| Line 1... |
Line 1... |
| 1 |
#!/bin/bash
|
1 |
#!/bin/bash
|
| 2 |
# $Id: alcasar-iptables.sh 2010 2016-07-26 14:08:50Z raphael.pion $
|
2 |
# $Id: alcasar-iptables.sh 2184 2017-04-26 17:15:13Z richard $
|
| 3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
3 |
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
|
| 4 |
# This script writes the netfilter rules for ALCASAR
|
4 |
# This script writes the netfilter rules for ALCASAR
|
| 5 |
# Rexy - 3abtux - CPN
|
5 |
# Rexy - 3abtux - CPN
|
| 6 |
#
|
6 |
#
|
| 7 |
# Reminders
|
7 |
# Reminders
|
| Line 354... |
Line 354... |
| 354 |
# FORWARD #
|
354 |
# FORWARD #
|
| 355 |
#############################
|
355 |
#############################
|
| 356 |
|
356 |
|
| 357 |
# Blocage des IPs du SET bl_ip_blocked pour le SET havp_bl
|
357 |
# Blocage des IPs du SET bl_ip_blocked pour le SET havp_bl
|
| 358 |
# Deny IPs of the SET bl_ip_blocked for the set havp_bl
|
358 |
# Deny IPs of the SET bl_ip_blocked for the set havp_bl
|
| 359 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p icmp -j REJECT --reject-with icmp-port-unreachable
|
359 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p icmp -j REJECT --reject-with icmp-proto-unreachable
|
| 360 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p udp -j REJECT --reject-with icmp-port-unreachable
|
360 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p udp -j REJECT --reject-with icmp-port-unreachable
|
| 361 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p tcp -j REJECT --reject-with tcp-reset
|
361 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p tcp -j REJECT --reject-with tcp-reset
|
| 362 |
|
362 |
|
| 363 |
# Rejet des requêtes DNS vers Internet
|
363 |
# Rejet des requêtes DNS vers Internet
|
| 364 |
# Deny forward DNS
|
364 |
# Deny forward DNS
|
| 365 |
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
|
365 |
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
|
| 366 |
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
|
366 |
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
|
| 367 |
|
367 |
|
| 368 |
# Autorisation des retours de connexions légitimes
|
368 |
# Active le suivi de session
|
| - |
|
369 |
# Allow Conntrack
|
| 369 |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
370 |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
| 370 |
|
371 |
|
| 371 |
# Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...)
|
372 |
# Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...)
|
| 372 |
nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" " -f1`
|
373 |
nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" " -f1`
|
| 373 |
if [ $nb_uamallowed != "0" ]
|
374 |
if [ $nb_uamallowed != "0" ]
|
| 374 |
then
|
375 |
then
|
| 375 |
while read ip_allowed_line
|
376 |
while read ip_allowed_line
|
| 376 |
do
|
377 |
do
|
| 377 |
ip_allowed=`echo $ip_allowed_line|cut -d"\"" -f2`
|
378 |
ip_allowed=`echo $ip_allowed_line|cut -d"\"" -f2`
|
| 378 |
$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NFLOG --nflog-prefix "RULE IP-allowed -- ACCEPT "
|
- |
|
| 379 |
$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NETFLOW
|
379 |
$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NETFLOW
|
| 380 |
$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ACCEPT
|
380 |
$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j ACCEPT
|
| 381 |
done < /usr/local/etc/alcasar-uamallowed
|
381 |
done < /usr/local/etc/alcasar-uamallowed
|
| 382 |
fi
|
382 |
fi
|
| 383 |
|
383 |
|
| - |
|
384 |
# filtrage protocole par utilisateur (profile 1 : http, https)
|
| - |
|
385 |
# protocols filtering for users (profil 1 : http, https)
|
| - |
|
386 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports http,https -m state --state NEW -j REJECT --reject-with tcp-reset
|
| - |
|
387 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports http,https -m state --state NEW -j REJECT --reject-with icmp-port-unreachable
|
| 384 |
|
388 |
