Subversion Repositories ALCASAR

Rev

Rev 3205 | Rev 3245 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 3205 Rev 3243
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-iptables.sh 3205 2024-06-03 21:33:22Z rexy $
 2 
# $Id: alcasar-iptables.sh 3243 2025-01-19 17:33:09Z rexy $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 - 
 
4 
# This script writes the netfilter rules for ALCASAR
 3 
# This script writes the netfilter rules for ALCASAR (see 'alcasar-iptables-bypass.sh' for iptables rules in Bypass mode)
5 
# Rexy - 3abtux - CPN
 4 
# Rexy - 3abtux - CPN
6 
#
 5 
#
7 
# Reminders
 6 
# Reminders
8 
# There are four channels for log :
 7 
# There are four channels for log :
9 
#	1 tracability of the consultation equipment with The 'Netflow' kernel module (iptables target = NETFLOW);
 8 
#	1 tracability of the consultation equipment with The 'Netflow' kernel module (iptables target = NETFLOW);
Line 51... Line 50...
51 
SSH_WAN_ADMIN_FROM=$([ "$SSH_WAN_ADMIN_FROM" == "0.0.0.0" ] && echo "0.0.0.0/0" || echo "$SSH_WAN_ADMIN_FROM" )
 50 
SSH_WAN_ADMIN_FROM=$([ "$SSH_WAN_ADMIN_FROM" == "0.0.0.0" ] && echo "0.0.0.0/0" || echo "$SSH_WAN_ADMIN_FROM" )
52 
SSH_LAN_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2|cut -d"/" -f1`
 51 
SSH_LAN_ADMIN_FROM=`grep ^SSH_ADMIN_FROM= $CONF_FILE|cut -d"=" -f2|cut -d"/" -f1`
53 
SSH_LAN_ADMIN_FROM=${SSH_LAN_ADMIN_FROM:="0.0.0.0"}
 52 
SSH_LAN_ADMIN_FROM=${SSH_LAN_ADMIN_FROM:="0.0.0.0"}
54 
SSH_LAN_ADMIN_FROM=$([ "$SSH_LAN_ADMIN_FROM" == "0.0.0.0" ] && echo "$PRIVATE_NETWORK_MASK" || echo "$SSH_LAN_ADMIN_FROM" )
 53 
SSH_LAN_ADMIN_FROM=$([ "$SSH_LAN_ADMIN_FROM" == "0.0.0.0" ] && echo "$PRIVATE_NETWORK_MASK" || echo "$SSH_LAN_ADMIN_FROM" )
55 
IPTABLES="/sbin/iptables"
 54 
IPTABLES="/sbin/iptables"
56 
REHABILITED_IP="/etc/e2guardian/lists/common/exceptioniplist"
 55 
REHABILITED_IP="/etc/e2guardian/lists/group1/exceptionsiteiplist"
57 
ALLOWED_SITES="/usr/local/etc/alcasar-site-direct"			# WEB Sites allowed for all (no av and no filtering for av_bl users)
 56 
ALLOWED_SITES="/usr/local/etc/alcasar-site-direct"			# WEB Sites allowed for all (no av and no filtering for av_bl users)
58 
MULTIWAN=`grep ^MULTIWAN $CONF_FILE|cut -d"=" -f2`
 57 
MULTIWAN=`grep ^MULTIWAN $CONF_FILE|cut -d"=" -f2`
59 
PROXY=`grep ^PROXY= $CONF_FILE|cut -d"=" -f2`
 58 
PROXY=`grep ^PROXY= $CONF_FILE|cut -d"=" -f2`
60 
PROXY_IP=`grep ^PROXY_IP= $CONF_FILE|cut -d"=" -f2`
 59 
PROXY_IP=`grep ^PROXY_IP= $CONF_FILE|cut -d"=" -f2`
61 
nb_gw=`grep ^WAN $CONF_FILE|wc -l`
 60 
nb_gw=`grep ^WAN $CONF_FILE|wc -l`
Line 74... Line 73...
74 
	for ((i=1 ; i<=$nb_gw ; i++)); do
 73 
	for ((i=1 ; i<=$nb_gw ; i++)); do
75 
		gw_list="${gw_list} gw$i"
 74 
		gw_list="${gw_list} gw$i"
76 
	done
 75 
	done
77 
fi
 76 
fi
78 
 
 77 
 
79 
# Sauvegarde des SET des utilisateurs connectés si ils existent
 - 
 
80 
# Saving SET of connected users if it exists
 78 
# Saving SET of connected users if it exists
81 
ipset list not_filtered 1>/dev/null 2>&1
 79 
ipset list not_filtered 1>/dev/null 2>&1
82 
if [ $? -eq 0 ];
 80 
if [ $? -eq 0 ];
83 
then
 81 
then
84 
	ipset save not_filtered > $TMP_users_set_save
 82 
	ipset save not_filtered > $TMP_users_set_save
Line 89... Line 87...
89 
	ipset save proto_1 >> $TMP_users_set_save
 87 
	ipset save proto_1 >> $TMP_users_set_save
90 
	ipset save proto_2 >> $TMP_users_set_save
 88 
	ipset save proto_2 >> $TMP_users_set_save
91 
	ipset save proto_3 >> $TMP_users_set_save
 89 
	ipset save proto_3 >> $TMP_users_set_save
92 
fi
 90 
fi
93 
 
 91 
 
94 
# Sauvegarde de la liste de toutes les IP déjà connectées pour les réintégrer dans le load balancing
 - 
 
95 
# Saving all of the already connected IP in order to put them back in the load balancing after
 92 
# Saving all of the already connected IP in order to put them back in the load balancing after
96 
if [ ! -f $TMP_ip_gw_save ];then
 93 
if [ ! -f $TMP_ip_gw_save ];then
97 
	# Save only if alcasar-network.sh --save has not been executed before
 94 
	# Save only if alcasar-network.sh --save has not been executed before
98 
	for i in $gw_list;do
 95 
	for i in $gw_list;do
99 
		ipset list $i 1>/dev/null 2>&1
 96 
		ipset list $i 1>/dev/null 2>&1
100 
		if [ $? -eq 0 ]
 97 
		if [ $? -eq 0 ]
101 
		then
 98 
		then
102 
			# the cut -d":" -f5 deletes all the lines with a :, i.e all the lines execpt the members
 99 
			# the cut -d":" -f5 deletes all the lines with a :, i.e all the lines except the members
103 
			ipset list $i | cut -d":" -f5 | sed '/^[[:space:]]*$/d' >> $TMP_ip_gw_save
 100 
			ipset list $i | cut -d":" -f5 | sed '/^[[:space:]]*$/d' >> $TMP_ip_gw_save
104 
		fi
 101 
		fi
105 
	done
 102 
	done
106 
fi
 103 
fi
107 
 
