Firewall-SOSDG/rc.firewall

566 lines
17 KiB
Plaintext
Raw Normal View History

2010-07-26 09:09:39 -06:00
#/bin/sh
2010-08-23 17:52:12 -06:00
# v0.9.5
2009-08-13 13:53:20 -06:00
# By Brielle Bruns <bruns@2mbit.com>
2009-08-13 17:13:29 -06:00
# URL: http://www.sosdg.org/freestuff/firewall
# License: GPLv3
2010-07-26 09:35:48 -06:00
#
# Copyright (C) 2009 - 2010 Brielle Bruns
# Copyright (C) 2009 - 2010 The Summit Open Source Development Group
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
2010-08-23 17:52:12 -06:00
FW_VERSION="0.9.5 BETA"
2010-08-23 15:39:19 -06:00
2010-08-25 12:00:48 -06:00
# These option is here to help pre-1.0 users easily upgrade, defines critical defaults
# that would otherwise require remaking their options file. I leave this on by default,
# but if you want to make sure you have a current options file, define this to 0.
COMPAT_CONFIG=1
2010-08-23 15:39:19 -06:00
BASEDIR=/etc/firewall-sosdg
#BASEDIR=`pwd`
TWEAKS=$BASEDIR/tweaks
2010-08-25 11:56:18 -06:00
if [ ! -r $BASEDIR/include/static ] || [ ! -r $BASEDIR/include/functions ]; then
echo "Error: Missing either include/static or include/functions. These are critical to operation"
echo "of this script. Please make sure they are readable and exist!"
exit 1
fi
2010-08-23 15:36:08 -06:00
. $BASEDIR/include/static
2010-08-25 11:56:18 -06:00
if [ -r $BASEDIR/options ]; then
. $BASEDIR/options
else
echo -e "${RED}Error: Can not load options file. Did you forget to rename options.default?"
exit 1
fi
2010-08-23 15:36:08 -06:00
. $BASEDIR/include/functions
while [ $# -gt 0 ]; do
case "$1" in
-f|--flush)
iptables_policy_reset ipv4 ACCEPT
iptables_policy_reset ipv6 ACCEPT
iptables_rules_flush ipv4
iptables_rules_flush ipv6
2010-08-23 15:57:03 -06:00
exit 0
2010-08-23 15:36:08 -06:00
;;
-h|--help)
show_help
2010-08-23 15:37:48 -06:00
exit 0
2010-08-23 15:36:08 -06:00
;;
esac
shift
done
2010-07-26 09:35:48 -06:00
echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
2010-08-23 15:36:08 -06:00
Firewall/SOSDG ${FW_VERSION}
2010-07-26 09:35:48 -06:00
Brielle Bruns <bruns@2mbit.com>
http://www.sosdg.org/freestuff/firewall
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to
redistribute it under certain conditions.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-="
2010-06-21 22:49:41 -06:00
2010-08-25 11:43:57 -06:00
if [ $UID != "0" ]; then
display_c RED "You must be root to run this script."
exit 2
fi
if [ ! -x $IPTABLES ]; then
display_c RED "iptables command not found. Please make sure you have the iptables"
display_c RED "installed (package or source) and you have the IPTABLES option properly"
display_c RED "defined in the 'options' file."
exit 3
fi
if [ ! -x $IP6TABLES ] && [ $IPV6 == "1" ]; then
display_c RED "ip6tables command not found. Please make sure you have the iptables"
display_c RED "installed (package or source) and you have the IP6TABLES option properly"
display_c RED "defined in the 'options' file."