|
| - |
|
389 |
# filtrage protocole par utilisateur (profile 2 : http https pop3 pop3s imap imaps ftp sftp ssh)
|
| - |
|
390 |
# protocols filtering for users (profil 2 : http https pop3 pop3s imap imaps ftp sftp ssh)
|
| 385 |
|
391 |
|
| 386 |
#filtrage protocole par utilisateur (on autorise le HTTP pour tous)
|
- |
|
| 387 |
#profile 1 : HTTP/S only
|
- |
|
| 388 |
for proto in $(echo http https)
|
- |
|
| 389 |
do
|
- |
|
| 390 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P1$proto -- ACCEPT "
|
- |
|
| 391 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NETFLOW
|
- |
|
| 392 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j ACCEPT
|
- |
|
| 393 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_UDP-P1$proto -- ACCEPT "
|
- |
|
| 394 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NETFLOW
|
- |
|
| 395 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j ACCEPT
|
- |
|
| 396 |
done
|
- |
|
| 397 |
|
- |
|
| 398 |
#profile 2 : HTTP/S, POP3S, IMAP/S, FTP, SSH/SFTP
|
- |
|
| 399 |
for proto in $(echo http https pop3 pop3s imap imaps ftp sftp ssh)
|
- |
|
| 400 |
do
|
- |
|
| 401 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P2$proto -- ACCEPT "
|
392 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports http,https,pop3,pop3s,imap,imaps,ftp,ftp-data,sftp,ssh -m state --state NEW -j REJECT --reject-with tcp-reset
|
| 402 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j NETFLOW
|
- |
|
| 403 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $proto -m state --state NEW -j ACCEPT
|
- |
|
| 404 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NFLOG --nflog-prefix "RULE F_UDP-P2$proto -- ACCEPT "
|
393 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports http,https,pop3,pop3s,imap,imaps,ssh -m state --state NEW -j REJECT --reject-with icmp-port-unreachable
|
| 405 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j NETFLOW
|
- |
|
| 406 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp --dport $proto -m state --state NEW -j ACCEPT
|
- |
|
| 407 |
done
|
- |
|
| 408 |
|
394 |
|
| - |
|
395 |
# filtrage protocole par utilisateur (profile 3 : personnalisable via l'ACC)
|
| - |
|
396 |
# protocols filtering for users (profil 3 : customized with ACC)
|
| 409 |
#profile 3 personalisables via l'ACC
|
397 |
#profile 3 personalisables via l'ACC
|
| 410 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P3http -- ACCEPT "
|
- |
|
| 411 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j NETFLOW
|
- |
|
| 412 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport http -m state --state NEW -j ACCEPT
|
398 |
custom_tcp_protocols_list='';custom_udp_protocols_list=''
|
| 413 |
while read svc_line
|
399 |
while read svc_line
|
| 414 |
do
|
400 |
do
|
| 415 |
svc_on=`echo $svc_line|cut -b1`
|
401 |
svc_on=`echo $svc_line|cut -b1`
|
| 416 |
if [ $svc_on != "#" ]
|
402 |
if [ $svc_on != "#" ]
|
| 417 |
then
|
403 |
then
|
| 418 |
svc_name=`echo $svc_line|cut -d" " -f1`
|
404 |
svc_name=`echo $svc_line|cut -d" " -f1`
|
| 419 |
svc_port=`echo $svc_line|cut -d" " -f2`
|
405 |
svc_port=`echo $svc_line|cut -d" " -f2`
|
| 420 |
if [ $svc_name = "icmp" ]
|
406 |
if [ $svc_name = "icmp" ]
|
| 421 |
then
|
407 |
then
|
| 422 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p icmp -j NETFLOW
|
- |
|
| 423 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p icmp -j ACCEPT
|
408 |
svc_icmp="on"
|
| 424 |
else
|
409 |
else
|
| - |
|
410 |
if [ "$custom_tcp_protocols_list" == "" ]
|
| - |
|
411 |
then
|
| - |
|
412 |
custom_tcp_protocols_list=$svc_port
|
| 425 |
|
413 |
else
|
| 426 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j NFLOG --nflog-prefix "RULE F_TCP-P3$svc_name -- ACCEPT "
|
414 |
custom_tcp_protocols_list=`echo $custom_tcp_protocols_list","$svc_port`
|
| - |
|
415 |
fi
|
| 427 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j NETFLOW
|
416 |
udp_svc=`egrep "[[:space:]]$svc_port/udp" /etc/services|wc -l`
|