 104 
 
108 
# Chargement de la sonde NetFlow (module noyau ipt_NETFLOW)
 - 
 
109 
# loading of NetFlow probe (ipt_NETFLOW kernel module)
 105 
# loading of NetFlow probe (ipt_NETFLOW kernel module)
110 
modprobe ipt_NETFLOW destination=127.0.0.1:2055
 106 
modprobe ipt_NETFLOW destination=127.0.0.1:2055
111 
 
 107 
 
112 
# Effacement des règles existantes
 - 
 
113 
# Flush all existing rules
 108 
# Flush all existing rules
114 
$IPTABLES -F
 109 
$IPTABLES -F
115 
$IPTABLES -t nat -F
 110 
$IPTABLES -t nat -F
116 
$IPTABLES -t mangle -F
 111 
$IPTABLES -t mangle -F
117 
$IPTABLES -F INPUT
 112 
$IPTABLES -F INPUT
118 
$IPTABLES -F FORWARD
 113 
$IPTABLES -F FORWARD
119 
$IPTABLES -F OUTPUT
 114 
$IPTABLES -F OUTPUT
120 
 
 115 
 
121 
# Suppression des chaines utilisateurs sur les tables filter et nat
 - 
 
122 
# Flush non default rules on filter and nat tables
 116 
# Flush non default rules on filter and nat tables
123 
$IPTABLES -X
 117 
$IPTABLES -X
124 
$IPTABLES -t nat -X
 118 
$IPTABLES -t nat -X
125 
 
 119 
 
126 
# Stratégies par défaut
 - 
 
127 
# Default policies
 120 
# Default policies
128 
$IPTABLES -P INPUT DROP
 121 
$IPTABLES -P INPUT DROP
129 
$IPTABLES -P FORWARD DROP
 122 
$IPTABLES -P FORWARD DROP
130 
$IPTABLES -P OUTPUT DROP
 123 
$IPTABLES -P OUTPUT DROP
131 
$IPTABLES -t nat -P PREROUTING ACCEPT
 124 
$IPTABLES -t nat -P PREROUTING ACCEPT
132 
$IPTABLES -t nat -P POSTROUTING ACCEPT
 125 
$IPTABLES -t nat -P POSTROUTING ACCEPT
133 
$IPTABLES -t nat -P OUTPUT ACCEPT
 126 
$IPTABLES -t nat -P OUTPUT ACCEPT
134 
 
 127 
 
135 
#############################
 128 
######################################################################################
136 
#          IPSET            #
 129 
#                         IPSET dynamically loaded/unloaded by coova                 #
- 
 
 130 
# 'not_filtered' :  @IP of users without DNS filtering                               #
- 
 
 131 
# 'av' :            @IP of user with AV (no more used)                               #
- 
 
 132 
# 'av_bl' :         @IP of blacklisted users                                         #
- 
 
 133 
# 'av_wl' :         @IP of whitelisted users                                         #
- 
 
 134 
# 'proto_0' :       @IP of users without protocol filtering                          #
- 
 
 135 
# 'proto_1 :        @IP of users with web ports                                      #
- 
 
 136 
# 'proto_2 :        @IP of users with web/ftp/mail/ssh ports                         #
- 
 
 137 
# 'proto_3 :        @IP of users with custom ports                                   #
- 
 
 138 
#                         IPSET dynamically loaded/unloaded by unbound               #
- 
 
 139 
# 'wl_ip_allowed' : @IP of web sites allowed                                         #
- 
 
 140 
#                         IPSET statically loaded                                    #
- 
 
 141 
# 'bl_ip_blocked' : @IP of sites in selected blacklisted categories                  #
- 
 
 142 
# 'site_direct' :   @IP/@network of trusted system/network (without authentication)  #
- 
 
 143 
# 'gwX' :           @IP of Gws (to manage load balancing)                            #
- 
 
 144 
# 'profil1_ports' : list of profil1 allowed ports                                    #
- 
 
 145 
# 'profil2_ports' : list of profil2 allowed ports                                    #
- 
 
 146 
# 'custom_ports' :  list of custom allowed ports                                     #
137 
#############################
 147 
######################################################################################
138 
# destruction de tous les SET
 148 
# destruction de tous les SET / destroy all SET
139 
# destroy all SET
 - 
 
140 
ipset flush
 149 
ipset flush
141 
ipset destroy
 150 
ipset destroy
142 
 
 151 
 
143 
###### BL set  ###########
 152 
######  'bl_ip_blocked' set  ######
144 
# Calcul de la taille / Compute the length
 153 
# Compute the length
145 
bl_set_length=$(wc -l $BL_IP_CAT/* | awk '{print $1}' | tail -n 1)
 154 
bl_set_length=$(wc -l $BL_IP_CAT/* | awk '{print $1}' | tail -n 1)
146 
# Chargement / loading
 155 
# Loading
147 
echo "create bl_ip_blocked hash:net family inet hashsize 1024 maxelem $bl_set_length" > $TMP_set_save
 156 
echo "create bl_ip_blocked hash:net family inet hashsize 1024 maxelem $bl_set_length" > $TMP_set_save
148 
for category in `ls -1 $BL_IP_CAT | cut -d '@' -f1`
 157 
for category in `ls -1 $BL_IP_CAT | cut -d '@' -f1`
149 
do
 158 
do
150 
	cat $BL_IP_CAT/$category >> $TMP_set_save
 159 
	cat $BL_IP_CAT/$category >> $TMP_set_save
151 
done
 160 
done
152 
ipset -! restore < $TMP_set_save
 161 
ipset -! restore < $TMP_set_save
153 
rm -f $TMP_set_save
 162 
rm -f $TMP_set_save
154 
# Suppression des ip réhabilitées / Removing of rehabilitated ip
 163 
# Removing of rehabilitated ip
155 
for ip in $(cat $REHABILITED_IP)
 164 
for ip in $(cat $REHABILITED_IP)
156 
do
 165 
do
157 
	ipset -q del bl_ip_blocked $ip
 166 
	ipset -q del bl_ip_blocked $ip
158 
done
 167 
done
159 
 
 168 
 
160 
# ipset for exception web sites (usefull for filtered users = av_bl)
 169 
###### 'site_direct' (usefull only for authenticated and filtered users) ######
161 
ipset create site_direct hash:net hashsize 1024
 170 
ipset create site_direct hash:net hashsize 1024
162 
for site in $(cat $ALLOWED_SITES)
 171 
for site in $(cat $ALLOWED_SITES)
163 
do
 172 
do
164 
    ipset add site_direct $site
 173 
    ipset add site_direct $site
165 
done
 174 
done
166 
 
