Subversion Repositories ALCASAR

Rev

Rev 872 | Rev 990 | Go to most recent revision | Only display areas with differences | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 872 Rev 958
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-iptables.sh 872 2012-05-11 15:19:57Z richard $
 2 
# $Id: alcasar-iptables.sh 958 2012-07-19 09:01:30Z franck $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# This script write the netfilter rules for ALCASAR
 4 
# This script write the netfilter rules for ALCASAR
5 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
6 
#
 6 
#
7 
# Reminders
 7 
# Reminders
8 
# There are three channels for log :
 8 
# There are three channels for log :
9 
#	1 (default) for tracability;
 9 
#	1 (default) for tracability;
10 
#	2 for secure admin (ssh);
 10 
#	2 for secure admin (ssh);
11 
#	3 for exterior access attempts.
 11 
#	3 for exterior access attempts.
12 
# The French Security Agency (ANSSI) rules was applied by 'this script
 12 
# The French Security Agency (ANSSI) rules was applied by 'this script
13 
# The bootps/dhcp (67) port is always open on tun0/eth1 by coova
13 
# The bootps/dhcp (67) port is always open on tun0/eth1 by coova
14 
conf_file="/usr/local/etc/alcasar.conf"
 14 
conf_file="/usr/local/etc/alcasar.conf"
15 
private_ip_mask=`grep PRIVATE_IP= $conf_file|cut -d"=" -f2`
 15 
private_ip_mask=`grep PRIVATE_IP= $conf_file|cut -d"=" -f2`
16 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
 16 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
17 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
 17 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
18 
private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`		# LAN IP address (ie.: 192.168.182.0)
 18 
private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`		# LAN IP address (ie.: 192.168.182.0)
19 
private_prefix=`/bin/ipcalc -p $private_ip_mask|cut -d"=" -f2`		# LAN prefix (ie. 24)
 19 
private_prefix=`/bin/ipcalc -p $private_ip_mask|cut -d"=" -f2`		# LAN prefix (ie. 24)
20 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
 20 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
21 
public_ip_mask=`grep PUBLIC_IP= $conf_file|cut -d"=" -f2`		# ALCASAR WAN IP address
 21 
public_ip_mask=`grep PUBLIC_IP= $conf_file|cut -d"=" -f2`		# ALCASAR WAN IP address
22 
PUBLIC_IP=`echo $public_ip_mask | cut -d"/" -f1`
 22 
PUBLIC_IP=`echo $public_ip_mask | cut -d"/" -f1`
23 
dns1=`grep DNS1= $conf_file|cut -d"=" -f2`				# first public DNS server
 23 
dns1=`grep DNS1= $conf_file|cut -d"=" -f2`				# first public DNS server
24 
dns1=${dns1:=208.67.220.220}
 24 
dns1=${dns1:=208.67.220.220}
25 
dns2=`grep DNS2= $conf_file|cut -d"=" -f2`				# second public DNS server
 25 
dns2=`grep DNS2= $conf_file|cut -d"=" -f2`				# second public DNS server
26 
dns2=${dns2:=208.67.222.222}
 26 
dns2=${dns2:=208.67.222.222}
27 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
 27 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
28 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
 28 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
29 
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
 29 
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
30 
DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
 30 
DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
31 
DNS_FILTERING=${DNS_FILTERING:=off}
 31 
DNS_FILTERING=${DNS_FILTERING:=off}
32 
QOS=`grep QOS= $conf_file|cut -d"=" -f2`				# QOS (on/off)
 32 
QOS=`grep QOS= $conf_file|cut -d"=" -f2`				# QOS (on/off)
33 
QOS=${QOS:=off}
 33 
QOS=${QOS:=off}
34 
SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
 34 
SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
35 
SSH=${SSH:=off}
 35 
SSH=${SSH:=off}
36 
Admin_from_IP=${Admin_from_IP:="0.0.0.0/0.0.0.0"}			# WAN IP address to reduce ssh access (all ip allowed on LAN side)
 36 
Admin_from_IP=${Admin_from_IP:="0.0.0.0/0.0.0.0"}			# WAN IP address to reduce ssh access (all ip allowed on LAN side)
37 
LDAP=`grep LDAP= $conf_file|cut -d"=" -f2`				# LDAP external server active (on/off)
 37 
LDAP=`grep LDAP= $conf_file|cut -d"=" -f2`				# LDAP external server active (on/off)
38 
LDAP=${LDAP:=off}
 38 
LDAP=${LDAP:=off}
39 
LDAP_IP=`grep LDAP_IP= $conf_file|cut -d"=" -f2`			# WAN IP address to reduce LDAP WAN access (all ip allowed on LAN side)
 39 
LDAP_IP=`grep LDAP_IP= $conf_file|cut -d"=" -f2`			# WAN IP address to reduce LDAP WAN access (all ip allowed on LAN side)
40 
LDAP_IP=${LDAP_IP:="0.0.0.0/0.0.0.0"}
 40 
LDAP_IP=${LDAP_IP:="0.0.0.0/0.0.0.0"}
41 
EXTIF="eth0"
 41 
EXTIF="eth0"
42 
INTIF="eth1"
 42 
INTIF="eth1"
43 
TUNIF="tun0"								# listen device for chilli daemon
 43 
TUNIF="tun0"								# listen device for chilli daemon
44 
IPTABLES="/sbin/iptables"
 44 
IPTABLES="/sbin/iptables"
45 
 
