Subversion Repositories ALCASAR

Rev

Rev 612 | Rev 672 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 612 Rev 615
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
# $Id: alcasar-iptables.sh 612 2011-05-22 21:19:27Z richard $
 2 
# $Id: alcasar-iptables.sh 615 2011-05-24 21:47:25Z richard $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# This script write the netfilter rules for ALCASAR
 4 
# This script write the netfilter rules for ALCASAR
5 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
6 
# There are three channels for log :
 6 
# There are three channels for log :
7 
#	1 (default) for tracability;
 7 
#	1 (default) for tracability;
Line 9... Line 9...
9 
#	3 for exterior access attempts.
 9 
#	3 for exterior access attempts.
10 
# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
 10 
# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
11 
 
 11 
 
12 
conf_file="/usr/local/etc/alcasar.conf"
 12 
conf_file="/usr/local/etc/alcasar.conf"
13 
private_ip_mask=`grep PRIVATE_IP $conf_file|cut -d"=" -f2`
 13 
private_ip_mask=`grep PRIVATE_IP $conf_file|cut -d"=" -f2`
- 
 
 14 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
14 
private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`		# LAN IP address (ie.: 192.168.182.0)
 15 
private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`		# LAN IP address (ie.: 192.168.182.0)
15 
private_prefix=`/bin/ipcalc -p $private_ip_mask|cut -d"=" -f2`		# LAN prefix (ie. 24)
 16 
private_prefix=`/bin/ipcalc -p $private_ip_mask|cut -d"=" -f2`		# LAN prefix (ie. 24)
16 
dns1=`grep DNS1 $conf_file|cut -d"=" -f2`				# first public DNS server
 17 
dns1=`grep DNS1 $conf_file|cut -d"=" -f2`				# first public DNS server
- 
 
 18 
dns1=${dns1:=208.67.220.220}
17 
dns2=`grep DNS2 $conf_file|cut -d"=" -f2`				# second public DNS server
 19 
dns2=`grep DNS2 $conf_file|cut -d"=" -f2`				# second public DNS server
- 
 
 20 
dns2=${dns2:=208.67.222.222}
18 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING $conf_file|cut -d"=" -f2`	# Network protocols filter (yes/no)
 21 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
- 
 
 22 
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
19 
DNS_FILTERING=`grep DNS_FILTERING $conf_file|cut -d"=" -f2`		# DNS and URLs filter (yes/no)
 23 
DNS_FILTERING=`grep DNS_FILTERING $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
- 
 
 24 
DNS_FILTERING=${DNS_FILTERING:=off}
20 
QOS=`grep QOS $conf_file|cut -d"=" -f2`					# QOS (yse/no)
 25 
QOS=`grep QOS $conf_file|cut -d"=" -f2`					# QOS (on/off)
- 
 
 26 
QOS=${QOS:=off}
21 
SSH=`grep SSH $conf_file|cut -d"=" -f2`					# sshd active (yes/no)
 27 
SSH=`grep SSH $conf_file|cut -d"=" -f2`					# sshd active (on/off)
- 
 
 28 
SSH=${SSH:=off}
- 
 
 29 
LDAP=`grep LDAP $conf_file|cut -d"=" -f2`				# ldap external server active (on/off)
- 
 
 30 
LDAP=${LDAP:=off}
22 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
 31 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
23 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
 32 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
24 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
 33 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
25 
EXTIF="eth0"
34 
EXTIF="eth0"
26 
INTIF="eth1"
 35 
INTIF="eth1"
Line 234... Line 243...
234 
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
 243 
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
235 
 
 244 
 
236 
# On autorise les requêtes DNS vers les serveurs DNS identifiés
245 
# On autorise les requêtes DNS vers les serveurs DNS identifiés
237 
# Allow DNS requests to identified DNS servers
 246 
# Allow DNS requests to identified DNS servers
238 
$IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m state --state NEW -j ACCEPT
 247 
$IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m state --state NEW -j ACCEPT
239 
# On autorise les requêtes http sortantes
 248 
# On autorise les requêtes HTTP sortantes
240 
# HTTP requests are allowed
 249 
# HTTP requests are allowed
241 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j ACCEPT
 250 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j ACCEPT
242 
# On autorise les requêtes ntp
251 
# On autorise les requêtes NTP
243 
# NTP requests are allowed
 252 
# NTP requests are allowed
244 
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT
 253 
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT
245 
# On autorise les requêtes ICMP (ping)
254 
# On autorise les requêtes ICMP (ping)
246 
# ICMP (ping) requests are allowed
 255 
# ICMP (ping) requests are allowed
247 
$IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT
 256 
$IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT
- 
 
 257 
# On autorise les requêtes LDAP si un serveur externe est configué
- 
 
 258 
# LDAP requests are allowed if an external server is declared
- 
 
 259 
if [ $LDAP = on ]
- 
 
 260 
	then
- 
 
 261 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport ldap -j ACCEPT
- 
 
 262 
	$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ldap -j ACCEPT
248 
 
 263 
fi
249 
# Traduction dynamique d'adresse en sortie
 264 
# Traduction dynamique d'adresse en sortie
250 
# Dynamic NAT on EXTIF
 265 
# Dynamic NAT on EXTIF
251 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
 266 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
252 
 
 267 
 
253 
# Save all rules
 268 
# Save all rules