Subversion Repositories ALCASAR

Rev

Rev 848 | Rev 871 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 848 Rev 859
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
# $Id: alcasar-iptables.sh 848 2012-04-03 17:43:10Z franck $
 2 
# $Id: alcasar-iptables.sh 859 2012-04-19 22:21:31Z richard $
3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# This script write the netfilter rules for ALCASAR
 4 
# This script write the netfilter rules for ALCASAR
5 
# Rexy - 3abtux - CPN
 5 
# Rexy - 3abtux - CPN
6 
#
 6 
#
7 
# Reminders
 7 
# Reminders
Line 25... Line 25...
25 
dns2=`grep DNS2= $conf_file|cut -d"=" -f2`				# second public DNS server
 25 
dns2=`grep DNS2= $conf_file|cut -d"=" -f2`				# second public DNS server
26 
dns2=${dns2:=208.67.222.222}
 26 
dns2=${dns2:=208.67.222.222}
27 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
 27 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
28 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
 28 
PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`	# Network protocols filter (on/off)
29 
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
 29 
PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
30 
EXT_LAN_FILTERING=`grep EXT_LAN_FILTERING= $conf_file|cut -d"=" -f2`	# filter acces to the lan on alcasar/eth0 (on/off)
 - 
 
31 
EXT_LAN_FILTERING=${EXT_LAN_FILTERING:=off}
 - 
 
32 
DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
 30 
DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`		# DNS and URLs filter (on/off)
33 
DNS_FILTERING=${DNS_FILTERING:=off}
 31 
DNS_FILTERING=${DNS_FILTERING:=off}
34 
QOS=`grep QOS= $conf_file|cut -d"=" -f2`				# QOS (on/off)
 32 
QOS=`grep QOS= $conf_file|cut -d"=" -f2`				# QOS (on/off)
35 
QOS=${QOS:=off}
 33 
QOS=${QOS:=off}
36 
SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
 34 
SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
Line 114... Line 112...
114 
#############################
 112 
#############################
115 
# Tout passe sur loopback
 113 
# Tout passe sur loopback
116 
# accept all on loopback
 114 
# accept all on loopback
117 
$IPTABLES -A INPUT -i lo -j ACCEPT
 115 
$IPTABLES -A INPUT -i lo -j ACCEPT
118 
 
 116 
 
119 
# Insertion de règles de blocage (Devel)
 - 
 
120 
# Here, we add block rules (Devel)
 - 
 
121 
if [ -s /usr/local/etc/alcasar-iptables-block ]; then
- 
 
122 
    while read ip_blocked
 - 
 
123 
    do
 - 
 
124 
      echo "Network Address blocked : $ip_blocked"
 - 
 
125 
      $IPTABLES -A FORWARD -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
 - 
 
126 
      $IPTABLES -A FORWARD -d $ip_blocked -j REJECT
 - 
 
127 
      $IPTABLES -A FORWARD -s $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
 - 
 
128 
      $IPTABLES -A FORWARD -s $ip_blocked -j REJECT
 - 
 
129 
    done < /usr/local/etc/alcasar-iptables-block
 - 
 
130 
fi
 - 
 
131 
 
 117 
 
132 
# Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 118 
# Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
133 
# Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 119 
# Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
134 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
 120 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
135 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 121 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
Line 147... Line 133...
147 
 
 133 
 
148 
# On interdit les connexions directes au port utilisé par DansGuardian (8080). Les packets concernés ont été marqués dans la table mangle (PREROUTING)
 134 
# On interdit les connexions directes au port utilisé par DansGuardian (8080). Les packets concernés ont été marqués dans la table mangle (PREROUTING)
149 
# Deny direct connections on DansGuardian port (8080). The concerned paquets are marked in mangle table (PREROUTING)
 135 
# Deny direct connections on DansGuardian port (8080). The concerned paquets are marked in mangle table (PREROUTING)
150 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset
 136 
$IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset
151 
 
 137 
 
152 
# Filtrage de l'accès au LAN connecté sur EXTIF (eth0)
 138 
# Insertion des règles de blocage IP
153 
# EXTIF (eth0) connected LAN filtering
 139 
# Here, we add IP block rules
154 
if [ $EXT_LAN_FILTERING = on ]; then
 140 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
- 
 
 141 
	while read ip_line
- 
 
 142 
	do
- 
 
 143 
		ip_on=`echo $ip_line|cut -b1`
- 
 
 144 
		if [ $ip_on != "#" ]
- 
 
 145 
		then
- 
 
 146 
			ip_blocked=`echo $ip_line|cut -d" " -f1`
- 
 
 147 
			$IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
155 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $public_ip_mask -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
 148 
			$IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j REJECT
156 
else
 149 
		fi
- 
 
 150 
	done < /usr/local/etc/alcasar-ip-blocked
- 
 
 151 
fi
157 
# Autorisation des connexions légitimes à DansGuardian
152 
# Autorisation des connexions légitimes à DansGuardian
158 
# Allow connections for DansGuardian
 153 
# Allow connections for DansGuardian
159 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
 154 
$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
160 
fi
 - 
 