 45 
 
46 
# Effacement des règles existantes
 46 
# Effacement des règles existantes
47 
# Flush all existing rules
 47 
# Flush all existing rules
48 
$IPTABLES -F
 48 
$IPTABLES -F
49 
$IPTABLES -t nat -F
 49 
$IPTABLES -t nat -F
50 
$IPTABLES -t mangle -F
 50 
$IPTABLES -t mangle -F
51 
$IPTABLES -F INPUT
 51 
$IPTABLES -F INPUT
52 
$IPTABLES -F FORWARD
 52 
$IPTABLES -F FORWARD
53 
$IPTABLES -F OUTPUT
 53 
$IPTABLES -F OUTPUT
54 
 
 54 
 
55 
# Suppression des chaines utilisateurs sur les tables filter et nat
 55 
# Suppression des chaines utilisateurs sur les tables filter et nat
56 
# Flush non default rules on filter and nat tables
 56 
# Flush non default rules on filter and nat tables
57 
$IPTABLES -X
 57 
$IPTABLES -X
58 
$IPTABLES -t nat -X
 58 
$IPTABLES -t nat -X
59 
 
 59 
 
60 
# Stratégies par défaut
 60 
# Stratégies par défaut
61 
# Default policies
 61 
# Default policies
62 
$IPTABLES -P INPUT DROP
 62 
$IPTABLES -P INPUT DROP
63 
$IPTABLES -P FORWARD DROP
 63 
$IPTABLES -P FORWARD DROP
64 
$IPTABLES -P OUTPUT DROP
 64 
$IPTABLES -P OUTPUT DROP
65 
$IPTABLES -t nat -P PREROUTING ACCEPT
 65 
$IPTABLES -t nat -P PREROUTING ACCEPT
66 
$IPTABLES -t nat -P POSTROUTING ACCEPT
 66 
$IPTABLES -t nat -P POSTROUTING ACCEPT
67 
$IPTABLES -t nat -P OUTPUT ACCEPT
 67 
$IPTABLES -t nat -P OUTPUT ACCEPT
68 
 
 68 
 
69 
#############################
 69 
#############################
70 
#       PREROUTING          #
 70 
#       PREROUTING          #
71 
#############################
 71 
#############################
72 
# Marquage (et journalisation) des paquets qui tentent d'accéder directement à DansGuardian pour pouvoir les rejeter en INPUT
 72 
# Marquage (et journalisation) des paquets qui tentent d'accéder directement à DansGuardian pour pouvoir les rejeter en INPUT
73 
# mark (and log) the dansguardian bypass attempts in order to DROP them in INPUT rules
 73 
# mark (and log) the dansguardian bypass attempts in order to DROP them in INPUT rules
74 
# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j ULOG --ulog-prefix "RULE direct-proxy -- DENY "
 74 
# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j ULOG --ulog-prefix "RULE direct-proxy -- DENY "
75 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
 75 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
76 
 
