Subversion Repositories ALCASAR

Rev

Rev 2468 | Rev 2495 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2468 Rev 2485
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-iptables.sh 2468 2017-12-27 17:22:39Z richard $
 2 
# $Id: alcasar-iptables.sh 2485 2018-02-05 22:05:03Z franck $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# This script writes the netfilter rules for ALCASAR
 4 
# This script writes the netfilter rules for ALCASAR
5 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
6 
#
 6 
#
7 
# Reminders
 7 
# Reminders
Line 41... Line 41...
41 
SSH=${SSH:=off}
 41 
SSH=${SSH:=off}
42 
SSH_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2`
 42 
SSH_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2`
43 
SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"}			# WAN IP address to reduce ssh access (all ip allowed on LAN side)
 43 
SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"}			# WAN IP address to reduce ssh access (all ip allowed on LAN side)
44 
IPTABLES="/sbin/iptables"
 44 
IPTABLES="/sbin/iptables"
45 
IP_REHABILITEES="/etc/dansguardian/lists/exceptioniplist"		# Rehabilitated IP
 45 
IP_REHABILITEES="/etc/dansguardian/lists/exceptioniplist"		# Rehabilitated IP
- 
 
 46 
SITE_DIRECT="/usr/local/etc/alcasar-site-direct"			# Site Direct (no havp and no filtrage) for user BL
46 
 
 47 
 
47 
# Sauvegarde des SET des utilisateurs connectés si ils existent
 48 
# Sauvegarde des SET des utilisateurs connectés si ils existent
48 
# Saving SET of connected users if it exists
 49 
# Saving SET of connected users if it exists
49 
ipset list not_filtered 1>/dev/null 2>&1
 50 
ipset list not_filtered 1>/dev/null 2>&1
50 
if [ $? -eq 0 ];
 51 
if [ $? -eq 0 ];
Line 110... Line 111...
110 
for ip in $(cat $IP_REHABILITEES)
 111 
for ip in $(cat $IP_REHABILITEES)
111 
do
 112 
do
112 
	ipset del bl_ip_blocked $ip
 113 
	ipset del bl_ip_blocked $ip
113 
done
 114 
done
114 
 
 115 
 
- 
 
 116 
# rajout exception havp_bl --> Site en direct pour les Utilisateurs filtrés
- 
 
 117 
ipset create site_direct hash:net hashsize 1024
- 
 
 118 
for site in $(cat $SITE_DIRECT)
- 
 
 119 
do
- 
 
 120 
        ipset add site_direct $site
- 
 
 121 
done
- 
 
 122 
 
115 
###### WL set  ###########
 123 
###### WL set  ###########
116 
# taille fixe, car peupler par dnsmasq / fixe length due to dnsmasq dynamic loading
 124 
# taille fixe, car peupler par dnsmasq / fixe length due to dnsmasq dynamic loading
117 
wl_set_length=65536
 125 
wl_set_length=65536
118 
# Chargement Loading
 126 
# Chargement Loading
119 
echo "create wl_ip_allowed hash:net family inet hashsize 1024 maxelem $wl_set_length" > $TMP_set_save
 127 
echo "create wl_ip_allowed hash:net family inet hashsize 1024 maxelem $wl_set_length" > $TMP_set_save
Line 196... Line 204...
196 
# Redirect HTTP of 'havp_wl' users who want IP not in the WL to ALCASAR ('access denied' page)
 204 
# Redirect HTTP of 'havp_wl' users who want IP not in the WL to ALCASAR ('access denied' page)
197 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src -m set ! --match-set wl_ip_allowed dst -p tcp --dport http -j REDIRECT --to-port 80
 205 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src -m set ! --match-set wl_ip_allowed dst -p tcp --dport http -j REDIRECT --to-port 80
198 
 
 206 
 
199 
# Redirection des requêtes HTTP sortantes des usagers 'havp_bl' vers DansGuardian
 207 
# Redirection des requêtes HTTP sortantes des usagers 'havp_bl' vers DansGuardian
200 
# Redirect outbound HTTP requests of "BL" users to DansGuardian (transparent proxy)
 208 
# Redirect outbound HTTP requests of "BL" users to DansGuardian (transparent proxy)
201 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8080
 209 
# $IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8080
202 
 
 - 
 
- 
 
 210 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport http -j REDIRECT --to-port 8080
203 
# Redirection des requêtes HTTP sortantes des usager 'havp_wl' et 'havp' vers Tinyproxy
 211 
# Redirection des requêtes HTTP sortantes des usager 'havp_wl' et 'havp' vers Tinyproxy
204 
# Redirect outbound HTTP requests for "WL-antivirus" users to Tinyproxy
 212 
# Redirect outbound HTTP requests for "WL-antivirus" users to Tinyproxy
205 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
 213 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
206 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
 214 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
207 
 
 215