_ip_mask=${private_ip_mask:=192.168.182.1/24}
 PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
 DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
 PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
 PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
 DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
 DNS_FILTERING=${DNS_FILTERING:=off}
-BL_IP_CAT="/usr/local/share/iptables-bl-enabled"			# categories files of the BlackListed IP
+BL_IP_CAT="/usr/local/share/iptables-bl"				# categories files of the BlackListed IP
 QOS=`grep QOS= $conf_file|cut -d"=" -f2`				# QOS (on/off)
 QOS=${QOS:=off}
 SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
 SSH=${SSH:=off}
 SSH_ADMIN_FROM=`grep SSH_ADMIN_FROM= $conf_file|cut -d"=" -f2`
 # destruction de tous les SET
 # destroy all the SET
 ipset destroy
-# Création du SET alcasar_ip_blocked et premier peuplement
+# Création et peuplement du SET alcasar_ip_blocked
-# creation of alcasar_ip_blocked SET and first populating
+# creation and first populating of alcasar_ip_blocked SET
 ipset create alcasar_ip_blocked hash:net hashsize 1024
 if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
 	while read ip_line
 	do
 		ip_on=`echo $ip_line|cut -b1`
 		if [ $ip_on != "#" ]
 		then
 			ip_blocked=`echo $ip_line|cut -d" " -f1`
-			echo $ip_blocked
 			ipset add alcasar_ip_blocked $ip_blocked
 		fi
 	done < /usr/local/etc/alcasar-ip-blocked
 fi
+# Création et initialisation du SET authenticated_ip (dynamiquement peuplé par les scripts conup/condown)
+# creation and initialization of authenticated_ip_ SET (populated dynamicly by conup/condown scripts)
+ipset create authenticated_ip hash:net hashsize 1024
+OLDIFS=$IFS
+IFS=$'\n'
+for equipment in `/usr/sbin/chilli_query list |grep -v "\.0\.0\.0"`
+do
+	active_ip=`echo $equipment |cut -d" " -f2`
+	active_session=`echo $equipment |cut -d" " -f5`
+	if [[ $(expr $active_session) -eq 1 ]]
+	then
+		ipset add authenticated_ip $active_ip
+	fi
+done
+IFS=$OLDIFS
+# Création et peuplement du SET blacklist_ip_blocked
+# creation and first populating of blacklist_ip_blocked SET
+# wait for a better blacklist adapt process
+#ipset create blacklist_ip_blocked hash:net hashsize 1024
+#cd $BL_IP_CAT
+#for category in `ls -1 | cut -d"@" -f1`
+#do
+#	while read ip_blocked
+#	do
+#		ipset add blacklist_ip_blocked $ip_blocked
+#	done < $BL_IP_CAT/$category
+#done
 #############################
 #       PREROUTING          #
 #############################
 # Marquage (et journalisation) des paquets qui tentent d'accéder directement à DansGuardian pour pouvoir les rejeter en INPUT
 # mark (and log) the dansguardian bypass attempts in order to DROP them in INPUT rules
 			$IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -s $ip_exception -d $PRIVATE_IP --dport domain -j ACCEPT
 		done < /usr/local/etc/alcasar-filter-exceptions
 	fi
 		$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 54
 fi
-# Redirection des requêtes HTTP des IP bloquées vers ALCASAR (page 'accès interdit')
+# Redirection des requêtes HTTP des IP admin bannies vers ALCASAR (page 'accès interdit')
-# Redirect HTTP requests of banned ip to ALCASAR (access deny window)
+# Redirect HTTP requests of admin banned ip to ALCASAR (access deny window)
-$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -m set --match-set alcasar_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80
+$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -m set --match-set alcasar_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port http
+# Redirection des requêtes HTTP des IP de la blacklist vers ALCASAR (page 'accès interdit')
+# Redirect HTTP requests of blacklist ip to ALCASAR (access deny window)
+#if [ $DNS_FILTERING = on ]; then
+#$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -m set --match-set blacklist_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80
+#fi
+# Redirection des requêtes HTTPS des IP sans utilisateurs authentifiés vers ALCASAR (page d'interception)
+# Redirect HTTPS requests of IP that don't have authenticate user to ALCASAR (intercept page)
+$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -m set ! --match-set authenticated_ip src ! -d $PRIVATE_IP -p tcp --dport https -j REDIRECT --to-port https
 # Journalisation des requètes HTTP vers Internet (seulement les paquets SYN) - Les autres protocoles sont journalisés en FORWARD par netflow
 ## Log HTTP requests to Internet (only syn packets) - Other protocols are log in FORWARD by netflow
 $IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -m state --state NEW -j ULOG --ulog-prefix "RULE F_http -- ACCEPT "
 $IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
 $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
 # Blocage des IPs du SET alcasar_ip_blocked
 # Deny IPs of the SET alcasar_ip_blocked
-$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -m set --match-set alcasar_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80
-$IPTABLES -A FORWARD -i $TUNIF -m set --match-set alcasar_ip_blocked dst -p udp -j REJECT --reject-with icmp-port-unreachable
 $IPTABLES -A FORWARD -i $TUNIF -m set --match-set alcasar_ip_blocked dst -p icmp -j REJECT --reject-with icmp-port-unreachable
+$IPTABLES -A FORWARD -i $TUNIF -m set --match-set alcasar_ip_blocked dst -p udp -j REJECT --reject-with icmp-port-unreachable
 $IPTABLES -A FORWARD -i $TUNIF -m set --match-set alcasar_ip_blocked dst -p tcp -j REJECT --reject-with tcp-reset
-# Si le filtrage de domain est activé, blocage des IP de la BL
+# Blocage des IPs du SET blacklist_ip_blocked
-# If DNS filter is on, reject IP of BL
+# Deny IPs of the SET blacklist_ip_blocked
-# Comment : loading time is too long and iptables should become oveloaded !!! should use "ipset" instead
 #if [ $DNS_FILTERING = on ]; then
-#	cd $BL_IP_CAT
-#	for category in `ls -1 | cut -d"@" -f1`
-#	do
-#		while read ip_blocked
-#		do
-#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
-#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p udp -j REJECT --reject-with icmp-port-unreachable
+#	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set blacklist_ip_blocked -p icmp -j REJECT --reject-with icmp-port-unreachable
-#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p icmp -j REJECT --reject-with icmp-port-unreachable
+#	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set blacklist_ip_blocked dst -p udp -j REJECT --reject-with icmp-port-unreachable
-#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
+#	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set blacklist_ip_blocked -p tcp -j REJECT --reject-with tcp-reset
-#		done < $BL_IP_CAT/$category
-#	done
 #fi
 # Autorisation des retours de connexions légitimes
 $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Subversion Repositories ALCASAR

(root)/scripts/alcasar-iptables.sh @ 2668 – Rev 1291 → 1294