 76 
 
77 
# Marquage (et journalisation) des paquets qui tentent d'accéder directement au port udp 54 pour pouvoir les rejeter en INPUT
 77 
# Marquage (et journalisation) des paquets qui tentent d'accéder directement au port udp 54 pour pouvoir les rejeter en INPUT
78 
# Mark (and log) the udp 54 direct attempts to REJECT them in INPUT rules
 78 
# Mark (and log) the udp 54 direct attempts to REJECT them in INPUT rules
79 
# Remarque : Ce port n'est ouvert que lorsque le filtrage est activé
 79 
# Remarque : Ce port n'est ouvert que lorsque le filtrage est activé
80 
# Remark : this port is only open when filtering is on
 80 
# Remark : this port is only open when filtering is on
81 
# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -d $PRIVATE_IP -m udp --dport 54 -j ULOG --ulog-prefix "RULE DNS-proxy -- DENY "
 81 
# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -d $PRIVATE_IP -m udp --dport 54 -j ULOG --ulog-prefix "RULE DNS-proxy -- DENY "
82 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 2
 82 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 2
83 
 
 83 
 
84 
# Si le filtrage est activé, redirection des flux DNS vers le port 54 (dns+blackhole) sauf pour les IP en exceptions
84 
# Si le filtrage est activé, redirection des flux DNS vers le port 54 (dns+blackhole) sauf pour les IP en exceptions
85 
# If DNS filter is on, redirect DNS request to udp 54 (dns+blackhole) except for exception IP addresses
 85 
# If DNS filter is on, redirect DNS request to udp 54 (dns+blackhole) except for exception IP addresses
86 
if [ $DNS_FILTERING = on ]; then
 86 
if [ $DNS_FILTERING = on ]; then
87 
	# Compute exception IP
 87 
	# Compute exception IP
88 
	nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
 88 
	nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
89 
	if [ $nb_exceptions != "0" ]
 89 
	if [ $nb_exceptions != "0" ]
90 
	then
 90 
	then
91 
		while read ip_exception
91 
		while read ip_exception
92 
		do
 92 
		do
93 
			$IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -s $ip_exception -d $PRIVATE_IP --dport domain -j ACCEPT
 93 
			$IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -s $ip_exception -d $PRIVATE_IP --dport domain -j ACCEPT
94 
		done < /usr/local/etc/alcasar-filter-exceptions
 94 
		done < /usr/local/etc/alcasar-filter-exceptions
95 
	fi
 95 
	fi
96 
		$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 54
 96 
		$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 54
97 
fi
 97 
fi
98 
 
 98 
 
99 
# Journalisation des requètes HTTP vers Internet (seulement les paquets SYN) - Les autres protocoles sont journalisés en FORWARD
 99 
# Journalisation des requètes HTTP vers Internet (seulement les paquets SYN) - Les autres protocoles sont journalisés en FORWARD
100 
# Log HTTP requests to Internet (only syn packets) - Other protocols are log in FORWARD
 100 
# Log HTTP requests to Internet (only syn packets) - Other protocols are log in FORWARD
101 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -m state --state NEW -j ULOG --ulog-prefix "RULE F_http -- ACCEPT "
 101 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -m state --state NEW -j ULOG --ulog-prefix "RULE F_http -- ACCEPT "
102 
# Redirection des requêtes HTTP vers DansGuardian (proxy transparent)
 102 
# Redirection des requêtes HTTP vers DansGuardian (proxy transparent)
103 
# Redirect HTTP requests in DansGuardian (transparent proxy)
 103 
# Redirect HTTP requests in DansGuardian (transparent proxy)
104 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8080
 104 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8080
105 
 
