Subversion Repositories ALCASAR

Rev

Rev 2840 | Rev 2844 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2840 Rev 2841
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-iptables.sh 2840 2020-06-27 22:35:40Z rexy $
 2 
# $Id: alcasar-iptables.sh 2841 2020-06-28 21:49:00Z rexy $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# This script writes the netfilter rules for ALCASAR
 4 
# This script writes the netfilter rules for ALCASAR
5 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
6 
#
 6 
#
7 
# Reminders
 7 
# Reminders
Line 43... Line 43...
43 
SSH=${SSH:=off}
 43 
SSH=${SSH:=off}
44 
SSH_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2`
 44 
SSH_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2`
45 
SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"}			# WAN IP address to reduce ssh access (all ip allowed on LAN side)
 45 
SSH_ADMIN_FROM=${SSH_ADMIN_FROM:="0.0.0.0/0.0.0.0"}			# WAN IP address to reduce ssh access (all ip allowed on LAN side)
46 
IPTABLES="/sbin/iptables"
 46 
IPTABLES="/sbin/iptables"
47 
IP_REHABILITEES="/etc/e2guardian/lists/exceptioniplist"		# Rehabilitated IP
 47 
IP_REHABILITEES="/etc/e2guardian/lists/exceptioniplist"		# Rehabilitated IP
48 
SITE_DIRECT="/usr/local/etc/alcasar-site-direct"			# Site Direct (no havp and no filtrage) for user BL
 48 
SITE_DIRECT="/usr/local/etc/alcasar-site-direct"			# WEB Sites allowed for all (no av and no filtering for av_bl users)
49 
 
 49 
 
50 
# Allow requests to internal DNS if activated
 50 
# Allow requests to internal DNS if activated
51 
if [ "$INT_DNS_ACTIVE" = "on" ]
 51 
if [ "$INT_DNS_ACTIVE" = "on" ]
52 
then
 52 
then
53 
	DNSSERVERS="$DNSSERVERS,$INT_DNS_IP"
 53 
	DNSSERVERS="$DNSSERVERS,$INT_DNS_IP"
Line 57... Line 57...
57 
# Saving SET of connected users if it exists
 57 
# Saving SET of connected users if it exists
58 
ipset list not_filtered 1>/dev/null 2>&1
 58 
ipset list not_filtered 1>/dev/null 2>&1
59 
if [ $? -eq 0 ];
 59 
if [ $? -eq 0 ];
60 
then
 60 
then
61 
	ipset save not_filtered > $TMP_users_set_save
 61 
	ipset save not_filtered > $TMP_users_set_save
62 
	ipset save havp >> $TMP_users_set_save
 62 
	ipset save av >> $TMP_users_set_save
63 
	ipset save havp_bl >> $TMP_users_set_save
 63 
	ipset save av_bl >> $TMP_users_set_save
64 
	ipset save havp_wl >> $TMP_users_set_save
 64 
	ipset save av_wl >> $TMP_users_set_save
65 
	ipset save proto_0 >> $TMP_users_set_save
 65 
	ipset save proto_0 >> $TMP_users_set_save
66 
	ipset save proto_1 >> $TMP_users_set_save
 66 
	ipset save proto_1 >> $TMP_users_set_save
67 
	ipset save proto_2 >> $TMP_users_set_save
 67 
	ipset save proto_2 >> $TMP_users_set_save
68 
	ipset save proto_3 >> $TMP_users_set_save
 68 
	ipset save proto_3 >> $TMP_users_set_save
69 
fi
 69 
fi
Line 120... Line 120...
120 
for ip in $(cat $IP_REHABILITEES)
 120 
for ip in $(cat $IP_REHABILITEES)
121 
do
 121 
do
122 
	ipset -q del bl_ip_blocked $ip
 122 
	ipset -q del bl_ip_blocked $ip
123 
done
 123 
done
124 
 