 175 
 
167 
###### WL set  ###########
 176 
###### 'wl_ip_allowed' set ######
168 
# taille fixe, car peuplé par unbound / fixe length due to unbound dynamic loading
 177 
# Fixe size as it is dynamically populated by unbound
169 
wl_set_length=65536
 178 
wl_set_length=65536
170 
# Chargement Loading
 179 
# Loading
171 
echo "create wl_ip_allowed hash:net family inet hashsize 1024 maxelem $wl_set_length" > $TMP_set_save
 180 
echo "create wl_ip_allowed hash:net family inet hashsize 1024 maxelem $wl_set_length" > $TMP_set_save
172 
#get ip-wl files from ACC
 181 
# get ip-wl files from ACC
173 
for category in `ls -1 $WL_IP_CAT |cut -d '@' -f1`
 182 
for category in `ls -1 $WL_IP_CAT |cut -d '@' -f1`
174 
do
 183 
do
175 
	cat $WL_IP_CAT/$category >> $TMP_set_save
 184 
	cat $WL_IP_CAT/$category >> $TMP_set_save
176 
done
 185 
done
177 
ipset -! restore < $TMP_set_save
 186 
ipset -! restore < $TMP_set_save
178 
rm -f $TMP_set_save
 187 
rm -f $TMP_set_save
179 
 
 188 
 
180 
# Restoration des SET des utilisateurs connectés si ils existent sinon création des SET
 - 
 
181 
# Restoring the connected users SETs if available, otherwise creating SETs
 189 
# Restoring the connected users SETs if available, otherwise creating SETs
182 
if [ -e $TMP_users_set_save ];
 190 
if [ -e $TMP_users_set_save ];
183 
then
 191 
then
184 
	ipset -! restore < $TMP_users_set_save
 192 
	ipset -! restore < $TMP_users_set_save
185 
	rm -f $TMP_users_set_save
 193 
	rm -f $TMP_users_set_save
186 
else
 194 
else
187 
	ipset create not_filtered hash:ip hashsize 1024
 195 
	ipset create not_filtered hash:ip hashsize 1024
188 
	ipset create av hash:ip hashsize 1024
 196 
	ipset create av hash:ip hashsize 1024
189 
	ipset create av_bl hash:ip hashsize 1024
 197 
	ipset create av_bl hash:ip hashsize 1024
190 
	ipset create av_wl hash:ip hashsize 1024
 198 
	ipset create av_wl hash:ip hashsize 1024
191 
	# pour les filtrages de protocole par utilisateur / For network protocols filtering by user
 199 
	# set d'utilisateurs pour le filtrages de protocoles / user set for protocol filtering
192 
	ipset create proto_0 hash:ip hashsize 1024
 200 
	ipset create proto_0 hash:ip hashsize 1024
193 
	ipset create proto_1 hash:ip hashsize 1024
 201 
	ipset create proto_1 hash:ip hashsize 1024
194 
	ipset create proto_2 hash:ip hashsize 1024
 202 
	ipset create proto_2 hash:ip hashsize 1024
195 
	ipset create proto_3 hash:ip hashsize 1024
 203 
	ipset create proto_3 hash:ip hashsize 1024
196 
fi
 204 
fi
197 
 
 205 
 
198 
#ipsets for load balancing
 206 
##### gw0, gw1, gwX : for load balancing ######
199 
for i in $gw_list; do
 207 
for i in $gw_list; do
200 
	ipset create $i hash:ip
 208 
	ipset create $i hash:ip
201 
done
 209 
done
202 
cat $TMP_ip_gw_save | while read ip; do
 210 
cat $TMP_ip_gw_save | while read ip; do
203 
	gw_min="gw0"
 211 
	gw_min="gw0"
Line 221... Line 229...
221 
	done
 229 
	done
222 
	ipset add $gw_min $ip
 230 
	ipset add $gw_min $ip
223 
done
 231 
done
224 
rm -f $TMP_ip_gw_save
 232 
rm -f $TMP_ip_gw_save
225 
 
 233 
 
- 
 
 234 
###### profil1_ports set ######
- 
 
 235 
# http https
- 
 
 236 
ipset create profil1_ports bitmap:port range 0-65535
- 
 
 237 
for svc_port in 80 443
- 
 
 238 
do
- 
 
 239 
	ipset add profil1_ports $svc_port
- 
 
 240 
done
- 
 
 241 
 
- 
 
 242 
###### profil2_ports set ######
- 
 
 243 
# ftp ftp-data ssh smtp http pop3 ftps imap https smtps(implicit) smtps(explicit) pop3s imaps smtps(explicit bis)
- 
 
 244 
ipset create profil2_ports bitmap:port range 0-65535
- 
 
 245 
for svc_port in 20 21 22 25 80 110 115 143 443 465 587 993 995 2525
- 
 
 246 
do
- 
 
 247 
	ipset add profil2_ports $svc_port
- 
 
 248 
done
- 
 
 249 
 
- 
 
 250 
###### custom_ports set ######
- 
 
 251 
ipset create custom_ports bitmap:port range 0-65535
- 
 
 252 
while read svc_line
- 
 
 253 
do
- 
 
 254 
	svc_on=`echo $svc_line|cut -b1`
- 
 
 255 
	if [ $svc_on != "#" ]
- 
 
 256 
	then
- 
 
 257 
		svc_name=`echo $svc_line|cut -d" " -f1`
- 
 
 258 
		svc_port=`echo $svc_line|cut -d" " -f2`
- 
 
 259 
		if [ $svc_name = "icmp" ]
- 
 
 260 
		then
- 
 
 261 
			svc_icmp="on"
- 
 
 262 
		else
- 
 
 263 
			ipset add custom_ports $svc_port
- 
 
 264 
		fi
- 
 
 265 
	fi
- 
 
 266 
done < /usr/local/etc/alcasar-services
- 
 
 267 
 
226 
#############################
 268 
#############################
227 
#       PREROUTING          #
 269 
#       PREROUTING          #
228 
#############################
 270 
#############################
229 
# Marquage (et journalisation) des paquets qui tentent d'accéder directement aux ports d'écoute du proxy HTTP/HTTPS (E2Guardian) pour pouvoir les rejeter en INPUT
 - 
 
230 
# Mark (and log) the direct attempts to E2guardian listen ports in order to REJECT them in INPUT rules
 271 
# Mark (and log) the direct attempts to E2guardian listen ports in order to REJECT them in INPUT rules
231 
# 8080 = ipset av_bl
 272 
# 8080 = ipset av_bl
232 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
 273 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8080 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
233 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
 274 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
234 
# 8081 = ipset av_wl + av (to be redefine)
 275 
# 8081 = ipset av_wl + av (to be redefine)
Line 236... Line 277...
236 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8081 -j MARK --set-mark 2
 277 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8081 -j MARK --set-mark 2
237 
# 8443 = tranparent HTTPS for ipsets av_bl + av_wl + av (future version)
 278 
# 8443 = tranparent HTTPS for ipsets av_bl + av_wl + av (future version)
238 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8443 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
 279 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -p tcp -d $PRIVATE_IP -m tcp --dport 8443 -j NFLOG --nflog-group 1 --nflog-prefix "RULE direct-proxy -- DENY "
239 
#$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8443 -j MARK --set-mark 6
 280 
#$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp -m tcp --dport 8443 -j MARK --set-mark 6
240 
 