161 
 
 155 
 
162 
# On interdit les connexions directes au port UDP 54. Les packets concernés ont été marqués dans la table mangle (PREROUTING)
 156 
# On interdit les connexions directes au port UDP 54. Les packets concernés ont été marqués dans la table mangle (PREROUTING)
163 
# Deny direct connections on UDP 54. The concerned paquets are marked in mangle table (PREROUTING)
 157 
# Deny direct connections on UDP 54. The concerned paquets are marked in mangle table (PREROUTING)
164 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 54 -m mark --mark 2 -j REJECT --reject-with icmp-port-unreachable
 158 
$IPTABLES -A INPUT -i $TUNIF -p udp --dport 54 -m mark --mark 2 -j REJECT --reject-with icmp-port-unreachable
165 
 
 159 
 
Line 214... Line 208...
214 
# Rejet des requêtes DNS vers Internet
 208 
# Rejet des requêtes DNS vers Internet
215 
# Deny forward DNS
 209 
# Deny forward DNS
216 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
 210 
$IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
217 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
 211 
$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
218 
 
 212 
 
219 
# Filtrage de l'accès au LAN connecté sur EXTIF (eth0)
 213 
# Insertion des règles de blocage IP
220 
# EXTIF (eth0) connected LAN filtering
 214 
# Here, we add IP block rules
221 
if [ $EXT_LAN_FILTERING = on ]; then
 215 
if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
- 
 
 216 
	while read ip_line
- 
 
 217 
	do
- 
 
 218 
		ip_on=`echo $ip_line|cut -b1`
- 
 
 219 
		if [ $ip_on != "#" ]
- 
 
 220 
		then
- 
 
 221 
			ip_blocked=`echo $ip_line|cut -d" " -f1`
- 
 
 222 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
222 
$IPTABLES -A FORWARD -i $TUNIF -p udp -d $public_ip_mask -j REJECT --reject-with icmp-port-unreachable
 223 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p udp -j REJECT --reject-with icmp-port-unreachable
223 
$IPTABLES -A FORWARD -i $TUNIF -p icmp -d $public_ip_mask -j REJECT --reject-with icmp-port-unreachable
 224 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p icmp -j REJECT --reject-with icmp-port-unreachable
224 
$IPTABLES -A FORWARD -i $TUNIF -p tcp -d $public_ip_mask -j REJECT --reject-with tcp-reset
 225 
			$IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
- 
 
 226 
		fi
- 
 
 227 
	done < /usr/local/etc/alcasar-ip-blocked
225 
fi
 228 
fi
- 
 
 229 
 
226 
# Autorisation des retours de connexions légitimes
 230 
# Autorisation des retours de connexions légitimes
227 
# Allow conntrack
 231 
# Allow conntrack
228 
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 232 
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
229 
 
 233 
 
230 
#  If protocols filter is activate
234 
#  If protocols filter is activate
Line 259... Line 263...
259 
		then
263 
		then
260 
			svc_name=`echo $svc_line|cut -d" " -f1`
 264 
			svc_name=`echo $svc_line|cut -d" " -f1`
261 
			svc_port=`echo $svc_line|cut -d" " -f2`
 265 
			svc_port=`echo $svc_line|cut -d" " -f2`
262 
			if [ $svc_name = "icmp" ]
 266 
			if [ $svc_name = "icmp" ]
263 
			then
 267 
			then
264 
				$IPTABLES -A FORWARD -i $TUNIF -p icmp -j ACCEPT
268 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp -j ACCEPT
265 
			else
 269 
			else
266 
				$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
 270 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
267 
				$IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
 271 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
268 
				$IPTABLES -A FORWARD -i $TUNIF -p udp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
 272 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
269 
				$IPTABLES -A FORWARD -i $TUNIF -p udp --dport $svc_port -m state --state NEW -j ACCEPT
 273 
				$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ACCEPT
270 
			fi
 274 
			fi
271 
		fi
 275 
		fi
272 
	done < /usr/local/etc/alcasar-services
 276 
	done < /usr/local/etc/alcasar-services
273 
	# Rejet explicite des autres protocoles
 277 
	# Rejet explicite des autres protocoles
274 
	# reject the others protocols
 278 
	# reject the others protocols
Line 283... Line 287...
283 
	. /usr/local/etc/alcasar-iptables-qos.sh
287 
	. /usr/local/etc/alcasar-iptables-qos.sh
284 
fi
 288 
fi
285 
 
 289 
 
286 
# Autorisation des connections sortant du LAN
290 
# Autorisation des connections sortant du LAN
287 
# Allow forward connections with log
 291 
# Allow forward connections with log
288 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
 292 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
289 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
 293 
$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
290 
 
 294 
 
291 
#############################
 295 
#############################
292 
#         OUTPUT            #
 296 
#         OUTPUT            #
293 
#############################
 297 
#############################
294 
# SSHD rules if activate
298 
# SSHD rules if activate