exit 3
fi
2010-08-21 20:38:19 -06:00
2010-08-23 15:39:51 -06:00
iptables_rules_flush ipv4
2010-08-20 13:21:10 -06:00
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_flush" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Loading custom flush rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv4_custom_flush"
fi
2009-08-13 13:53:20 -06:00
2009-08-19 15:10:47 -06:00
$BASEDIR/prerun
2009-08-13 13:53:20 -06:00
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_trust" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Loading custom trust rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv4_custom_trust"
fi
2009-08-13 13:53:20 -06:00
2010-06-21 22:49:41 -06:00
if [ "$TRUSTEDIP" ]; then
2010-08-20 13:24:40 -06:00
display_c YELLOW "Adding trusted IP: " N
2010-06-21 22:49:41 -06:00
for i in $TRUSTEDIP; do
echo -n "$i "
$IPTABLES -A INPUT -s $i -j ACCEPT
$IPTABLES -A OUTPUT -d $i -j ACCEPT
done
echo -ne "\n"
fi
2009-08-29 18:52:40 -06:00
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_blockip" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Loading custom ip block rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_blockip"
fi
2009-08-29 18:52:40 -06:00
if [ $BLOCKEDIP ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Adding blocked IPs: " N
2009-08-29 18:52:40 -06:00
for i in `grep -v "\#" $BLOCKEDIP`; do
2009-08-29 18:57:39 -06:00
echo -n "$i "
2009-08-29 18:54:17 -06:00
$IPTABLES -A INPUT -s $i -j DROP
$IPTABLES -A OUTPUT -d $i -j DROP
2009-08-29 18:52:40 -06:00
done
echo -ne "\n"
2009-08-29 18:57:39 -06:00
fi
2009-08-29 18:52:40 -06:00
2010-06-19 15:41:27 -06:00
if [ "$STRIPECN" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Stripping ECN off of TCP packets to " N
2010-06-19 15:41:27 -06:00
for i in $STRIPECN; do
2010-06-21 22:34:28 -06:00
echo -en "$i "
2010-06-19 15:41:27 -06:00
$IPTABLES -A PREROUTING -t mangle -p tcp -d $i -j ECN \
2010-06-19 15:44:54 -06:00
--ecn-tcp-remove
2010-06-19 15:41:27 -06:00
done
2010-06-21 22:45:40 -06:00
echo -ne "\n"
2010-06-19 15:41:27 -06:00
fi
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_mssclamp" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Loading custom MSS Clamp rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_mssclamp"
fi
2010-05-15 11:29:54 -06:00
if [ "$CLAMPMSS" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Clamping MSS to PMTU..."
2010-05-15 11:07:40 -06:00
for i in $CLAMPMSS; do
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
2010-05-15 11:10:59 -06:00
--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
2010-05-15 11:07:40 -06:00
$IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
2010-05-15 11:10:59 -06:00
--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
2010-05-15 11:07:40 -06:00
# This is necessary to make sure that PMTU works
$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded \
-o $i -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded \
-i $i -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
-o $i -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed \
-i $i -j ACCEPT
done
2009-08-13 16:11:39 -06:00
echo -en "\n"
2010-06-21 22:45:40 -06:00
fi
2009-08-13 13:53:20 -06:00
2010-08-23 19:35:36 -06:00
if [ $HACK_IPV4 ]; then
apply_ipv4_hack $HACK_IPV4
fi
2009-08-13 13:53:20 -06:00
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_conntrack" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Loading custom conntrack rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_conntrack"
fi
2009-08-24 21:51:41 -06:00
if [ $CONNTRACK ]; then
2010-07-14 21:56:14 -06:00
$IPTABLES -A INPUT -m state --state NEW -j ACCEPT
2009-08-24 21:51:41 -06:00
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
2010-07-14 21:39:40 -06:00
$IPTABLES -A FORWARD -m state --state NEW -j ACCEPT
2009-08-24 21:51:41 -06:00
$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state NEW -j ACCEPT
2010-07-14 22:03:28 -06:00
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP
$IPTABLES -A FORWARD -m state --state INVALID -j DROP
