Subversion Repositories ALCASAR

Rev

Rev 1063 | Rev 1147 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1063 Rev 1072
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-iptables.sh 1063 2013-04-01 21:36:46Z richard $
 2 
# $Id: alcasar-iptables.sh 1072 2013-04-14 21:36:57Z richard $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# This script write the netfilter rules for ALCASAR
 4 
# This script write the netfilter rules for ALCASAR
5 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
6 
#
 6 
#
7 
# Reminders
 7 
# Reminders
Line 27... Line 27...
27 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
 27 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
28 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
 28 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
29 
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
 29 
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
30 
DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
 30 
DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
31 
DNS_FILTERING=${DNS_FILTERING:=off}
 31 
DNS_FILTERING=${DNS_FILTERING:=off}
- 
 
 32 
BL_IP_CAT="/usr/local/share/iptables-bl-enabled"			# categories files of the BlackListed IP
32 
QOS=`grep QOS= $conf_file|cut -d"=" -f2`				# QOS (on/off)
 33 
QOS=`grep QOS= $conf_file|cut -d"=" -f2`				# QOS (on/off)
33 
QOS=${QOS:=off}
 34 
QOS=${QOS:=off}
34 
SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
 35 
SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
35 
SSH=${SSH:=off}
 36 
SSH=${SSH:=off}
36 
SSH_ADMIN_FROM=`grep SSH_ADMIN_FROM= $conf_file|cut -d"=" -f2`
 37 
SSH_ADMIN_FROM=`grep SSH_ADMIN_FROM= $conf_file|cut -d"=" -f2`
Line 80... Line 81...
80 
# Remarque : Ce port n'est ouvert que lorsque le filtrage est activé
 81 
# Remarque : Ce port n'est ouvert que lorsque le filtrage est activé
81 
# Remark : this port is only open when filtering is on
 82 
# Remark : this port is only open when filtering is on
82 
# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -d $PRIVATE_IP -m udp --dport 54 -j ULOG --ulog-prefix "RULE DNS-proxy -- DENY "
 83 
# $IPTABLES -A PREROUTING -t nat -i $TUNIF -p udp -d $PRIVATE_IP -m udp --dport 54 -j ULOG --ulog-prefix "RULE DNS-proxy -- DENY "
83 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 2
 84 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 2
84 
 
 85 
 
85 
# Si le filtrage est activé, redirection des flux DNS vers le port 54 (dns+blackhole) sauf pour les IP en exceptions
86 
# Si le filtrage DNS est activé, redirection des flux DNS vers le port 54 (dns+blackhole) sauf pour les IP en exceptions
86 
# If DNS filter is on, redirect DNS request to udp 54 (dns+blackhole) except for exception IP addresses
 87 
# If DNS filter is on, redirect DNS request to udp 54 (dns+blackhole) except for exception IP addresses
87 
if [ $DNS_FILTERING = on ]; then
 88 
if [ $DNS_FILTERING = on ]; then
88 
	# Compute exception IP
 89 
	# Compute exception IP
89 
	nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
 90 
	nb_exceptions=`wc -l /usr/local/etc/alcasar-filter-exceptions | cut -d" " -f1`
90 
	if [ $nb_exceptions != "0" ]
 91 
	if [ $nb_exceptions != "0" ]
Line 212... Line 213...
212 
# Deny forward DNS
 213 
# Deny forward DNS
213 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
 214 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
214 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
 215 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
215 
 
 216 
 
216 
# Insertion des règles de blocage IP
 217 
# Insertion des règles de blocage IP
217 
# Here, we add IP block rules
218 
# Here, we add local IP block rules
218 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
219 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
219 
	while read ip_line
 220 
	while read ip_line
220 
	do
 221 
	do
221 
		ip_on=`echo $ip_line|cut -b1`
 222 
		ip_on=`echo $ip_line|cut -b1`
222 
		if [ $ip_on != "#" ]
 223 
		if [ $ip_on != "#" ]
Line 228... Line 229...
228 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
 229 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
229 
		fi
 230 
		fi
230 
	done < /usr/local/etc/alcasar-ip-blocked
 231 
	done < /usr/local/etc/alcasar-ip-blocked
231 
fi
 232 
fi
232 
 
 233 
 
- 
 
 234 
# Si le filtrage de domain est activé, blocage des IP de la BL
- 
 
 235 
# If DNS filter is on, reject IP of BL
- 
 
 236 
# Comment : loading time is too long and iptables should become oveloaded !!!
- 
 
 237 
#if [ $DNS_FILTERING = on ]; then
- 
 
 238 
#	cd $BL_IP_CAT
- 
 
 239 
#	for category in `ls -1 | cut -d"@" -f1`
- 
 
 240 
#	do
- 
 
 241 
#		while read ip_blocked
- 
 
 242 
#		do
- 
 
 243 
#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
- 
 
 244 
#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p udp -j REJECT --reject-with icmp-port-unreachable
- 
 
 245 
#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p icmp -j REJECT --reject-with icmp-port-unreachable
- 
 
 246 
#			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
- 
 
 247 
#		done < $BL_IP_CAT/$category
- 
 
 248 
#	done
- 
 
 249 
#fi
- 
 
 250 
 
233 
# Autorisation des retours de connexions légitimes
 251 
# Autorisation des retours de connexions légitimes
234 
# Allow conntrack
 252 
# Allow conntrack
235 
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 253 
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
236 
 
 254 
 
237 
#  If protocols filter is activate
255 
#  If protocols filter is activate