 105 
 
106 
# Redirection des requêtes NTP vers le serveur NTP local
 106 
# Redirection des requêtes NTP vers le serveur NTP local
107 
# Redirect NTP request in local NTP server
 107 
# Redirect NTP request in local NTP server
108 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p udp --dport ntp -j REDIRECT --to-port 123
 108 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p udp --dport ntp -j REDIRECT --to-port 123
109 
 
 109 
 
110 
#############################
 110 
#############################
111 
#         INPUT             #
 111 
#         INPUT             #
112 
#############################
 112 
#############################
113 
 
 113 
 
114 
# Tout passe sur loopback
 114 
# Tout passe sur loopback
115 
# accept all on loopback
 115 
# accept all on loopback
116 
$IPTABLES -A INPUT -i lo -j ACCEPT
 116 
$IPTABLES -A INPUT -i lo -j ACCEPT
117 
 
 117 
 
118 
# Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 118 
# Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
119 
# Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 119 
# Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
120 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
 120 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
121 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 121 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
122 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 122 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
123 
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 123 
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
124 
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
 124 
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
125 
 
 125 
 
126 
# On rejette les trame en broadcast et en multicast sur EXTIF (évite leur journalisation)
 126 
# On rejette les trame en broadcast et en multicast sur EXTIF (évite leur journalisation)
127 
# Drop broadcast & multicast on EXTIF to avoid log
127 
# Drop broadcast & multicast on EXTIF to avoid log
128 
$IPTABLES -A INPUT -i $EXTIF -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
 128 
$IPTABLES -A INPUT -i $EXTIF -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
129 
 
 129 
 
130 
# On autorise les retours de connexions légitimes par INPUT
 130 
# On autorise les retours de connexions légitimes par INPUT
131 
# Conntrack on INPUT
 131 
# Conntrack on INPUT
132 
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 132 
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
133 
 
 133 
 
134 
# On interdit les connexions directes au port utilisé par DansGuardian (8080). Les packets concernés ont été marqués dans la table mangle (PREROUTING)
 134 
# On interdit les connexions directes au port utilisé par DansGuardian (8080). Les packets concernés ont été marqués dans la table mangle (PREROUTING)
135 
# Deny direct connections on DansGuardian port (8080). The concerned paquets are marked in mangle table (PREROUTING)
 135 
# Deny direct connections on DansGuardian port (8080). The concerned paquets are marked in mangle table (PREROUTING)
136 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset
 136 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset
137 
 
 137 
 
138 
# Insertion des règles de blocage IP
 138 
# Insertion des règles de blocage IP
139 
# Here, we add IP block rules
139 
# Here, we add IP block rules
140 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
140 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
141 
	while read ip_line
 141 
	while read ip_line
142 
	do
 142 
	do
143 
		ip_on=`echo $ip_line|cut -b1`
 143 
		ip_on=`echo $ip_line|cut -b1`
144 
		if [ $ip_on != "#" ]
 144 
		if [ $ip_on != "#" ]
145 
		then
145 
		then
146 
			ip_blocked=`echo $ip_line|cut -d" " -f1`
 146 
			ip_blocked=`echo $ip_line|cut -d" " -f1`
147 
			$IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
 147 
			$IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
148 
			$IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j REJECT
148 
			$IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j REJECT
149 
		fi
 149 
		fi
150 
	done < /usr/local/etc/alcasar-ip-blocked
 150 
	done < /usr/local/etc/alcasar-ip-blocked
151 
fi
 151 
fi
152 
# Autorisation des connexions légitimes à DansGuardian
152 
# Autorisation des connexions légitimes à DansGuardian
153 
# Allow connections for DansGuardian
 153 
# Allow connections for DansGuardian
154 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
 154 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
155 
 