2009-08-24 21:51:41 -06:00
fi
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_blockoutports" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Loading custom blocked outbound port rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv4_custom_blockoutports"
2010-07-14 22:55:09 -06:00
fi
2010-06-21 22:34:28 -06:00
if [ "$BLOCKTCPPORTS" ] || [ "$BLOCKUDPPORTS" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Blocking outbound port: " N
2009-08-13 13:53:20 -06:00
2010-06-21 22:34:28 -06:00
if [ "$BLOCKTCPPORTS" ]; then
for i in $BLOCKTCPPORTS; do
2010-08-21 20:23:51 -06:00
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
$IPTABLES -A OUTPUT -p tcp --dport $i --syn -j DROP
2010-06-21 23:21:54 -06:00
if [ "$NATRANGE" ]; then
2010-06-21 23:27:02 -06:00
for src in $NATRANGE; do
$IPTABLES -A FORWARD -p tcp -s $src --dport $i --syn -j DROP
2010-06-21 23:21:54 -06:00
done
fi
2010-06-21 22:34:28 -06:00
done
fi
if [ "$BLOCKUDPPORTS" ]; then
for i in $BLOCKUDPPORTS; do
2010-08-21 20:23:51 -06:00
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
$IPTABLES -A OUTPUT -p udp --dport $i -j DROP
2010-06-21 23:21:54 -06:00
if [ "$NATRANGE" ]; then
2010-06-21 23:27:02 -06:00
for src in $NATRANGE; do
$IPTABLES -A FORWARD -p udp -s $src --dport $i -j DROP
2010-06-21 23:21:54 -06:00
done
fi
2010-06-21 22:34:28 -06:00
done
fi
2010-08-21 11:18:40 -06:00
reset_color
2010-06-21 22:34:28 -06:00
fi
2009-08-13 13:53:20 -06:00
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_allowedports" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Loading custom allowed port rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_allowedports"
fi
2010-06-21 22:34:28 -06:00
if [ "$TCPPORTS" ] || [ "$UDPPORTS" ]; then
2010-08-20 13:33:45 -06:00
display_c YELLOW "Adding allowed port: " N
2010-06-21 22:34:28 -06:00
if [ "$TCPPORTS" ]; then
for i in $TCPPORTS; do
2010-08-21 20:28:16 -06:00
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
$IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT
done
fi
if [ "$UDPPORTS" ]; then
for i in $UDPPORTS; do
2010-08-21 20:28:16 -06:00
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
#$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT
$IPTABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
$IPTABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
$IPTABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
done
fi
2010-08-20 13:47:42 -06:00
reset_color
2010-06-21 22:34:28 -06:00
fi
2009-08-13 13:53:20 -06:00
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_proto" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom protocol rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_proto"
fi
2010-06-21 22:34:28 -06:00
if [ "$ALLOWEDPROTO" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Adding allowed protocols: " N
2010-06-21 22:34:28 -06:00
for i in $ALLOWEDPROTO; do
echo -n "$i "
$IPTABLES -A INPUT -p $i -j ACCEPT
$IPTABLES -A OUTPUT -p $i -j ACCEPT
done
2010-08-20 13:47:42 -06:00
reset_color
2010-06-21 22:34:28 -06:00
fi
2009-08-13 13:53:20 -06:00
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_notrack" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom NOTRACK rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_notrack"
fi
2009-08-13 13:53:20 -06:00
if [ $CONNTRACK ]; then
for i in $DONTTRACK; do
$IPTABLES -t raw -I PREROUTING -s $i -j NOTRACK
$IPTABLES -t raw -I PREROUTING -d $i -j NOTRACK
$IPTABLES -t raw -I OUTPUT -s $i -j NOTRACK
$IPTABLES -t raw -I OUTPUT -d $i -j NOTRACK
done
fi
2009-08-13 16:26:44 -06:00
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_routing" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom routing rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_routing"
fi
2009-08-13 15:56:21 -06:00
if [ $ROUTING ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Adding route: " N
2009-08-13 15:56:21 -06:00
for i in `grep -v "\#" $ROUTING`; do
ROUTE=( ${i//:/ } )
2009-08-13 16:16:53 -06:00
FWINT1=${ROUTE[0]}
FWINT2=${ROUTE[2]}