| 428 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
|
417 |
if [ $udp_svc = "1" ] # udp service exist
|
| - |
|
418 |
then
|
| 429 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j NFLOG --nflog-prefix "RULE F_UDP-P3$svc_name -- ACCEPT "
|
419 |
if [ "$custom_udp_protocols_list" == "" ]
|
| - |
|
420 |
then
|
| 430 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j NETFLOW
|
421 |
custom_udp_protocols_list=$svc_port
|
| - |
|
422 |
else
|
| 431 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ACCEPT
|
423 |
custom_udp_protocols_list=`echo $custom_udp_protocols_list","$svc_port`
|
| - |
|
424 |
fi
|
| - |
|
425 |
fi
|
| 432 |
fi
|
426 |
fi
|
| 433 |
fi
|
427 |
fi
|
| 434 |
done < /usr/local/etc/alcasar-services
|
428 |
done < /usr/local/etc/alcasar-services
|
| - |
|
429 |
if [ "$custom_tcp_protocols_list" == "" ]
|
| - |
|
430 |
then
|
| - |
|
431 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -j REJECT
|
| - |
|
432 |
else
|
| - |
|
433 |
if [ "$svc_icmp" != "on" ]
|
| - |
|
434 |
then
|
| - |
|
435 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p icmp -j REJECT --reject-with icmp-proto-unreachable
|
| - |
|
436 |
fi
|
| - |
|
437 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports $custom_tcp_protocols_list -m state --state NEW -j REJECT --reject-with tcp-reset
|
| - |
|
438 |
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports $custom_udp_protocols_list -m state --state NEW -j REJECT --reject-with icmp-port-unreachable
|
| - |
|
439 |
fi
|
| 435 |
|
440 |
|
| 436 |
# Rejet explicite des autres protocoles pour P1, P2, P3 et les autres
|
- |
|
| 437 |
# reject the others protocols for P1,P2, P3 and other
|
- |
|
| 438 |
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -j NFLOG --nflog-prefix "RULE F_filterP1 -- REJECT "
|
- |
|
| 439 |
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -p tcp -j REJECT --reject-with tcp-reset
|
- |
|
| 440 |
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -p udp -j REJECT --reject-with icmp-port-unreachable
|
- |
|
| 441 |
$IPTABLES -A FORWARD -i $TUNIF -m set ! --match-set proto_0 src -p icmp -j REJECT
|
- |
|
| 442 |
|
- |
|
| 443 |
|
- |
|
| 444 |
|
- |
|
| 445 |
# Autorisation des connections sortant du LAN
|
441 |
# journalisation et autorisation des connections sortant du LAN
|
| 446 |
# Allow forward connections with log
|
442 |
# Allow forward connections with log
|
| 447 |
#$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
|
- |
|
| 448 |
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j NETFLOW
|
443 |
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j NETFLOW
|
| 449 |
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
|
444 |
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
|
| 450 |
|
445 |
|
| 451 |
#############################
|
446 |
#############################
|
| 452 |
# OUTPUT #
|
447 |
# OUTPUT #
|
| 453 |
#############################
|
448 |
#############################
|
| 454 |
# On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur
|
449 |
# On laisse tout sortir sur toutes les cartes sauf celle qui est connectée sur l'extérieur
|
| 455 |
# Everything is allowed but traffic through outside network interface
|
450 |
# Everything is allowed but traffic through outside network interface
|
| 456 |
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
|
451 |
#$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
|
| - |
|
452 |
$IPTABLES -A OUTPUT -j ACCEPT
|
| 457 |
|
453 |
|
| 458 |
# Si configéré, on autorise les requêtes DHCP
|
454 |
# Si configéré, on autorise les requêtes DHCP
|
| 459 |
# Allow DHCP requests if configured
|
455 |
# Allow DHCP requests if configured
|
| 460 |
public_ip_mask=`grep ^PUBLIC_IP= $CONF_FILE|cut -d"=" -f2` # ALCASAR WAN IP address
|
456 |
public_ip_mask=`grep ^PUBLIC_IP= $CONF_FILE|cut -d"=" -f2` # ALCASAR WAN IP address
|
| 461 |
if [[ "$public_ip_mask" == "dhcp" ]]
|
457 |
if [[ "$public_ip_mask" == "dhcp" ]]
|