 155 
 
156 
# On interdit les connexions directes au port UDP 54. Les packets concernés ont été marqués dans la table mangle (PREROUTING)
 156 
# On interdit les connexions directes au port UDP 54. Les packets concernés ont été marqués dans la table mangle (PREROUTING)
157 
# Deny direct connections on UDP 54. The concerned paquets are marked in mangle table (PREROUTING)
 157 
# Deny direct connections on UDP 54. The concerned paquets are marked in mangle table (PREROUTING)
158 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 54 -m mark --mark 2 -j REJECT --reject-with icmp-port-unreachable
 158 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 54 -m mark --mark 2 -j REJECT --reject-with icmp-port-unreachable
159 
 
 159 
 
160 
# autorisation des connexion légitime à DNSMASQ (avec blackhole)
 160 
# autorisation des connexion légitime à DNSMASQ (avec blackhole)
161 
# Allow connections for DNSMASQ (with blackhole)
 161 
# Allow connections for DNSMASQ (with blackhole)
162 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT
 162 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT
163 
 
 163 
 
164 
# Accès direct aux services internes
 164 
# Accès direct aux services internes
165 
# Internal services access
 165 
# Internal services access
166 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j ACCEPT	# DNS non filtré # DNS without blackhole
 166 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j ACCEPT	# DNS non filtré # DNS without blackhole
167 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 8 -j ACCEPT	# Réponse ping # ping responce
 167 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 8 -j ACCEPT	# Réponse ping # ping responce
168 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 0 -j ACCEPT	# Requête  ping # ping request
 168 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 0 -j ACCEPT	# Requête  ping # ping request
169 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport https -j ACCEPT	# Pages d'authentification et MCC # authentication pages and MCC
 169 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport https -j ACCEPT	# Pages d'authentification et MCC # authentication pages and MCC
170 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport http -j ACCEPT	# Page d'avertissement filtrage # Filtering warning pages
 170 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport http -j ACCEPT	# Page d'avertissement filtrage # Filtering warning pages
171 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 3990 -j ACCEPT	# Requêtes de deconnexion usagers # Users logout requests
 171 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 3990 -j ACCEPT	# Requêtes de deconnexion usagers # Users logout requests
172 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT	# Serveur local de temps # local time server
 172 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT	# Serveur local de temps # local time server
173 
 
 173 
 
174 
# SSHD rules if activate
174 
# SSHD rules if activate
175 
if [ $SSH = on ]
 175 
if [ $SSH = on ]
176 
	then
 176 
	then
177 
	$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
 177 
	$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
178 
	$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
 178 
	$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
179 
	$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
 179 
	$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
180 
	$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
 180 
	$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
181 
fi
 181 
fi
182 
 
 182 
 
183 
# Insertion de règles locales
 183 
# Insertion de règles locales
184 
# Here, we add local rules (i.e. VPN from Internet)
 184 
# Here, we add local rules (i.e. VPN from Internet)
185 
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
 185 
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
186 
        . /usr/local/etc/alcasar-iptables-local.sh
 186 
        . /usr/local/etc/alcasar-iptables-local.sh
187 
fi
 187 
fi
188 
 
 188 
 
189 
# Journalisation et rejet des connexions (autres que celles autorisées) effectuées depuis le LAN
 189 
# Journalisation et rejet des connexions (autres que celles autorisées) effectuées depuis le LAN
190 
# Deny and log on INPUT from the LAN
 190 
# Deny and log on INPUT from the LAN
191 
$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
 191 
$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
192 
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
 192 
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
193 
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
 193 
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
194 
 
 194 
 
195 
# interdiction d'accès à INTIF (n'est utile que lorsque chilli est arrêté).
 195 
# interdiction d'accès à INTIF (n'est utile que lorsque chilli est arrêté).
196 
# Reject INTIF access (only when chilli is down)
 196 
# Reject INTIF access (only when chilli is down)
197 
$IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE Protect1 -- REJECT "
 197 
$IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE Protect1 -- REJECT "
198 
$IPTABLES -A INPUT -i $INTIF -j REJECT
 198 
$IPTABLES -A INPUT -i $INTIF -j REJECT
199 
 
 199 
 
200 
# Journalisation et rejet des connexions initiées depuis le réseau extérieur (test des effets du paramètre --limit en cours)
 200 
# Journalisation et rejet des connexions initiées depuis le réseau extérieur (test des effets du paramètre --limit en cours)
201 
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
 201 
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
202 
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
 202 
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
203 
 