FWIP1=${ROUTE[1]}
FWIP2=${ROUTE[3]}
2010-06-21 22:43:58 -06:00
if [ -e "/proc/sys/net/ipv4/conf/$FWINT1/forwarding" ]; then
echo 1 > /proc/sys/net/ipv4/conf/$FWINT1/forwarding
fi
if [ -e "/proc/sys/net/ipv4/conf/$FWINT2/forwarding" ]; then
echo 1 > /proc/sys/net/ipv4/conf/$FWINT2/forwarding
fi
2009-08-13 16:21:23 -06:00
$IPTABLES -A FORWARD -i $FWINT1 -o $FWINT2 \
-s $FWIP1 -d $FWIP2 -j ACCEPT
2009-08-13 16:06:17 -06:00
if [ ${ROUTE[4]} == "1" ]; then
2010-08-21 20:28:16 -06:00
#echo -en "\E[35m$FWINT1\E[37m:$FWIP1<->\E[34m$FWINT2\E[37m:$FWIP2 "
echo -en "${PURPLE}$FWINT1:$FWIP1${AQUA}<->${BLUE}$FWINT2:$FWIP2 "
2009-08-13 16:16:53 -06:00
$IPTABLES -A FORWARD -o $FWINT1 -i $FWINT2 \
-d $FWIP1 -s $FWIP2 -j ACCEPT
2009-08-13 16:06:17 -06:00
else
2010-08-21 20:34:13 -06:00
echo -en "${PURPLE}$FWINT1:$FWIP1${AQUA}->${BLUE}$FWINT2:$FWIP2 "
2009-08-13 16:06:17 -06:00
fi
2009-08-13 13:53:20 -06:00
done
2010-06-21 22:34:28 -06:00
echo -ne "\n"
2009-08-13 13:53:20 -06:00
fi
2009-08-13 16:26:44 -06:00
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_portforward" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom port forwarding rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_portforward"
fi
if [ $PORTFW ] && [ $NAT ]; then
2010-08-26 15:57:12 -06:00
display_c YELLOW "Adding port forward for:"
for i in `grep -v "\#" $PORTFW`; do
PORTADD=( ${i//:/ } )
2010-08-26 15:57:12 -06:00
$IPTABLES -A PREROUTING -t nat -i ${PORTADD[0]} -p ${PORTADD[4]} -s ${PORTADD[1]} \
--dport ${PORTADD[3]} -d ${PORTADD[2]} -j DNAT --to \
${PORTADD[5]}:${PORTADD[6]}
$IPTABLES -A INPUT -p ${PORTADD[4]} -m state --state NEW -s ${PORTADD[1]} \
--dport ${PORTADD[3]} -d ${PORTADD[2]} -i ${PORTADD[0]} -j ACCEPT
display_c DEFAULT "\t${GREEN}${PORTADD[0]}:${BLUE}${PORTADD[1]}:${PURPLE}${PORTADD[2]}:${PORTADD[3]}:${PORTADD[4]}${AQUA}->${BLUE}${PORTADD[5]}:${PORTADD[6]} "
done
2010-08-21 11:32:08 -06:00
reset_color
fi
2009-08-13 15:12:04 -06:00
if [ $LANDHCPSERVER ]; then
2010-08-21 10:54:46 -06:00
#$IPTABLES -A INPUT -i $INTIF -s 0.0.0.0 -j ACCEPT
$IPTABLES -I INPUT -i $INTIF -p udp --dport 67:68 --sport \
67:68 -j ACCEPT
2009-08-13 15:12:04 -06:00
fi
2009-08-16 19:44:42 -06:00
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_nat" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom nat rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_nat"
fi
2010-05-15 11:07:40 -06:00
2009-08-13 13:53:20 -06:00
if [ $NAT ]; then
2010-08-21 11:20:53 -06:00
if [ "$NAT_RANGE" ]; then
2010-08-21 10:54:46 -06:00
display_c YELLOW "Adding NAT rule: " N
2010-08-21 11:20:53 -06:00
for i in $NAT_RANGE; do
2010-08-21 10:54:46 -06:00
NAT_RULE=( ${i//:/ } )
2010-08-21 11:07:07 -06:00
case ${NAT_RULE[0]} in
2010-08-21 10:54:46 -06:00
SNAT)
2010-08-21 11:10:19 -06:00
$IPTABLES -A POSTROUTING -t nat -s ${NAT_RULE[2]} -j SNAT \
2010-08-21 11:00:41 -06:00
-o ${NAT_RULE[3]} --to-source ${NAT_RULE[4]}
2010-08-21 20:34:13 -06:00
echo -en "${GREEN}SNAT:${PURPLE}${NAT_RULE[1]}:${NAT_RULE[2]}${AQUA}->${BLUE}${NAT_RULE[3]}:${NAT_RULE[4]} "
2010-08-21 11:18:40 -06:00
$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed -o ${NAT_RULE[3]} -j ACCEPT
2010-08-21 10:54:46 -06:00
;;
MASQ)
2010-08-21 11:18:40 -06:00
$IPTABLES -A POSTROUTING -t nat -s ${NAT_RULE[2]} -j MASQUERADE -o ${NAT_RULE[3]}
2010-08-21 20:34:13 -06:00
echo -en "${GREEN}MASQ:${PURPLE}${NAT_RULE[2]}${AQUA}->${BLUE}${NAT_RULE[3]} "
2010-08-21 11:18:40 -06:00
$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed -o ${NAT_RULE[3]} -j ACCEPT
2010-08-21 10:54:46 -06:00
;;
*) display_c RED "Invalid NAT rule in NAT_RANGE" ;;
esac
done
2010-08-21 11:20:53 -06:00
reset_color
2010-08-21 11:50:39 -06:00
fi
2010-08-21 10:54:46 -06:00
#=================
# This section is going away in 1.0
2010-08-21 11:50:39 -06:00
if [ "$NATRANGE" ]; then
2010-08-21 20:49:41 -06:00
echo -e "${RED} **** WARNING ****"
echo -e "${RED} NATRANGE option detected. Please switch to using"
echo -e "${RED} NAT_RANGE which uses the newer style NAT mappings."