 281 
 
241 
# Marquage des paquets qui tentent d'accéder directement aux ports d'écoute DNS (UNBOUND) pour pouvoir les rejeter en INPUT
 - 
 
242 
# Mark the direct attempts to DNS ports (UNBOUND) in order to REJECT them in INPUT rules
 282 
# Mark the direct attempts to DNS ports (UNBOUND) in order to REJECT them in INPUT rules
243 
# 54 = ipset av_bl
 283 
# 54 = ipset av_bl
244 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 3
 284 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 54 -j MARK --set-mark 3
245 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 54 -j MARK --set-mark 3
 285 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 54 -j MARK --set-mark 3
246 
# 55 = ipset av_wl
 286 
# 55 = ipset av_wl
Line 248... Line 288...
248 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 55 -j MARK --set-mark 4
 288 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 55 -j MARK --set-mark 4
249 
# 56 = blackall
 289 
# 56 = blackall
250 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 56 -j MARK --set-mark 5
 290 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p tcp --dport 56 -j MARK --set-mark 5
251 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 56 -j MARK --set-mark 5
 291 
$IPTABLES -A PREROUTING -t mangle -i $TUNIF -d $PRIVATE_IP -p udp --dport 56 -j MARK --set-mark 5
252 
 
 292 
 
253 
# redirection DNS des usagers
 - 
 
254 
# users DNS redirection
 293 
# users DNS redirection
255 
# 54 = ipset av_bl
 294 
# 54 = ipset av_bl
256 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -p udp --dport domain -j REDIRECT --to-port 54
 295 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -p udp --dport domain -j REDIRECT --to-port 54
257 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -p tcp --dport domain -j REDIRECT --to-port 54
 296 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -p tcp --dport domain -j REDIRECT --to-port 54
258 
# 55 = ipset av_wl
 297 
# 55 = ipset av_wl
Line 260... Line 299...
260 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -p tcp --dport domain -j REDIRECT --to-port 55
 299 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -p tcp --dport domain -j REDIRECT --to-port 55
261 
# 53 = all other users
 300 
# 53 = all other users
262 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 53
 301 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 53
263 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p tcp --dport domain -j REDIRECT --to-port 53
 302 
$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p tcp --dport domain -j REDIRECT --to-port 53
264 
 
 303 
 
265 
# Redirection HTTP des usagers 'av_bl' cherchant à joindre les IP de la blacklist vers ALCASAR (page 'accès interdit')
 - 
 
266 
# Redirect HTTP of 'av_bl' users who want blacklist IP to ALCASAR ('access denied' page)
 304 
# Redirect HTTP of 'av_bl' users who want blacklist IP to ALCASAR ('access denied' page)
267 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80
 305 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p tcp --dport http -j REDIRECT --to-port 80
268 
 
 306 
 
269 
# Redirection HTTP des usagers 'av_wl' cherchant à joindre les IP qui ne sont pas dans la WL vers ALCASAR (page 'accès interdit')
 - 
 
270 
# Redirect HTTP of 'av_wl' users who want IP not in the WL to ALCASAR ('access denied' page)
 307 
# Redirect HTTP of 'av_wl' users who want IP not in the WL to ALCASAR ('access denied' page)
271 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -m set ! --match-set wl_ip_allowed dst -p tcp --dport http -j REDIRECT --to-port 80
 308 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -m set ! --match-set wl_ip_allowed dst -p tcp --dport http -j REDIRECT --to-port 80
272 
 
 309 
 
273 
# Journalisation des usagers "av_bl + av_wl + av" (paquets SYN uniquement). Les autres protocoles sont journalisés en FORWARD par netflow.
 - 
 
274 
# accounting of "av_bl + av_wl + av"  users (only syn packets). Other protocols are logged in FORWARD by netflow
 310 
# accounting of "av_bl + av_wl + av"  users (only syn packets). Other protocols are logged in FORWARD by netflow
275 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
 311 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
276 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
 312 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
277 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
 313 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src ! -d $PRIVATE_IP -p tcp --dport http -m conntrack --ctstate NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT "
278 
 
 314 
 
279 
# Redirection des requêtes HTTP des usagers "av_bl + av_wl + av" vers E2guardian
 - 
 
280 
# Redirect outbound "av_bl + av_wl +av" users HTTP requests to E2guardian
 315 
# Redirect outbound "av_bl + av_wl +av" users HTTP requests to E2guardian
281 
# 8080 = ipset av_bl
 316 
# 8080 = ipset av_bl
282 
#$IPTABLES -A PREROUTING -t mangle -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport http -j MARK --set-mark 200
 317 
#$IPTABLES -A PREROUTING -t mangle -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport http -j MARK --set-mark 200
283 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport http -j REDIRECT --to-port 8080
 318 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport http -j REDIRECT --to-port 8080
284 
# 8081 = ipset av_wl & av
 319 
# 8081 = ipset av_wl & av
285 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8081
 320 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8081
286 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8081
 321 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src ! -d $PRIVATE_IP -p tcp --dport http -j REDIRECT --to-port 8081
287 
 
 322 
 
288 
# Redirection des requêtes HTTPS sortantes des usagers av_bl + av_wl + av vers E2Guardian (in a future version - don't forget to set E2guardian as a tranparent HTTPS proxy)
 - 
 
289 
# Redirect outbound HTTPS requests of av_bl + av_wl + av users to E2Guardian
 323 
# Redirect outbound HTTPS requests of av_bl + av_wl + av users to E2Guardian
290 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
 324 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_bl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
291 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
 325 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av_wl src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
292 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
 326 
#$IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set av src -m set ! --match-set site_direct dst ! -d $PRIVATE_IP  -p tcp --dport https -j REDIRECT --to-port 8443
293 
 
 327 
 
294 
# Redirection des requêtes NTP vers le serveur NTP local
 - 
 
295 
# Redirect NTP request in local NTP server
 328 
# Redirect NTP request in local NTP server
296 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p udp --dport ntp -j REDIRECT --to-port 123
 329 
$IPTABLES -A PREROUTING -t nat -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $PRIVATE_IP -p udp --dport ntp -j REDIRECT --to-port 123
297 
 
 330 
 
298 
#Récupération de la marque associée à une gw pour chaque connection
 331 
# Retrieving the mark associated with a gw for each connection
299 
$IPTABLES -A PREROUTING -t mangle -j CONNMARK --restore-mark
 332 
$IPTABLES -A PREROUTING -t mangle -j CONNMARK --restore-mark
300 
 