 203 
 
204 
 
 204 
 
205 
#############################
 205 
#############################
206 
#        FORWARD            #
 206 
#        FORWARD            #
207 
#############################
 207 
#############################
208 
 
 208 
 
209 
# Rejet des requêtes DNS vers Internet
 209 
# Rejet des requêtes DNS vers Internet
210 
# Deny forward DNS
 210 
# Deny forward DNS
211 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
 211 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
212 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
 212 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
213 
 
 213 
 
214 
# Insertion des règles de blocage IP
 214 
# Insertion des règles de blocage IP
215 
# Here, we add IP block rules
215 
# Here, we add IP block rules
216 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
216 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
217 
	while read ip_line
 217 
	while read ip_line
218 
	do
 218 
	do
219 
		ip_on=`echo $ip_line|cut -b1`
 219 
		ip_on=`echo $ip_line|cut -b1`
220 
		if [ $ip_on != "#" ]
 220 
		if [ $ip_on != "#" ]
221 
		then
221 
		then
222 
			ip_blocked=`echo $ip_line|cut -d" " -f1`
 222 
			ip_blocked=`echo $ip_line|cut -d" " -f1`
223 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
 223 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
224 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p udp -j REJECT --reject-with icmp-port-unreachable
 224 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p udp -j REJECT --reject-with icmp-port-unreachable
225 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p icmp -j REJECT --reject-with icmp-port-unreachable
 225 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p icmp -j REJECT --reject-with icmp-port-unreachable
226 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
 226 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
227 
		fi
 227 
		fi
228 
	done < /usr/local/etc/alcasar-ip-blocked
 228 
	done < /usr/local/etc/alcasar-ip-blocked
229 
fi
 229 
fi
230 
 
 230 
 
231 
# Autorisation des retours de connexions légitimes
 231 
# Autorisation des retours de connexions légitimes
232 
# Allow conntrack
 232 
# Allow conntrack
233 
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 233 
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
234 
 
