| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar-iptables.sh 1159 2013-07-17 09:25:15Z crox53 $
|
2 |
# $Id: alcasar-iptables.sh 1161 2013-07-17 20:16:26Z richard $
|
| 3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
| 4 |
# This script write the netfilter rules for ALCASAR
|
4 |
# This script write the netfilter rules for ALCASAR
|
| 5 |
# Rexy - 3abtux - CPN
|
5 |
# Rexy - 3abtux - CPN
|
| 6 |
#
|
6 |
#
|
| 7 |
# Reminders
|
7 |
# Reminders
|
| Line 181... |
Line 181... |
| 181 |
if [ $SSH = on ]
|
181 |
if [ $SSH = on ]
|
| 182 |
then
|
182 |
then
|
| 183 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
|
183 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
|
| 184 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
|
184 |
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
|
| 185 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
|
185 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
|
| 186 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
|
186 |
$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW -j ACCEPT
|
| 187 |
fi
|
187 |
fi
|
| 188 |
|
188 |
|
| 189 |
# Insertion de règles locales
|
189 |
# Insertion de règles locales
|
| 190 |
# Here, we add local rules (i.e. VPN from Internet)
|
190 |
# Here, we add local rules (i.e. VPN from Internet)
|
| 191 |
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
|
191 |
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
|
| Line 234... |
Line 234... |
| 234 |
done < /usr/local/etc/alcasar-ip-blocked
|
234 |
done < /usr/local/etc/alcasar-ip-blocked
|
| 235 |
fi
|
235 |
fi
|
| 236 |
|
236 |
|
| 237 |
# Si le filtrage de domain est activé, blocage des IP de la BL
|
237 |
# Si le filtrage de domain est activé, blocage des IP de la BL
|
| 238 |
# If DNS filter is on, reject IP of BL
|
238 |
# If DNS filter is on, reject IP of BL
|
| 239 |
# Comment : loading time is too long and iptables should become oveloaded !!!
|
239 |
# Comment : loading time is too long and iptables should become oveloaded !!! should use "ipset" instead
|
| 240 |
#if [ $DNS_FILTERING = on ]; then
|
240 |
#if [ $DNS_FILTERING = on ]; then
|
| 241 |
# cd $BL_IP_CAT
|
241 |
# cd $BL_IP_CAT
|
| 242 |
# for category in `ls -1 | cut -d"@" -f1`
|
242 |
# for category in `ls -1 | cut -d"@" -f1`
|
| 243 |
# do
|
243 |
# do
|
| 244 |
# while read ip_blocked
|
244 |
# while read ip_blocked
|
| Line 323... |
Line 323... |
| 323 |
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
|
323 |
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
|
| 324 |
|
324 |
|
| 325 |
#############################
|
325 |
#############################
|
| 326 |
# OUTPUT #
|
326 |
# OUTPUT #
|
| 327 |
#############################
|
327 |
#############################
|
| 328 |
# SSHD rules if activate
|
- |
|
| 329 |
if [ $SSH = on ]
|
- |
|
| 330 |
then
|
- |
|
| 331 |
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT
|
- |
|
| 332 |
fi
|
- |
|
| 333 |
# On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur
|
328 |
# On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur
|
| 334 |
# Everything is allowed but traffic through outside network interface
|
329 |
# Everything is allowed but traffic through outside network interface
|
| 335 |
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
|
330 |
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
|
| 336 |
|
331 |
|
| 337 |
# On autorise les requêtes DNS vers les serveurs DNS identifiés
|
332 |
# On autorise les requêtes DNS vers les serveurs DNS identifiés
|