 333 
 
301 
if [ "$PROXY" == "on" ] || [ "$PROXY" == "On" ];then
 334 
if [ "$PROXY" == "on" ] || [ "$PROXY" == "On" ];then
302 
	$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p tcp -m multiport --dports http,https -j DNAT --to-destination $PROXY_IP
 335 
	$IPTABLES -A PREROUTING -t nat -i $TUNIF ! -d $PRIVATE_IP -p tcp -m multiport --dports http,https -j DNAT --to-destination $PROXY_IP
303 
fi
 336 
fi
304 
 
 337 
 
305 
#Marquage pour le load balancing
 338 
# Marking for load balancing
306 
if [ "$MULTIWAN" == "on" ] || [ "$MULTIWAN" == "On" ]; then
 339 
if [ "$MULTIWAN" == "on" ] || [ "$MULTIWAN" == "On" ]; then
307 
	temp_index=200
 340 
	temp_index=200
308 
	for i in $gw_list; do
 341 
	for i in $gw_list; do
309 
		$IPTABLES -A PREROUTING -t mangle -i $TUNIF -m set --match-set $i src -j MARK --set-mark $temp_index
 342 
		$IPTABLES -A PREROUTING -t mangle -i $TUNIF -m set --match-set $i src -j MARK --set-mark $temp_index
310 
		temp_index=$(($temp_index+1))
 343 
		temp_index=$(($temp_index+1))
Line 312... Line 345...
312 
fi
 345 
fi
313 
 
 346 
 
314 
#############################
 347 
#############################
315 
#         INPUT             #
 348 
#         INPUT             #
316 
#############################
 349 
#############################
317 
# Tout passe sur loopback
 - 
 
318 
# accept all on loopback
 350 
# Accept all on loopback
319 
$IPTABLES -A INPUT -i lo -j ACCEPT
 351 
$IPTABLES -A INPUT -i lo -j ACCEPT
320 
$IPTABLES -A OUTPUT -o lo -j ACCEPT
 352 
$IPTABLES -A OUTPUT -o lo -j ACCEPT
321 
 
 353 
 
322 
# Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 - 
 
323 
# Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST and NEW not SYN)
 354 
# Drop non-standard connections (FIN-URG-PUSH, XMAS, NullScan, SYN-RST and NEW not SYN)
324 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
 355 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
325 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 356 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
326 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 357 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
327 
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 358 
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
328 
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m conntrack --ctstate NEW -j DROP
 359 
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m conntrack --ctstate NEW -j DROP
329 
 
 360 
 
330 
# Si configuré, on autorise les réponses DHCP sur EXTIF
 - 
 
331 
# If configured, DHCP responses are allowed on EXTIF
 361 
# If configured, DHCP responses are allowed on EXTIF
332 
if [[ "$dhcp_on_extif" == "on" ]]
 362 
if [[ "$dhcp_on_extif" == "on" ]]
333 
then
 363 
then
334 
	$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 68 -j ACCEPT
 364 
	$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 68 -j ACCEPT
335 
	$IPTABLES -A INPUT -i $EXTIF -p udp --dport 68 -j ACCEPT
 365 
	$IPTABLES -A INPUT -i $EXTIF -p udp --dport 68 -j ACCEPT
336 
fi
 366 
fi
337 
 
 367 
 
338 
# On rejette les trame en broadcast et en multicast sur EXTIF (évite leur journalisation)
 - 
 
339 
# Drop broadcast & multicast on EXTIF to avoid log
 368 
# Drop broadcast & multicast on EXTIF to avoid log
340 
$IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
 369 
$IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
341 
 
 370 
 
342 
# On autorise les retours de connexions légitimes par INPUT
 - 
 
343 
# Conntrack on INPUT
 371 
# Conntrack on INPUT
344 
$IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 372 
$IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
345 
 
 373 
 
346 
# On interdit les connexions directes aux ports d'écoute d'E2Guardian. Les packets concernés ont été marqués et loggués dans la table mangle (PREROUTING)
 - 
 
347 
# Deny direct connections on E2Guardian listen ports. The concerned paquets have been marked and logged in mangle table (PREROUTING)
 374 
# Deny direct connections on E2Guardian listen ports. The concerned paquets have been marked and logged in mangle table (PREROUTING)
348 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset # av_bl
 375 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset # av_bl
349 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8081 -m mark --mark 2 -j REJECT --reject-with tcp-reset # av_wl + av
 376 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8081 -m mark --mark 2 -j REJECT --reject-with tcp-reset # av_wl + av
350 
#$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8443 -m mark --mark 6 -j REJECT --reject-with tcp-reset # av_bl + av_wl + av (future version)
 377 
#$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8443 -m mark --mark 6 -j REJECT --reject-with tcp-reset # av_bl + av_wl + av (future version)
351 
 
 378 
 
352 
# On autorise les connexions HTTP/HTTPS légitimes vers E2Guardian
 - 
 
353 
# Allow HTTP connections to E2Guardian
 379 
# Allow HTTP/HTTPS connections to E2Guardian
354 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m conntrack --ctstate NEW --syn -j ACCEPT
 380 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m conntrack --ctstate NEW --syn -j ACCEPT
355 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8081 -m conntrack --ctstate NEW --syn -j ACCEPT
 381 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8081 -m conntrack --ctstate NEW --syn -j ACCEPT
356 
#$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8443 -m conntrack --ctstate NEW --syn -j ACCEPT # (future version)
 382 
#$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8443 -m conntrack --ctstate NEW --syn -j ACCEPT # (future version)
357 
 
 383 
 
358 
# On interdit les connexions directes aux ports d'écoupe DNS (UNBOUND). Les packets concernés ont été marqués dans la table mangle (PREROUTING)
 - 
 
359 
# Deny direct connections to DNS ports (UNBOUND). The concerned paquets are marked in mangle table (PREROUTING)
 384 
# Deny direct connections to DNS ports (UNBOUND). The concerned paquets are marked in mangle table (see PREROUTING)
360 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 54 -m mark --mark 3 -j REJECT --reject-with icmp-port-unreachable
 385 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 54 -m mark --mark 3 -j REJECT --reject-with icmp-port-unreachable
361 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 54 -m mark --mark 3 -j REJECT --reject-with tcp-reset
 386 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 54 -m mark --mark 3 -j REJECT --reject-with tcp-reset
362 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 55 -m mark --mark 4 -j REJECT --reject-with icmp-port-unreachable
 387 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 55 -m mark --mark 4 -j REJECT --reject-with icmp-port-unreachable
363 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 55 -m mark --mark 4 -j REJECT --reject-with tcp-reset
 388 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 55 -m mark --mark 4 -j REJECT --reject-with tcp-reset
364 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 56 -m mark --mark 5 -j REJECT --reject-with icmp-port-unreachable
 389 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 56 -m mark --mark 5 -j REJECT --reject-with icmp-port-unreachable
365 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 56 -m mark --mark 5 -j REJECT --reject-with tcp-reset
 390 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 56 -m mark --mark 5 -j REJECT --reject-with tcp-reset
366 
 
