Subversion Repositories ALCASAR

Rev

Rev 577 | Rev 612 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 577 Rev 604
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
# $Id: alcasar-iptables.sh 577 2011-04-18 18:30:38Z franck $
 2 
# $Id: alcasar-iptables.sh 604 2011-05-15 21:23:10Z richard $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# This script write the netfilter rules for ALCASAR
 4 
# This script write the netfilter rules for ALCASAR
5 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
6 
# There are three channels for log :
 6 
# There are three channels for log :
7 
#	1 (default) for tracability;
 7 
#	1 (default) for tracability;
8 
#	2 for secure admin (ssh);
 8 
#	2 for secure admin (ssh);
9 
#	3 for exterior access attempts.
 9 
#	3 for exterior access attempts.
10 
# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
 10 
# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
11 
 
 11 
 
- 
 
 12 
private_ip_mask=`grep PRIVATE_IP /usr/local/etc/alcasar-network|cut -d"=" -f2`
- 
 
 13 
private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`		# LAN IP address (ie.: 192.168.182.0)
- 
 
 14 
private_prefix=`/bin/ipcalc -p $private_ip_mask|cut -d"=" -f2`		# LAN prefix (ie. 24)
- 
 
 15 
dns1=`grep DNS1 /usr/local/etc/alcasar-network|cut -d"=" -f2`		# first public DNS server
- 
 
 16 
dns2=`grep DNS2 /usr/local/etc/alcasar-network|cut -d"=" -f2`		# second public DNS server
- 
 
 17 
 
12 
IPTABLES="/sbin/iptables"
 18 
IPTABLES="/sbin/iptables"
13 
PROTO_FILTERING="no"
 19 
PROTO_FILTERING="no"
14 
DNS_FILTERING="no"
 20 
DNS_FILTERING="no"
15 
QOS="no"
 21 
QOS="no"
16 
EXTIF="eth0"
 22 
EXTIF="eth0"
17 
INTIF="eth1"
 23 
INTIF="eth1"
18 
TUNIF="tun0"
 24 
TUNIF="tun0"								# listen card for chilli daemon
19 
PRIVATE_NETWORK_MASK="192.168.182.0/24"
 25 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
20 
PRIVATE_IP="192.168.182.1"
 26 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
21 
DNSSERVERS="208.67.220.220,208.67.222.222"
 27 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
22 
 
 28 
 
23 
# Effacement des règles existantes
 29 
# Effacement des règles existantes
24 
# Flush all existing rules
 30 
# Flush all existing rules
25 
$IPTABLES -F
 31 
$IPTABLES -F
26 
$IPTABLES -t nat -F
 32 
$IPTABLES -t nat -F
Line 75... Line 81...
75 
 
 81 
 
76 
# On stoppe les broadcasts et multicast
 82 
# On stoppe les broadcasts et multicast
77 
# Drop broadcast & multicast
 83 
# Drop broadcast & multicast
78 
$IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
 84 
$IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
79 
 
 85 
 
80 
# On laisse passer les ICMP echo-request et echo-reply en provenance du LAN
 - 
 
81 
# Allow ping (icmp N°0 & 8) from LAN
 - 
 
82 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 0 -j ACCEPT
 - 
 
83 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 8 -j ACCEPT
 - 
 
84 
 
 - 
 
85 
# Insertion de règles locales
 - 
 
86 
# Here, we add local rules (i.e. ssh from Internet)
 - 
 
87 
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
 - 
 
88 
        . /usr/local/etc/alcasar-iptables-local.sh
 - 
 
89 
fi
 - 
 
90 
 
 - 
 
91 
# Rejet des tentatives de création de tunnels DNS (même pour les utilisateurs authentifiés)
86 
# Rejet des tentatives de création de tunnels DNS (même pour les utilisateurs authentifiés)
92 
# Deny forward DNS (even for authenticated users ...)
 87 
# Deny forward DNS (even for authenticated users ...)
93 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
 88 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
94 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
 89 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
95 
 
 90 
 
Line 164... Line 159...
164 
# Autorisation des connections sortant du LAN
159 
# Autorisation des connections sortant du LAN
165 
# Allow forward connections with log
 160 
# Allow forward connections with log
166 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
 161 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
167 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
 162 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
168 
 
 163 
 
169 
###########################################################################################
 164 
#################################################################################################
170 
#  Direct input from local network (dns, ntp, https, http, ssh and 3990 (user disconnect) #
 165 
#  Direct input from local network (icmp, dns, ntp, https, http, ssh and 3990 (user disconnect) #
171 
###########################################################################################
 166 
#################################################################################################
- 
 
 167 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 0 -j ACCEPT # ping reply
- 
 
 168 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp --icmp-type 8 -j ACCEPT # ping request
172 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport domain -j ACCEPT # dnsmasq without forward
 169 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport domain -j ACCEPT # dnsmasq without forward
173 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT # dnsmasq with blackhole
 170 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT # dnsmasq with blackhole
174 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT
 171 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT
175 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport https -j ACCEPT
 172 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport https -j ACCEPT
176 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport http -j ACCEPT
 173 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport http -j ACCEPT
177 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
 - 
 
178 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
 - 
 
179 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport 3990 -j ACCEPT
 174 
$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport 3990 -j ACCEPT
180 
 
 175 
 
- 
 
 176 
# SSHD rules if activate
- 
 
 177 
ssh_active=`grep SSH /usr/local/etc/alcasar-network|cut -d"=" -f2`
- 
 
 178 
if [ $ssh_active = "on" ]
- 
 
 179 
	then
- 
 
 180 
	Admin_from_IP="0.0.0.0/0.0.0.0"		# Une @IP fixe peut-être fournie pour restreindre l'accès en ssh depuis l'extérieur (ex: 80.22.21.53/24) ( 0.0.0.0/0.0.0.0  = de n'importe où ! )
- 
 
 181 
	$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
- 
 
 182 
	$IPTABLES -A INPUT -i $TUNIF -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
- 
 
 183 
	$IPTABLES -A INPUT -i $EXTIF -p tcp --dport ssh -s $Admin_from_IP -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
- 
 
 184 
	$IPTABLES -A INPUT -i $EXTIF -p tcp --dport ssh -s $Admin_from_IP -m state --state NEW,ESTABLISHED -j ACCEPT
- 
 
 185 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT
- 
 
 186 
fi
- 
 
 187 
 
- 
 
 188 
# Insertion de règles locales
- 
 
 189 
# Here, we add local rules (i.e. ssh from Internet)
- 
 
 190 
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
- 
 
 191 
        . /usr/local/etc/alcasar-iptables-local.sh
- 
 
 192 
fi
- 
 
 193 
 
181 
# On autorise les retours de connexions légitimes par INPUT
 194 
# On autorise les retours de connexions légitimes par INPUT
182 
# Conntrack on INPUT
 195 
# Conntrack on INPUT
183 
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 196 
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
184 
 
 197 
 
185 
# On interdit les connexions directes au port utilisé par DansGuardian (8080)
 198 
# On interdit les connexions directes au port utilisé par DansGuardian (8080)