Subversion Repositories ALCASAR

Rev

Rev 1962 | Rev 2010 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log

Rev 1962 Rev 2006
Line 1... Line 1...
1
#!/bin/bash
1
#!/bin/bash
2
# $Id: alcasar-iptables.sh 1962 2016-06-24 17:21:40Z richard $
2
# $Id: alcasar-iptables.sh 2006 2016-07-22 13:07:10Z raphael.pion $
3
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
3
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4
# This script writes the netfilter rules for ALCASAR
4
# This script writes the netfilter rules for ALCASAR
5
# Rexy - 3abtux - CPN
5
# Rexy - 3abtux - CPN
6
#
6
#
7
# Reminders
7
# Reminders
Line 31... Line 31...
31
dns1=`grep ^DNS1= $CONF_FILE|cut -d"=" -f2`
31
dns1=`grep ^DNS1= $CONF_FILE|cut -d"=" -f2`
32
dns2=`grep ^DNS2= $CONF_FILE|cut -d"=" -f2`
32
dns2=`grep ^DNS2= $CONF_FILE|cut -d"=" -f2`
33
dns1=${dns1:=208.67.220.220}
33
dns1=${dns1:=208.67.220.220}
34
dns2=${dns2:=208.67.222.222}
34
dns2=${dns2:=208.67.222.222}
35
DNSSERVERS="$dns1,$dns2"						# first and second public DNS servers
35
DNSSERVERS="$dns1,$dns2"						# first and second public DNS servers
36
PROTOCOLS_FILTERING=`grep ^PROTOCOLS_FILTERING= $CONF_FILE|cut -d"=" -f2`	# Network protocols filter (on/off)
-
 
37
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
-
 
38
BL_IP_CAT="/usr/local/share/iptables-bl-enabled"			# categories files of the BlackListed IP
36
BL_IP_CAT="/usr/local/share/iptables-bl-enabled"			# categories files of the BlackListed IP
39
WL_IP_CAT="/usr/local/share/iptables-wl-enabled"			# categories files of the WhiteListed IP
37
WL_IP_CAT="/usr/local/share/iptables-wl-enabled"			# categories files of the WhiteListed IP
40
TMP_users_set_save="/tmp/users_set_save"				# tmp file for backup users set 
38
TMP_users_set_save="/tmp/users_set_save"				# tmp file for backup users set 
41
TMP_set_save="/tmp/ipset_save"						# tmp file for blacklist and whitelist creation
39
TMP_set_save="/tmp/ipset_save"						# tmp file for blacklist and whitelist creation
42
SSH=`grep ^SSH= $CONF_FILE|cut -d"=" -f2`				# sshd active (on/off)
40
SSH=`grep ^SSH= $CONF_FILE|cut -d"=" -f2`				# sshd active (on/off)
Line 60... Line 58...
60
	ipset save havp >> $TMP_users_set_save
58
	ipset save havp >> $TMP_users_set_save
61
	ipset save havp_bl >> $TMP_users_set_save
59
	ipset save havp_bl >> $TMP_users_set_save
62
	ipset save havp_wl >> $TMP_users_set_save
60
	ipset save havp_wl >> $TMP_users_set_save
63
	ipset save not_auth_yet >> $TMP_users_set_save
61
	ipset save not_auth_yet >> $TMP_users_set_save
64
	ipset save users_list >> $TMP_users_set_save
62
	ipset save users_list >> $TMP_users_set_save
-
 
63
	ipset save proto_0 >> $TMP_users_set_save
-
 
64
	ipset save proto_1 >> $TMP_users_set_save
-
 
65
	ipset save proto_2 >> $TMP_users_set_save
-
 
66
	ipset save proto_3 >> $TMP_users_set_save
65
fi
67
fi
66
 
68
 
67
# loading of NetFlow probe (ipt_NETFLOW kernel module)
69
# loading of NetFlow probe (ipt_NETFLOW kernel module)
68
modprobe ipt_NETFLOW destination=127.0.0.1:2055
70
modprobe ipt_NETFLOW destination=127.0.0.1:2055
69
 
71
 
Line 148... Line 150...
148
	ipset add users_list havp
150
	ipset add users_list havp
149
	ipset add users_list havp_wl
151
	ipset add users_list havp_wl
150
	ipset add users_list havp_bl
152
	ipset add users_list havp_bl
151
	ipset add users_list not_filtered
153
	ipset add users_list not_filtered
152
	ipset add users_list not_auth_yet
154
	ipset add users_list not_auth_yet
-
 
155
	#pour les filtrages de protocole par utilisateur
-
 
156
	ipset create proto_0 hash:net hashsize 1024
-
 
157
	ipset create proto_1 hash:net hashsize 1024
-
 
158
	ipset create proto_2 hash:net hashsize 1024
-
 
159
	ipset create proto_3 hash:net hashsize 1024
153
fi
160
fi
154
 
161
 
155
#############################
162
#############################
156
#       PREROUTING          #
163
#       PREROUTING          #
157
#############################
164
#############################
Line 360... Line 367...
360
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
367
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
361
 