 391 
 
367 
# On autorise les connexion DNS légitime
 - 
 
368 
# Allow DNS connections
 392 
# Allow DNS connections
369 
# ipset = av_bl
 393 
# ipset = av_bl
370 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT
 394 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 54 -j ACCEPT
371 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 54 -j ACCEPT
 395 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 54 -j ACCEPT
372 
# ipset = av_wl
 396 
# ipset = av_wl
Line 374... Line 398...
374 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 55 -j ACCEPT
 398 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 55 -j ACCEPT
375 
# blackall
 399 
# blackall
376 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 56 -j ACCEPT
 400 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport 56 -j ACCEPT
377 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 56 -j ACCEPT
 401 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 56 -j ACCEPT
378 
 
 402 
 
379 
# On accepte l'accès aux services internes
 - 
 
380 
# Internal services access
 403 
# Internal services access
381 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j ACCEPT	# DNS
 404 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j ACCEPT	# DNS
382 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport domain -j ACCEPT	# DNS
 405 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport domain -j ACCEPT	# DNS
383 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 8 -j ACCEPT	# Réponse ping # ping responce
 406 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 8 -j ACCEPT	# Réponse ping # ping responce
384 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 0 -j ACCEPT	# Requête  ping # ping request
 407 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 0 -j ACCEPT	# Requête  ping # ping request
385 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport https -j ACCEPT	# Pages d'authentification et MCC # authentication pages and MCC
 408 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport https -j ACCEPT	# Pages d'authentification et MCC # authentication pages and MCC
386 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport http -j ACCEPT	# Page d'avertissement filtrage # Filtering warning pages
 409 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport http -j ACCEPT	# Page d'avertissement filtrage # Filtering warning pages
387 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 3990:3991 -j ACCEPT	# Requêtes de deconnexion usagers # Users logout requests
 410 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 3990:3991 -j ACCEPT	# Requêtes de deconnexion usagers # Users logout requests
388 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT	# Serveur local de temps # local time server
 411 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT	# Serveur local de temps # local time server
389 
 
 412 
 
390 
# Accès au serveur SSHD si activé en LAN et WAN
 - 
 
391 
# SSHD server access in LAN and WAN if enabled
 413 
# SSHD server access from LAN (and from WAN if enabled)
392 
if [ $SSH_LAN -gt 0 ]
 414 
if [ $SSH_LAN -gt 0 ]
393 
	then
 415 
	then
394 
	$IPTABLES -A INPUT -i $TUNIF -s $SSH_LAN_ADMIN_FROM -d $PRIVATE_IP -p tcp --dport $SSH_LAN -m conntrack --ctstate NEW -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-LAN -- ACCEPT"
 416 
	$IPTABLES -A INPUT -i $TUNIF -s $SSH_LAN_ADMIN_FROM -d $PRIVATE_IP -p tcp --dport $SSH_LAN -m conntrack --ctstate NEW -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-LAN -- ACCEPT"
395 
	$IPTABLES -A INPUT -i $TUNIF -s $SSH_LAN_ADMIN_FROM -d $PRIVATE_IP -p tcp --dport $SSH_LAN -j ACCEPT
 417 
	$IPTABLES -A INPUT -i $TUNIF -s $SSH_LAN_ADMIN_FROM -d $PRIVATE_IP -p tcp --dport $SSH_LAN -j ACCEPT
396 
fi
 418 
fi
Line 398... Line 420...
398 
	then
 420 
	then
399 
	$IPTABLES -A INPUT -i $EXTIF -s $SSH_WAN_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_WAN -m conntrack --ctstate NEW --syn -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-WAN -- ACCEPT"
 421 
	$IPTABLES -A INPUT -i $EXTIF -s $SSH_WAN_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_WAN -m conntrack --ctstate NEW --syn -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-WAN -- ACCEPT"
400 
	$IPTABLES -A INPUT -i $EXTIF -s $SSH_WAN_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_WAN -j ACCEPT
 422 
	$IPTABLES -A INPUT -i $EXTIF -s $SSH_WAN_ADMIN_FROM -d $PUBLIC_IP -p tcp --dport $SSH_WAN -j ACCEPT
401 
fi
 423 
fi
402 
 
 424 
 
403 
# Insertion de règles locales
 - 
 
404 
# Here, we add local rules (i.e. VPN from Internet)
 425 
# Here, we add local rules (i.e. VPN from Internet)
405 
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
 426 
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
406 
	. /usr/local/etc/alcasar-iptables-local.sh
 427 
	. /usr/local/etc/alcasar-iptables-local.sh
407 
fi
 428 
fi
408 
 
 429 
 
409 
# Journalisation et rejet des connexions (autres que celles autorisées) effectuées depuis le LAN
 - 
 
410 
# Deny and log on INPUT from the LAN
 430 
# Deny and log on INPUT from the LAN
411 
$IPTABLES -A INPUT -i $TUNIF -m conntrack --ctstate NEW -j NFLOG --nflog-group 3 --nflog-prefix "RULE rej-int -- REJECT "
 431 
$IPTABLES -A INPUT -i $TUNIF -m conntrack --ctstate NEW -j NFLOG --nflog-group 3 --nflog-prefix "RULE rej-int -- REJECT "
412 
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
 432 
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
413 
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
 433 
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
414 
 
 434 
 
415 
# Interdiction d'accès à INTIF (n'est utile que lorsque chilli est arrêté).
 - 
 
416 
# Reject INTIF access (only when chilli is down)
 435 
# Reject INTIF access (only when chilli is down)
417 
$IPTABLES -A INPUT -i $INTIF -j NFLOG --nflog-group 3 --nflog-prefix "RULE Protect1 -- REJECT "
 436 
$IPTABLES -A INPUT -i $INTIF -j NFLOG --nflog-group 3 --nflog-prefix "RULE Protect1 -- REJECT "
418 
$IPTABLES -A INPUT -i $INTIF -j REJECT
 437 
$IPTABLES -A INPUT -i $INTIF -j REJECT
419 
 
 438 
 
420 
# Journalisation et rejet des connexions initiées depuis le réseau extérieur (test des effets du paramètre --limit en cours)
 - 
 
