Subversion Repositories ALCASAR

Rev

Rev 520 | Rev 573 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 520 Rev 568
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
# $Id: alcasar-iptables.sh 520 2011-03-27 20:55:05Z richard $
 2 
# $Id: alcasar-iptables.sh 568 2011-04-10 21:11:27Z richard $
3 
# script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
- 
 
 4 
# This script write the netfilter rules for ALCASAR
4 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
5 
# there are three channels for log :
 6 
# There are three channels for log :
6 
#	1 (default) for tracability;
 7 
#	1 (default) for tracability;
7 
#	2 for secure admin (ssh);
 8 
#	2 for secure admin (ssh);
8 
#	3 for exterior access attempts.
 9 
#	3 for exterior access attempts.
- 
 
 10 
# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
9 
 
 11 
 
10 
IPTABLES="/sbin/iptables"
 12 
IPTABLES="/sbin/iptables"
11 
PROTO_FILTERING="no"
 13 
PROTO_FILTERING="no"
12 
DNS_FILTERING="no"
 14 
DNS_FILTERING="no"
13 
QOS="no"
 15 
QOS="no"
Line 237... Line 239...
237 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
 239 
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE
238 
 
 240 
 
239 
# Save all rules
 241 
# Save all rules
240 
/etc/init.d/iptables save
 242 
/etc/init.d/iptables save
241 
 
 243 
 
242 
# no martians log (for mdv2009 only)
 - 
 
243 
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
 - 
 
244 
 
 - 
 
245 
# End of script
 244 
# End of script
246 
 
 245