 124 
 
125 
# rajout exception havp_bl --> Site en direct pour les Utilisateurs filtrés
 125 
# ipset for exception web sites (usefull for filtered users = av_bl)
126 
ipset create site_direct hash:net hashsize 1024
 126 
ipset create site_direct hash:net hashsize 1024
127 
for site in $(cat $SITE_DIRECT)
 127 
for site in $(cat $SITE_DIRECT)
128 
do
 128 
do
129 
    ipset add site_direct $site
 129 
    ipset add site_direct $site
130 
done
 130 
done
Line 148... Line 148...
148 
then
 148 
then
149 
	ipset -! restore < $TMP_users_set_save
 149 
	ipset -! restore < $TMP_users_set_save
150 
	rm -f $TMP_users_set_save
 150 
	rm -f $TMP_users_set_save
151 
else
 151 
else
152 
	ipset create not_filtered hash:ip hashsize 1024
 152 
	ipset create not_filtered hash:ip hashsize 1024
153 
	ipset create havp hash:ip hashsize 1024
 153 
	ipset create av hash:ip hashsize 1024
154 
	ipset create havp_bl hash:ip hashsize 1024
 154 
	ipset create av_bl hash:ip hashsize 1024
155 
	ipset create havp_wl hash:ip hashsize 1024
 155 
	ipset create av_wl hash:ip hashsize 1024
156 
	# pour les filtrages de protocole par utilisateur / For network protocols filtering by user
 156 
	# pour les filtrages de protocole par utilisateur / For network protocols filtering by user
157 
	ipset create proto_0 hash:ip hashsize 1024
 157 
	ipset create proto_0 hash:ip hashsize 1024
158 
	ipset create proto_1 hash:ip hashsize 1024
 158 
	ipset create proto_1 hash:ip hashsize 1024
159 
	ipset create proto_2 hash:ip hashsize 1024
 159 
	ipset create proto_2 hash:ip hashsize 1024
160 
	ipset create proto_3 hash:ip hashsize 1024
 160 
	ipset create proto_3 hash:ip hashsize 1024
Line 164... Line 164...
164 
#       PREROUTING          #
 164 
#       PREROUTING          #
165 
#############################
 165 
#############################
166 
 
 166 
 
167 
# Marquage (et journalisation) des paquets qui tentent d'accéder directement aux ports d'écoute du proxy HTTP/HTTPS (E2Guardian) pour pouvoir les rejeter en INPUT
 167 
# Marquage (et journalisation) des paquets qui tentent d'accéder directement aux ports d'écoute du proxy HTTP/HTTPS (E2Guardian) pour pouvoir les rejeter en INPUT
168 
# Mark (and log) the direct attempts to E2guardian listen ports in order to REJECT them in INPUT rules
 168 
# Mark (and log) the direct attempts to E2guardian listen ports in order to REJECT them in INPUT rules
169 
# 8080 = ipset havp_bl
 169 
# 8080 = ipset av_bl
170 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
 170 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
171 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
 171 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
172 
# 8090 = ipset havp_wl + havp
 172 
# 8090 = ipset av_wl + av
173 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8090 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
 173 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8090 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
174 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8090 -j MARK --set-mark 2
 174 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8090 -j MARK --set-mark 2
175 
# 8443 = tranparent HTTPS for ipsets havp_bl + havp_wl + havp
 175 
# 8443 = tranparent HTTPS for ipsets av_bl + av_wl + av
176 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8443 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
 176 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8443 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
177 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8443 -j MARK --set-mark 6
 177 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8443 -j MARK --set-mark 6
178 
 
 178 
 
179 
# Marquage des paquets qui tentent d'accéder directement aux ports d'écoute DNS (UNBOUND) pour pouvoir les rejeter en INPUT
 179 
# Marquage des paquets qui tentent d'accéder directement aux ports d'écoute DNS (UNBOUND) pour pouvoir les rejeter en INPUT
180 
# Mark the direct attempts to DNS ports (UNBOUND) in order to REJECT them in INPUT rules
 180 
# Mark the direct attempts to DNS ports (UNBOUND) in order to REJECT them in INPUT rules
181 
# 54 = ipset havp_bl
 181 
# 54 = ipset av_bl
182 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 3
 182 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 3
183 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 54 -j MARK --set-mark 3
 183 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 54 -j MARK --set-mark 3
184 
# 55 = ipset havp_wl
 184 
# 55 = ipset av_wl
185 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 55 -j MARK --set-mark 4
 185 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 55 -j MARK --set-mark 4
186 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 55 -j MARK --set-mark 4
 186 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 55 -j MARK --set-mark 4
187 
# 56 = blackall
 187 
# 56 = blackall
188 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 56 -j MARK --set-mark 5
 188 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 56 -j MARK --set-mark 5
189 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 56 -j MARK --set-mark 5
 189 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 56 -j MARK --set-mark 5
190 
 
 190 
 
191 
# redirection DNS des usagers
 191 
# redirection DNS des usagers
192 
# users DNS redirection
 192 
# users DNS redirection
193 
# 54 = ipset havp_bl
 193 
# 54 = ipset av_bl
194 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src -p udp --dport domain -j REDIRECT --to-port 54
 194 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -p udp --dport domain -j REDIRECT --to-port 54
195 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src -p tcp --dport domain -j REDIRECT --to-port 54
 195 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -p tcp --dport domain -j REDIRECT --to-port 54
196 
# 55 = ipset havp_wl
 196 
# 55 = ipset av_wl
197 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src -p udp --dport domain -j REDIRECT --to-port 55
 197 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -p udp --dport domain -j REDIRECT --to-port 55
198 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src -p tcp --dport domain -j REDIRECT --to-port 55
 198 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -p tcp --dport domain -j REDIRECT --to-port 55
199 
# 53 = all other users
199 
# 53 = all other users
200 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 53
 200 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 53
201 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p tcp --dport domain -j REDIRECT --to-port 53
 201 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p tcp --dport domain -j REDIRECT --to-port 53
202 
 