421 
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
 439 
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
422 
$IPTABLES -A INPUT -i $EXTIF -m conntrack --ctstate NEW -j NFLOG --nflog-group 3 --nflog-threshold 10 --nflog-prefix "RULE rej-ext -- DROP"
 440 
$IPTABLES -A INPUT -i $EXTIF -m conntrack --ctstate NEW -j NFLOG --nflog-group 3 --nflog-threshold 10 --nflog-prefix "RULE rej-ext -- DROP"
423 
 
 441 
 
424 
#############################
 442 
#############################
425 
#        FORWARD            #
 443 
#        FORWARD            #
426 
#############################
 444 
#############################
427 
 
 445 
 
428 
# Blocage des IPs du SET bl_ip_blocked pour le SET av_bl
 - 
 
429 
# Deny IPs of the SET bl_ip_blocked for the set av_bl
 446 
# Deny IPs of the SET bl_ip_blocked for the set av_bl
430 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p icmp -j REJECT --reject-with icmp-host-prohibited
 447 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p icmp -j REJECT --reject-with icmp-host-prohibited
431 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p udp -j REJECT --reject-with icmp-host-prohibited
 448 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p udp -j REJECT --reject-with icmp-host-prohibited
432 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p tcp -j REJECT --reject-with tcp-reset
 449 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_bl src -m set --match-set bl_ip_blocked dst -p tcp -j REJECT --reject-with tcp-reset
433 
 
 450 
 
434 
# Active le suivi de session
 - 
 
435 
# Allow Conntrack
 451 
# Allow Conntrack
436 
$IPTABLES -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 452 
$IPTABLES -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
437 
 
 453 
 
438 
# Compute uamallowed IP (ie : IP address of equipments connected between ALCASAR and router like DMZ, own servers, etc.)
 454 
# Compute uamallowed IP (ie : IP address of equipments connected between ALCASAR and router like DMZ, own servers, etc.)
439 
nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" "  -f1`
 455 
nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" "  -f1`
Line 445... Line 461...
445 
		$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m conntrack --ctstate NEW -j NETFLOW
 461 
		$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m conntrack --ctstate NEW -j NETFLOW
446 
		$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m conntrack --ctstate NEW -j ACCEPT
 462 
		$IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m conntrack --ctstate NEW -j ACCEPT
447 
	done < /usr/local/etc/alcasar-uamallowed
 463 
	done < /usr/local/etc/alcasar-uamallowed
448 
fi
 464 
fi
449 
 
 465 
 
450 
# filtrage protocole par utilisateur (profile 1 : http, https)
 - 
 
451 
# protocols filtering for users (profil 1 : http, https)
 466 
# protocols filtering for users (profil1 = http, https)
452 
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports http,https -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
 467 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p tcp -m set ! --match-set profil1_ports dst -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
453 
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports http,https -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
 468 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_1 src -s $PRIVATE_NETWORK_MASK -p udp -m set ! --match-set profil1_ports dst -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
454 
 
 469 
 
455 
# filtrage protocole par utilisateur (profile 2 : http https smtp pop3 pop3s imap imaps ftp sftp ssh 465+587(smtps))
 - 
 
456 
# protocols filtering for users (profil 2 : http https smtp pop3 pop3s imap imaps ftp sftp ssh 465+587(smtps))
 470 
# protocols filtering for users (profil2 = ftp ftp-data ssh smtp http pop3 ftps imap https smtps(implicit) smtps(explicit) pop3s imaps smtps(explicit bis))
457 
 
 - 
 
458 
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports smtp,http,https,pop3,pop3s,imap,imaps,ftp,ftp-data,sftp,ssh,465,587 -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
 471 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p tcp -m set ! --match-set profil2_ports dst -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
459 
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports smtp,http,https,pop3,pop3s,imap,imaps,ftp,ftp-data,sftp,ssh,465,587 -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
 472 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_2 src -s $PRIVATE_NETWORK_MASK -p udp -m set ! --match-set profil2_ports dst -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
460 
 
 473 
 
461 
# filtrage protocole par utilisateur (profile 3 : personnalisable via l'ACC)
 - 
 
462 
# protocols filtering for users (profil 3 : customized with ACC)
 474 
# protocols filtering for users (profil 3 : customized with ACC)
463 
custom_tcp_protocols_list='';custom_udp_protocols_list=''
 - 
 
464 
while read svc_line
 - 
 
465 
do
 - 
 
466 
	svc_on=`echo $svc_line|cut -b1`
 - 
 
467 
	if [ $svc_on != "#" ]
 - 
 
468 
	then
 - 
 
469 
		svc_name=`echo $svc_line|cut -d" " -f1`
 - 
 
470 
		svc_port=`echo $svc_line|cut -d" " -f2`
 - 
 
471 
		if [ $svc_name = "icmp" ]
 - 
 
472 
		then
 - 
 
473 
			svc_icmp="on"
 - 
 
474 
		else
 - 
 
475 
			if [ "$custom_tcp_protocols_list" == "" ]
 - 
 
476 
			then
 - 
 
477 
				custom_tcp_protocols_list=$svc_port
 - 
 
478 
			else
 - 
 
479 
				custom_tcp_protocols_list=`echo $custom_tcp_protocols_list","$svc_port`
 - 
 
480 
			fi
 - 
 
481 
			udp_svc=`grep -E "[[:space:]]$svc_port/udp" /etc/services|wc -l`
 - 
 
482 
			if [ $udp_svc = "1" ] # udp service exist
 - 
 
483 
			then
 - 
 
484 
				if [ "$custom_udp_protocols_list" == "" ]
 - 
 
485 
				then
 - 
 
486 
					custom_udp_protocols_list=$svc_port
 - 
 
487 
				else
 - 
 
488 
					custom_udp_protocols_list=`echo $custom_udp_protocols_list","$svc_port`
 - 
 
489 
				fi
 - 
 
490 
			fi
 - 
 
491 
		fi
 - 
 
492 
	fi
 - 
 
493 
done < /usr/local/etc/alcasar-services
 - 
 
494 
	if [ "$custom_tcp_protocols_list" == "" ]
 - 
 
495 
	then
 - 
 
496 
		$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -j REJECT
 - 
 
497 
	else
 - 
 
498 
		if [ "$svc_icmp" != "on" ]
 475 
if [ "$svc_icmp" != "on" ]
499 
		then
 476 
then
500 
			$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p icmp -j REJECT --reject-with icmp-proto-unreachable
 477 
	$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p icmp -j REJECT --reject-with icmp-proto-unreachable
501 
		fi
 478 
fi
502 
		$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp -m multiport ! --dports $custom_tcp_protocols_list -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
 479 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p tcp -m set ! --match-set custom_ports dst -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
503 
		$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports $custom_udp_protocols_list -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
 480 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp -m set ! --match-set custom_ports dst -m conntrack --ctstate NEW -j REJECT --reject-with icmp-port-unreachable
504 
	fi
 - 
 
