| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar-iptables.sh 1062 2013-04-01 21:20:12Z richard $
|
2 |
# $Id: alcasar-iptables.sh 1063 2013-04-01 21:36:46Z richard $
|
| 3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
| 4 |
# This script write the netfilter rules for ALCASAR
|
4 |
# This script write the netfilter rules for ALCASAR
|
| 5 |
# Rexy - 3abtux - CPN
|
5 |
# Rexy - 3abtux - CPN
|
| 6 |
#
|
6 |
#
|
| 7 |
# Reminders
|
7 |
# Reminders
|
| Line 31... |
Line 31... |
| 31 |
DNS_FILTERING=${DNS_FILTERING:=off}
|
31 |
DNS_FILTERING=${DNS_FILTERING:=off}
|
| 32 |
QOS=`grep QOS= $conf_file|cut -d"=" -f2` # QOS (on/off)
|
32 |
QOS=`grep QOS= $conf_file|cut -d"=" -f2` # QOS (on/off)
|
| 33 |
QOS=${QOS:=off}
|
33 |
QOS=${QOS:=off}
|
| 34 |
SSH=`grep SSH= $conf_file|cut -d"=" -f2` # sshd active (on/off)
|
34 |
SSH=`grep SSH= $conf_file|cut -d"=" -f2` # sshd active (on/off)
|
| 35 |
SSH=${SSH:=off}
|
35 |
SSH=${SSH:=off}
|
| 36 |
SSH_ADMIN_IP=`grep SSH_ADMIN_IP= $conf_file|cut -d"=" -f2`
|
36 |
SSH_ADMIN_FROM=`grep SSH_ADMIN_FROM= $conf_file|cut -d"=" -f2`
|
| 37 |
SSH_ADMIN_IP=${SSH_ADMIN_IP:="0.0.0.0/0.0.0.0"} # WAN IP address to reduce ssh access (all ip allowed on LAN side)
|
37 |
SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"} # WAN IP address to reduce ssh access (all ip allowed on LAN side)
|
| 38 |
LDAP=`grep LDAP= $conf_file|cut -d"=" -f2` # LDAP external server active (on/off)
|
38 |
LDAP=`grep LDAP= $conf_file|cut -d"=" -f2` # LDAP external server active (on/off)
|
| 39 |
LDAP=${LDAP:=off}
|
39 |
LDAP=${LDAP:=off}
|
| 40 |
LDAP_IP=`grep LDAP_IP= $conf_file|cut -d"=" -f2` # WAN IP address to reduce LDAP WAN access (all ip allowed on LAN side)
|
40 |
LDAP_IP=`grep LDAP_IP= $conf_file|cut -d"=" -f2` # WAN IP address to reduce LDAP WAN access (all ip allowed on LAN side)
|
| 41 |
LDAP_IP=${LDAP_IP:="0.0.0.0/0.0.0.0"}
|
41 |
LDAP_IP=${LDAP_IP:="0.0.0.0/0.0.0.0"}
|
| 42 |
EXTIF="eth0"
|
42 |
EXTIF="eth0"
|
| Line 176... |
Line 176... |
| 176 |
# SSHD rules if activate
|
176 |
# SSHD rules if activate
|
| 177 |
if [ $SSH = on ]
|
177 |
if [ $SSH = on ]
|
| 178 |
then
|
178 |
then
|
| 179 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
|
179 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
|
| 180 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
|
180 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
|
| 181 |
$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
|
181 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
|
| 182 |
$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
|
182 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
|
| 183 |
fi
|
183 |
fi
|
| 184 |
|
184 |
|
| 185 |
# Insertion de règles locales
|
185 |
# Insertion de règles locales
|
| 186 |
# Here, we add local rules (i.e. VPN from Internet)
|
186 |
# Here, we add local rules (i.e. VPN from Internet)
|
| 187 |
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
|
187 |
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
|