 202 
 
203 
# Redirection des requêtes HTTP des usagers vers E2guardian
 203 
# Redirection des requêtes HTTP des usagers vers E2guardian
204 
# Redirect outbound users HTTP requests to E2guardian
 204 
# Redirect outbound users HTTP requests to E2guardian
205 
# 8080 = ipset havp_bl
 205 
# 8080 = ipset av_bl
206 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport http -j REDIRECT --to-port 8080
 206 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport http -j REDIRECT --to-port 8080
207 
# 8090 = ipset havp_wl & havp
 207 
# 8090 = ipset av_wl & av
208 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
 208 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
209 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
 209 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8090
210 
 
 210 
 
211 
# Redirection des requêtes HTTPS sortantes des usagers havp_bl + havp_wl + havp vers E2Guardian
 211 
# Redirection des requêtes HTTPS sortantes des usagers av_bl + av_wl + av vers E2Guardian
212 
# Redirect outbound HTTPS requests of havp_bl + havp_wl + havp users to E2Guardian
 212 
# Redirect outbound HTTPS requests of av_bl + av_wl + av users to E2Guardian
213 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
 213 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
214 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
 214 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
215 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
 215 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
216 
 
 216 
 
217 
# Journalisation HTTP_Internet des usagers 'havp_bl' (paquets SYN uniquement). Les autres protocoles sont journalisés en FORWARD par netflow.
 217 
# Journalisation HTTP_Internet des usagers 'av_bl' (paquets SYN uniquement). Les autres protocoles sont journalisés en FORWARD par netflow.
218 
# Log Internet HTTP of 'havp_bl' users" (only syn packets). Other protocols are logged in FORWARD by netflow
 218 
# Log Internet HTTP of 'av_bl' users" (only syn packets). Other protocols are logged in FORWARD by netflow
219 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
 219 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
220 
 
 220 
 
221 
# Redirection HTTP des usagers 'havp_bl' cherchant à joindre les IP de la blacklist vers ALCASAR (page 'accès interdit')
 221 
# Redirection HTTP des usagers 'av_bl' cherchant à joindre les IP de la blacklist vers ALCASAR (page 'accès interdit')
222 
# Redirect HTTP of 'havp_bl' users who want blacklist IP to ALCASAR ('access denied' page)
 222 
# Redirect HTTP of 'av_bl' users who want blacklist IP to ALCASAR ('access denied' page)
223 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80
 223 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80
224 
 
 224 
 
225 
# Redirection HTTP des usagers 'havp_wl' cherchant à joindre les IP qui ne sont pas dans la WL vers ALCASAR (page 'accès interdit')
 225 
# Redirection HTTP des usagers 'av_wl' cherchant à joindre les IP qui ne sont pas dans la WL vers ALCASAR (page 'accès interdit')
226 
# Redirect HTTP of 'havp_wl' users who want IP not in the WL to ALCASAR ('access denied' page)
 226 
# Redirect HTTP of 'av_wl' users who want IP not in the WL to ALCASAR ('access denied' page)
227 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src -m set ! --match-set wl_ip_allowed dst -p tcp --dport http -j REDIRECT --to-port 80
 227 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -m set ! --match-set wl_ip_allowed dst -p tcp --dport http -j REDIRECT --to-port 80
228 
 
 228 
 
229 
# Redirection des requêtes NTP vers le serveur NTP local
 229 
# Redirection des requêtes NTP vers le serveur NTP local
230 
# Redirect NTP request in local NTP server
 230 
# Redirect NTP request in local NTP server
231 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p udp --dport ntp -j REDIRECT --to-port 123
 231 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p udp --dport ntp -j REDIRECT --to-port 123
232 
 
 232 
 
Line 263... Line 263...
263 
# Conntrack on INPUT
 263 
# Conntrack on INPUT
264 
$IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 264 
$IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
265 
 
 265 
 
266 
# On interdit les connexions directes aux ports d'écoute d'E2Guardian. Les packets concernés ont été marqués et loggués dans la table mangle (PREROUTING)
 266 
# On interdit les connexions directes aux ports d'écoute d'E2Guardian. Les packets concernés ont été marqués et loggués dans la table mangle (PREROUTING)
267 
# Deny direct connections on E2Guardian listen ports. The concerned paquets have been marked and logged in mangle table (PREROUTING)
 267 
# Deny direct connections on E2Guardian listen ports. The concerned paquets have been marked and logged in mangle table (PREROUTING)
268 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset # havp_bl
 268 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset # av_bl
269 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8090 -m mark --mark 2 -j REJECT --reject-with tcp-reset # havp_wl+havp
 269 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8090 -m mark --mark 2 -j REJECT --reject-with tcp-reset # av_wl + av
270 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8443 -m mark --mark 6 -j REJECT --reject-with tcp-reset # havp_bl+havp_wl+havp
 270 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8443 -m mark --mark 6 -j REJECT --reject-with tcp-reset # av_bl + av_wl + av
271 
 
