| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar-iptables.sh 3040 2022-07-17 22:31:53Z rexy $
|
2 |
# $Id: alcasar-iptables.sh 3041 2022-07-20 21:06:54Z rexy $
|
| 3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
| 4 |
# This script writes the netfilter rules for ALCASAR
|
4 |
# This script writes the netfilter rules for ALCASAR
|
| 5 |
# Rexy - 3abtux - CPN
|
5 |
# Rexy - 3abtux - CPN
|
| 6 |
#
|
6 |
#
|
| 7 |
# Reminders
|
7 |
# Reminders
|
| Line 40... |
Line 40... |
| 40 |
TMP_users_set_save="/tmp/users_set_save" # tmp file for backup users set
|
40 |
TMP_users_set_save="/tmp/users_set_save" # tmp file for backup users set
|
| 41 |
TMP_set_save="/tmp/ipset_save" # tmp file for blacklist and whitelist creation
|
41 |
TMP_set_save="/tmp/ipset_save" # tmp file for blacklist and whitelist creation
|
| 42 |
TMP_ip_gw_save="/tmp/ipset_ip_gw_save" # tmp file for already connected ips
|
42 |
TMP_ip_gw_save="/tmp/ipset_ip_gw_save" # tmp file for already connected ips
|
| 43 |
SSH=`grep ^SSH= $CONF_FILE|cut -d"=" -f2` # sshd active (on/off)
|
43 |
SSH=`grep ^SSH= $CONF_FILE|cut -d"=" -f2` # sshd active (on/off)
|
| 44 |
SSH=${SSH:=off}
|
44 |
SSH=${SSH:=off}
|
| - |
|
45 |
SSH_LAN=`grep ^SSH_LAN= $CONF_FILE|cut -d"=" -f2` # local SSH active
|
| - |
|
46 |
SSH_LAN=${SSH_LAN:=off}
|
| 45 |
SSH_PORT=`grep ^SSH_WAN= $CONF_FILE|cut -d"=" -f2` #ssh WAN port
|
47 |
SSH_PORT=`grep ^SSH_WAN= $CONF_FILE|cut -d"=" -f2` #ssh WAN port
|
| 46 |
SSH_PORT=${SSH_PORT:=0}
|
48 |
SSH_PORT=${SSH_PORT:=0}
|
| 47 |
SSH_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2`
|
49 |
SSH_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2`
|
| 48 |
SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"} # WAN IP address to reduce ssh access (all ip allowed on LAN side)
|
50 |
SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"} # WAN IP address to reduce ssh access (all ip allowed on LAN side)
|
| 49 |
IPTABLES="/sbin/iptables"
|
51 |
IPTABLES="/sbin/iptables"
|
| Line 393... |
Line 395... |
| 393 |
|
395 |
|
| 394 |
# Accès au serveur SSHD si activé
|
396 |
# Accès au serveur SSHD si activé
|
| 395 |
# SSHD server access if enabled
|
397 |
# SSHD server access if enabled
|
| 396 |
if [ $SSH = on ]
|
398 |
if [ $SSH = on ]
|
| 397 |
then
|
399 |
then
|
| - |
|
400 |
if [ $SSH_LAN = on ]
|
| - |
|
401 |
then
|
| 398 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m conntrack --ctstate NEW -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-LAN -- ACCEPT"
|
402 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m conntrack --ctstate NEW -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-LAN -- ACCEPT"
|
| 399 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
|
403 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
|
| - |
|
404 |
fi
|
| 400 |
if [ $SSH_PORT -gt 0 ]
|
405 |
if [ $SSH_PORT -gt 0 ]
|
| 401 |
then
|
406 |
then
|
| 402 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_PORT -m conntrack --ctstate NEW --syn -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-WAN -- ACCEPT"
|
407 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_PORT -m conntrack --ctstate NEW --syn -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-WAN -- ACCEPT"
|
| 403 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_PORT -m conntrack --ctstate NEW -j ACCEPT
|
408 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_PORT -m conntrack --ctstate NEW -j ACCEPT
|
| 404 |
fi
|
409 |
fi
|