 234 
 
235 
#  If protocols filter is activate
235 
#  If protocols filter is activate
236 
if [ $PROTOCOLS_FILTERING = on ]; then
 236 
if [ $PROTOCOLS_FILTERING = on ]; then
237 
	# Compute exception IP (IP addresses that shouldn't be filtered)
 237 
	# Compute exception IP (IP addresses that shouldn't be filtered)
238 
	nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
 238 
	nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
239 
	if [ $nb_exceptions != "0" ]
 239 
	if [ $nb_exceptions != "0" ]
240 
	then
 240 
	then
241 
		while read ip_exception
241 
		while read ip_exception
242 
		do
 242 
		do
243 
			$IPTABLES -A FORWARD -i $TUNIF -s $ip_exception -m state --state NEW -j ULOG --ulog-prefix "RULE IP-exception -- ACCEPT "
 243 
			$IPTABLES -A FORWARD -i $TUNIF -s $ip_exception -m state --state NEW -j ULOG --ulog-prefix "RULE IP-exception -- ACCEPT "
244 
			$IPTABLES -A FORWARD -i $TUNIF -s $ip_exception -m state --state NEW -j ACCEPT
 244 
			$IPTABLES -A FORWARD -i $TUNIF -s $ip_exception -m state --state NEW -j ACCEPT
245 
		done < /usr/local/etc/alcasar-filter-exceptions
 245 
		done < /usr/local/etc/alcasar-filter-exceptions
246 
	fi
 246 
	fi
247 
	# Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...)
247 
	# Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...)
248 
	nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" "  -f1`
 248 
	nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" "  -f1`
249 
	if [ $nb_uamallowed != "0" ]
 249 
	if [ $nb_uamallowed != "0" ]
250 
	then
 250 
	then
251 
		while read ip_allowed_line
251 
		while read ip_allowed_line
252 
		do
 252 
		do
253 
			ip_allowed=`echo $ip_allowed_line|cut -d"\"" -f2`
 253 
			ip_allowed=`echo $ip_allowed_line|cut -d"\"" -f2`
254 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ULOG --ulog-prefix "RULE IP-allowed -- ACCEPT "
 254 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ULOG --ulog-prefix "RULE IP-allowed -- ACCEPT "
255 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ACCEPT
 255 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ACCEPT
256 
		done < /usr/local/etc/alcasar-uamallowed
 256 
		done < /usr/local/etc/alcasar-uamallowed
257 
	fi
 257 
	fi
258 
	# Autorisation des protocoles non commentés
 258 
	# Autorisation des protocoles non commentés
259 
	# Allow non comment protocols
 259 
	# Allow non comment protocols
260 
	while read svc_line
 260 
	while read svc_line
261 
	do
 261 
	do
262 
		svc_on=`echo $svc_line|cut -b1`
 262 
		svc_on=`echo $svc_line|cut -b1`
263 
		if [ $svc_on != "#" ]
 263 
		if [ $svc_on != "#" ]
264 
		then
264 
		then
265 
			svc_name=`echo $svc_line|cut -d" " -f1`
 265 
			svc_name=`echo $svc_line|cut -d" " -f1`
266 
			svc_port=`echo $svc_line|cut -d" " -f2`
 266 
			svc_port=`echo $svc_line|cut -d" " -f2`
267 
			if [ $svc_name = "icmp" ]
 267 
			if [ $svc_name = "icmp" ]
268 
			then
 268 
			then
269 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp -j ACCEPT
269 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp -j ACCEPT
270 
			else
 270 
			else
271 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
 271 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
272 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
 272 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
273 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
 273 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
274 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ACCEPT
 274 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ACCEPT
275 
			fi
 275 
			fi
276 
		fi
 276 
		fi
277 
	done < /usr/local/etc/alcasar-services
 277 
	done < /usr/local/etc/alcasar-services
278 
	# Rejet explicite des autres protocoles
 278 
	# Rejet explicite des autres protocoles
279 
	# reject the others protocols
 279 
	# reject the others protocols
280 
	$IPTABLES -A FORWARD -i $TUNIF -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
 280 
	$IPTABLES -A FORWARD -i $TUNIF -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
281 
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
 281 
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
282 
	$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
 282 
	$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
283 
	$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT
283 
	$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT
284 
fi
 284 
fi
285 
 
 285 
 
286 
#  If QOS is activate  #
 286 
#  If QOS is activate  #
287 
if [ $QOS = on ] && [ -e /usr/local/etc/alcasar-iptables-qos.sh ]; then
 287 
if [ $QOS = on ] && [ -e /usr/local/etc/alcasar-iptables-qos.sh ]; then
288 
	. /usr/local/etc/alcasar-iptables-qos.sh
288 
	. /usr/local/etc/alcasar-iptables-qos.sh
289 
fi
 289 
fi
290 
 
 290 
 
291 
# Autorisation des connections sortant du LAN
291 
# Autorisation des connections sortant du LAN
292 
# Allow forward connections with log
 292 
# Allow forward connections with log
293 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
 293 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
294 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
 294 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
295 
 
 295 
 
296 
#############################
 296 
#############################
297 
#         OUTPUT            #
 297 
#         OUTPUT            #
298 
#############################
 298 
#############################
299 
# SSHD rules if activate
299 
# SSHD rules if activate
300 
if [ $SSH = on ]
 300 
if [ $SSH = on ]
301 
	then
 301 
	then
302 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT
 302 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT
303 
fi
 303 
fi
304 
# On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur
 304 
# On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur
305 
# Everything is allowed but traffic through outside network interface
 305 
# Everything is allowed but traffic through outside network interface
306 
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
 306 
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
307 
 
 307 
 
308 
# On autorise les requêtes DNS vers les serveurs DNS identifiés
308 
# On autorise les requêtes DNS vers les serveurs DNS identifiés
309 
# Allow DNS requests to identified DNS servers
 309 
# Allow DNS requests to identified DNS servers
310 
$IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m state --state NEW -j ACCEPT
 310 
$IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m state --state NEW -j ACCEPT
311 
 