505 
 
 481 
 
506 
# On autorise (ou pas) les utilisateurs à accéder au réseau situé entre ALCASAR et le routeur Internet
 - 
 
507 
# Users are allowed (or not allowed) to access the network between ALCASAR and the Internet router
 482 
# Users are allowed (or not) to access the network between ALCASAR and the Internet router
508 
if [ "$interlan" != "on" ]
 483 
if [ "$interlan" != "on" ]
509 
then
 484 
then
510 
	$IPTABLES -A FORWARD -i $TUNIF -d $public_ip_mask -j DROP
 485 
	$IPTABLES -A FORWARD -i $TUNIF -d $public_ip_mask -j DROP
511 
fi
 486 
fi
512 
 
 487 
 
513 
# Blocage des usagers 'av_wl' cherchant à joindre les IP qui ne sont pas dans la WL
 - 
 
514 
# Block 'av_wl' users who want IP not in the WL
 488 
# Block 'av_wl' users who want IP not in the WL
515 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_wl src -m set ! --match-set wl_ip_allowed dst -j DROP
 489 
$IPTABLES -A FORWARD -i $TUNIF -m set --match-set av_wl src -m set ! --match-set wl_ip_allowed dst -j DROP
516 
 
 490 
 
517 
# journalisation et autorisation des connections sortant du LAN
 - 
 
518 
# Allow forward connections with log
 491 
# Allow forward connections with log
519 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j NETFLOW
 492 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j NETFLOW
520 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j ACCEPT
 493 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m conntrack --ctstate NEW -j ACCEPT
521 
 
 494 
 
522 
#############################
 495 
#############################
523 
#         OUTPUT            #
 496 
#         OUTPUT            #
524 
#############################
 497 
#############################
525 
# On laisse tout sortir sur la carte interne (voir les règles suivantes pour la carte externe)
 - 
 
526 
# We let everything out on INTIF (see following rules for the EXTIF)
 498 
# We let everything out on INTIF (see following rules for the EXTIF)
527 
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
 499 
$IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT
528 
 
 500 
 
529 
# Si configuré, on autorise les requêtes DHCP sur EXTIF
 - 
 
530 
# Allow DHCP requests on EXTIF if configured
 501 
# Allow DHCP requests on EXTIF if configured
531 
if [[ "$dhcp_on_extif" == "on" ]]
 502 
if [[ "$dhcp_on_extif" == "on" ]]
532 
then
 503 
then
533 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport 67 -j ACCEPT
 504 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport 67 -j ACCEPT
534 
	$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport 67 -j ACCEPT
 505 
	$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport 67 -j ACCEPT
535 
fi
 506 
fi
536 
 
 507 
 
537 
# On autorise les requêtes DNS vers les serveurs DNS identifiés
 - 
 
538 
# Allow DNS requests to identified DNS servers
 508 
# Allow DNS requests to identified DNS servers
539 
$IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m conntrack --ctstate NEW -j ACCEPT
 509 
$IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m conntrack --ctstate NEW -j ACCEPT
540 
 
 510 
 
541 
# On autorise les requêtes HTTP et HTTPS avec log Netflow (en provenance de E2guardian)
 - 
 
542 
# HTTP & HTTPS requests are allowed with netflow log (from E2guardian)
 511 
# HTTP & HTTPS requests are allowed with netflow log (from E2guardian)
543 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j NETFLOW
 512 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j NETFLOW
544 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j ACCEPT
 513 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport http -j ACCEPT
545 
#$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport https -j NETFLOW # When E2guardian will be in HTTPS transparent proxy)
 514 
#$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport https -j NETFLOW # When E2guardian will be in HTTPS transparent proxy)
546 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport https -j ACCEPT
 515 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport https -j ACCEPT
547 
 
 516 
 
548 
# On autorise les requêtes RSYNC sortantes (maj BL de Toulouse)
 - 
 
549 
# RSYNC requests are allowed (update of Toulouse BL)
 517 
# RSYNC requests are allowed (update of Toulouse BL)
550 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport rsync -j ACCEPT
 518 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport rsync -j ACCEPT
551 
 
 519 
 
552 
# On autorise les requêtes FTP
 - 
 
553 
# FTP requests are allowed
 520 
# FTP requests are allowed
554 
# modprobe nf_conntrack_ftp # no more needed with kernel > 5.15.85
 521 
# modprobe nf_conntrack_ftp # no more needed with kernel > 5.15.85
555 
# $IPTABLES -t raw -A OUTPUT -p tcp --dport ftp -j CT --helper ftp # no more needed with kernel > 5.15.85
 522 
# $IPTABLES -t raw -A OUTPUT -p tcp --dport ftp -j CT --helper ftp # no more needed with kernel > 5.15.85
556 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport ftp -j ACCEPT
 523 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport ftp -j ACCEPT
557 
$IPTABLES -A OUTPUT -o $EXTIF -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 524 
$IPTABLES -A OUTPUT -o $EXTIF -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
558 
 
 525 
 
559 
# On autorise les requêtes NTP
 - 
 
560 
# NTP requests are allowed
 526 
# NTP requests are allowed
561 
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT
 527 
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT
562 
 
 528 
 
563 
# On autorise les requêtes ICMP (ping)
 - 
 
564 
# ICMP (ping) requests are allowed
 529 
# ICMP (ping) requests are allowed
565 
$IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT
 530 
$IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT
566 
 
 531 
 
567 
# On autorise les requêtes LDAP
 - 
 
568 
# LDAP requests are allowed
 532 
# LDAP requests are allowed
569 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp -m multiport --dports ldap,ldaps -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 533 
$IPTABLES -A OUTPUT -o $EXTIF -p tcp -m multiport --dports ldap,ldaps -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
570 
$IPTABLES -A OUTPUT -o $EXTIF -p udp -m multiport --dports ldap,ldaps -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
 534 
$IPTABLES -A OUTPUT -o $EXTIF -p udp -m multiport --dports ldap,ldaps -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
571 
 
 535 
 
572 
#############################
 536 
#############################
573 
#       POSTROUTING         #
 537 
#       POSTROUTING         #
574 
#############################
 538 
#############################
575 
# Traduction dynamique d'adresse en sortie
 - 
 
576 
# Dynamic NAT on EXTIF
 539 
# Dynamic NAT on EXTIF
577 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
 540 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
578 
 
 541 
 
579 
#Sauvegarde de la marque associée à la connexion pour le load balancing
 542 
# Saving the load balancing mark
580 
$IPTABLES -A POSTROUTING -t mangle -j CONNMARK --save-mark
 543 
$IPTABLES -A POSTROUTING -t mangle -j CONNMARK --save-mark
581 
 
 544 
 
582 
#############################
 545 
#############################
583 
#          FAIL2BAN         #
 546 
#          FAIL2BAN         #
584 
#############################
 547 
#############################