 271 
 
272 
# On autorise les connexions HTTP/HTTPS légitimes vers E2Guardian
 272 
# On autorise les connexions HTTP/HTTPS légitimes vers E2Guardian
273 
# Allow HTTP connections to E2Guardian
 273 
# Allow HTTP connections to E2Guardian
274 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m conntrack --ctstate NEW --syn -j ACCEPT
 274 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m conntrack --ctstate NEW --syn -j ACCEPT
275 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8090 -m conntrack --ctstate NEW --syn -j ACCEPT
 275 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8090 -m conntrack --ctstate NEW --syn -j ACCEPT
Line 284... Line 284...
284 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 56 -m mark --mark 5 -j REJECT --reject-with icmp-port-unreachable
 284 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 56 -m mark --mark 5 -j REJECT --reject-with icmp-port-unreachable
285 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 56 -m mark --mark 5 -j REJECT --reject-with tcp-reset
 285 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 56 -m mark --mark 5 -j REJECT --reject-with tcp-reset
286 
 
 286 
 
287 
# On autorise les connexion DNS légitime
 287 
# On autorise les connexion DNS légitime
288 
# Allow DNS connections
 288 
# Allow DNS connections
289 
# ipset = havp_bl
 289 
# ipset = av_bl
290 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT
 290 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT
291 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 54 -j ACCEPT
 291 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 54 -j ACCEPT
292 
# ipset = havp_wl
 292 
# ipset = av_wl
293 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 55 -j ACCEPT
 293 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 55 -j ACCEPT
294 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 55 -j ACCEPT
 294 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 55 -j ACCEPT
295 
# blackall
 295 
# blackall
296 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 56 -j ACCEPT
 296 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 56 -j ACCEPT
297 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 56 -j ACCEPT
 297 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 56 -j ACCEPT
Line 340... Line 340...
340 
 
 340 
 
341 
#############################
 341 
#############################
342 
#        FORWARD            #
 342 
#        FORWARD            #
343 
#############################
 343 
#############################
344 
 
 344 
 
345 
# Blocage des IPs du SET bl_ip_blocked pour le SET havp_bl
 345 
# Blocage des IPs du SET bl_ip_blocked pour le SET av_bl
346 
# Deny IPs of the SET bl_ip_blocked for the set havp_bl
 346 
# Deny IPs of the SET bl_ip_blocked for the set av_bl
347 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p icmp -j REJECT --reject-with icmp-host-prohibited
 347 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p icmp -j REJECT --reject-with icmp-host-prohibited
348 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p udp -j REJECT --reject-with icmp-host-prohibited
 348 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p udp -j REJECT --reject-with icmp-host-prohibited
349 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_bl src -m set --match-set bl_ip_blocked dst -p tcp -j REJECT --reject-with tcp-reset
 349 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p tcp -j REJECT --reject-with tcp-reset
350 
 
 350 
 
351 
# Active le suivi de session
 351 
# Active le suivi de session
352 
# Allow Conntrack
 352 
# Allow Conntrack
353 
$IPTABLES -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 353 
$IPTABLES -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
354 
 
 354 
 
Line 418... Line 418...
418 
		fi
 418 
		fi
419 
		$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports $custom_tcp_protocols_list -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
 419 
		$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports $custom_tcp_protocols_list -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
420 
		$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports $custom_udp_protocols_list -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
 420 
		$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports $custom_udp_protocols_list -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
421 
	fi
 421 
	fi
422 
 
 422 
 
423 
# Blocage des usagers 'havp_wl' cherchant à joindre les IP qui ne sont pas dans la WL
 423 
# Blocage des usagers 'av_wl' cherchant à joindre les IP qui ne sont pas dans la WL
424 
# Block 'havp_wl' users who want IP not in the WL
 424 
# Block 'av_wl' users who want IP not in the WL
425 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set havp_wl src -m set ! --match-set wl_ip_allowed dst -j DROP
 425 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_wl src -m set ! --match-set wl_ip_allowed dst -j DROP
426 
 
 426 
 
427 
# journalisation et autorisation des connections sortant du LAN
 427 
# journalisation et autorisation des connections sortant du LAN
428 
# Allow forward connections with log
 428 
# Allow forward connections with log
429 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j NETFLOW
 429 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j NETFLOW
430 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j ACCEPT
 430 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j ACCEPT