 311 
 
312 
# On autorise les requêtes HTTP sortantes
 312 
# On autorise les requêtes HTTP sortantes
313 
# HTTP requests are allowed
 313 
# HTTP requests are allowed
314 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j ACCEPT
 314 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j ACCEPT
315 
 
 315 
 
316 
# On autorise les requêtes FTP
316 
# On autorise les requêtes FTP
317 
# FTP requests are allowed
 317 
# FTP requests are allowed
318 
modprobe ip_conntrack_ftp
 318 
modprobe ip_conntrack_ftp
319 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport ftp -j ACCEPT
 319 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport ftp -j ACCEPT
320 
$IPTABLES -A OUTPUT -o $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
 320 
$IPTABLES -A OUTPUT -o $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
321 
 
 321 
 
322 
# On autorise les requêtes NTP
322 
# On autorise les requêtes NTP
323 
# NTP requests are allowed
 323 
# NTP requests are allowed
324 
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT
 324 
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT
325 
 
 325 
 
326 
# On autorise les requêtes ICMP (ping)
326 
# On autorise les requêtes ICMP (ping)
327 
# ICMP (ping) requests are allowed
 327 
# ICMP (ping) requests are allowed
328 
$IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT
 328 
$IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT
329 
 
 329 
 
330 
# On autorise les requêtes LDAP si un serveur externe est configué
 330 
# On autorise les requêtes LDAP si un serveur externe est configué
331 
# LDAP requests are allowed if an external server is declared
 331 
# LDAP requests are allowed if an external server is declared
332 
if [ $LDAP = on ]
 332 
if [ $LDAP = on ]
333 
	then
 333 
	then
334 
	$IPTABLES -A OUTPUT -p tcp -d $LDAP_IP -m multiport --dports ldap,ldaps -m state --state NEW,ESTABLISHED -j ACCEPT
 334 
	$IPTABLES -A OUTPUT -p tcp -d $LDAP_IP -m multiport --dports ldap,ldaps -m state --state NEW,ESTABLISHED -j ACCEPT
335 
	$IPTABLES -A OUTPUT -p udp -d $LDAP_IP -m multiport --dports ldap,ldaps -m state --state NEW,ESTABLISHED -j ACCEPT
 335 
	$IPTABLES -A OUTPUT -p udp -d $LDAP_IP -m multiport --dports ldap,ldaps -m state --state NEW,ESTABLISHED -j ACCEPT
336 
#	$IPTABLES -A INPUT  -p tcp -s $LDAP_IP -m multiports --sports ldap,ldaps -m state --state ESTABLISHED -j ACCEPT
 336 
#	$IPTABLES -A INPUT  -p tcp -s $LDAP_IP -m multiports --sports ldap,ldaps -m state --state ESTABLISHED -j ACCEPT
337 
#	$IPTABLES -A INPUT  -p udp -s $LDAP_IP -m multiports --sports ldap,ldaps -m state --state ESTABLISHED -j ACCEPT
 337 
#	$IPTABLES -A INPUT  -p udp -s $LDAP_IP -m multiports --sports ldap,ldaps -m state --state ESTABLISHED -j ACCEPT
338 
fi
 338 
fi
339 
 
 339 
 
340 
 
 340 
 
341 
#############################
 341 
#############################
342 
#       POSTROUTING         #
 342 
#       POSTROUTING         #
343 
#############################
 343 
#############################
344 
# Traduction dynamique d'adresse en sortie
 344 
# Traduction dynamique d'adresse en sortie
345 
# Dynamic NAT on EXTIF
 345 
# Dynamic NAT on EXTIF
346 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
 346 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
347 
 
 347 
 
348 
# Save all rules
 348 
# Save all rules
349 
/etc/init.d/iptables save
 349 
/etc/init.d/iptables save
350 
 
 350 
 
351 
# End of script
 351 
# End of script
352 
 
 352 
 
353 
 
 353