368
 
362
# Autorisation des retours de connexions légitimes
369
# Autorisation des retours de connexions légitimes
363
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
370
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
364
 
371
 
365
#  If protocols filter is activate
-
 
366
if [ $PROTOCOLS_FILTERING = on ]; then
-
 
367
	# Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...) 
372
# Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...) 
368
	nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" "  -f1`
373
nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" "  -f1`
369
	if [ $nb_uamallowed != "0" ]
374
if [ $nb_uamallowed != "0" ]
370
	then
375
then
371
		while read ip_allowed_line 
376
	while read ip_allowed_line 
Line 374... Line 379...
374
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NFLOG --nflog-prefix "RULE IP-allowed -- ACCEPT "
379
		$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NFLOG --nflog-prefix "RULE IP-allowed -- ACCEPT "
375
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NETFLOW
380
		$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NETFLOW
376
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ACCEPT
381
		$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ACCEPT
377
		done < /usr/local/etc/alcasar-uamallowed
382
	done < /usr/local/etc/alcasar-uamallowed
378
	fi
383
fi
-
 
384
 
-
 
385
 
-
 
386
 
379
	# Autorisation du HTTP et des protocoles non commentés
387
#filtrage protocole par utilisateur (on autorise le HTTP pour tous)
-
 
388
#profile 1 : HTTP/S only
380
	# Allow HTTP and non comment protocols
389
for proto in $(echo http https)
-
 
390
do
-
 
391
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P1$proto -- ACCEPT "
-
 
392
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NETFLOW
-
 
393
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j ACCEPT
-
 
394
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_UDP-P1$proto -- ACCEPT "
-
 
395
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NETFLOW
-
 
396
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j ACCEPT
-
 
397
done
-
 
398
 
-
 
399
#profile 2 : HTTP/S, POP3S, IMAP/S, FTP, SSH/SFTP
-
 
400
for proto in $(echo http https pop3 pop3s imap imaps ftp sftp ssh)
-
 
401
do
-
 
402
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P2$proto -- ACCEPT "
-
 
403
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NETFLOW
-
 
404
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j ACCEPT
-
 
405
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_UDP-P2$proto -- ACCEPT "
-
 
406
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NETFLOW
-
 
407
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j ACCEPT
-
 
408
done
-
 
409
 
-
 
410
#profile 3 personalisables via l'ACC
381
	$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
411
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P3http -- ACCEPT "
382
	$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j NETFLOW
412
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j NETFLOW
383
	$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j ACCEPT
413
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j ACCEPT
384
	while read svc_line
414
while read svc_line
385
	do
415
do
386
		svc_on=`echo $svc_line|cut -b1`
416
	svc_on=`echo $svc_line|cut -b1`
387
		if [ $svc_on != "#" ]
417
	if [ $svc_on != "#" ]
388
		then	
418
	then	
389
			svc_name=`echo $svc_line|cut -d" " -f1`
419
		svc_name=`echo $svc_line|cut -d" " -f1`
390
			svc_port=`echo $svc_line|cut -d" " -f2`
420
		svc_port=`echo $svc_line|cut -d" " -f2`
391
			if [ $svc_name = "icmp" ]
421
		if [ $svc_name = "icmp" ]
392
			then
422
		then
393
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp -j NETFLOW
423
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p icmp -j NETFLOW
394
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp -j ACCEPT 
424
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p icmp -j ACCEPT 
395
			else
425
		else
396
 
426
 
397
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
427
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P3$svc_name -- ACCEPT "
398
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j NETFLOW
428
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j NETFLOW
399
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
429
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
400
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j NFLOG --nflog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
430
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j NFLOG --nflog-prefix "RULE F_UDP-P3$svc_name -- ACCEPT "
401
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j NETFLOW
431
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j NETFLOW
402
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ACCEPT
432
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ACCEPT
403
			fi
433
		fi
404
		fi
434
	fi
405
	done < /usr/local/etc/alcasar-services
435
done < /usr/local/etc/alcasar-services
-
 
436
 
406
	# Rejet explicite des autres protocoles
437
# Rejet explicite des autres protocoles pour P1, P2, P3 et les autres
407
	# reject the others protocols
438
# reject the others protocols for P1,P2, P3 and other
408
	$IPTABLES -A FORWARD -i $TUNIF -j NFLOG --nflog-prefix "RULE F_filter -- REJECT "
439
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -j NFLOG --nflog-prefix "RULE F_filterP1 -- REJECT "
409
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
440
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -p tcp -j REJECT --reject-with tcp-reset
410
	$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
441
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -p udp -j REJECT --reject-with icmp-port-unreachable
411
	$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT 
442
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -p icmp -j REJECT 
-
 
443
 
412
fi
444
 
413
 
445
 
414
# Autorisation des connections sortant du LAN  
446
# Autorisation des connections sortant du LAN  
415
# Allow forward connections with log
447
# Allow forward connections with log
416
#$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
448
#$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
417
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j NETFLOW
449
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j NETFLOW