echo -e "${RED} NATRANGE will be removed in v1.0"
2010-08-21 11:50:39 -06:00
for i in $NATRANGE; do
$IPTABLES -A POSTROUTING -t nat -s $i -o $NATEXTIF -j SNAT --to-source $NATEXTIP
done
#This is necessary to make sure that PMTU works
$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o $NATEXTIF \
-j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
-o $NATEXTIF -j ACCEPT
2010-08-21 10:54:46 -06:00
#=================
2010-08-21 11:50:39 -06:00
fi
2009-08-13 13:53:20 -06:00
fi
$IPTABLES --policy INPUT ACCEPT
$IPTABLES --policy OUTPUT ACCEPT
$IPTABLES --policy FORWARD DROP
2010-07-14 22:55:09 -06:00
if [ -s "$BASEDIR/include/ipv4_custom_blockincoming" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom incoming blocked rules..."
2010-07-14 22:55:09 -06:00
. "$BASEDIR/include/ipv4_custom_blockincoming"
fi
2009-08-13 13:53:20 -06:00
if [ $BLOCKINCOMING ]; then
$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -A INPUT -p udp -j DROP
fi
#================[IPv6]================
if [ $IPV6 ]; then
2010-08-24 11:46:47 -06:00
iptables_rules_flush ipv6
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_flush" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 flush rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_flush"
fi
2009-08-13 13:53:20 -06:00
2010-08-20 13:47:42 -06:00
display_c YELLOW "Adding trusted IPv6: " N
2009-08-13 13:53:20 -06:00
$IP6TABLES -A INPUT -i lo -j ACCEPT
$IP6TABLES -A OUTPUT -o lo -j ACCEPT
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_trust" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 trust rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_trust"
fi
2009-08-13 13:53:20 -06:00
for i in $IPV6TRUSTED; do
echo -n "$i "
$IP6TABLES -A INPUT -s $i -j ACCEPT
$IP6TABLES -A OUTPUT -d $i -j ACCEPT
done
2010-08-20 13:47:42 -06:00
reset_color
2009-08-13 13:53:20 -06:00
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_mssclamp" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 MSS Clamp rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_mssclamp"
fi
2010-05-15 11:07:40 -06:00
2010-05-15 11:29:54 -06:00
if [ "$CLAMPMSSIPV6" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Clamping IPV6 MSS to PMTU..."
2010-05-15 11:23:16 -06:00
for i in $CLAMPMSSIPV6; do
2010-05-15 11:15:39 -06:00
$IP6TABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
2010-05-15 11:25:10 -06:00
--mss 1280:1536
2010-05-15 11:15:39 -06:00
$IP6TABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
2010-05-15 11:25:10 -06:00
--mss 1280:1536
2010-05-15 11:15:39 -06:00
# This is necessary to make sure that PMTU works
2010-05-15 11:20:07 -06:00
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded \
2010-05-15 11:15:39 -06:00
-o $i -j ACCEPT
2010-05-15 11:20:07 -06:00
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type time-exceeded \
2010-05-15 11:15:39 -06:00
-i $i -j ACCEPT
2010-05-15 11:20:07 -06:00
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big \
2010-05-15 11:15:39 -06:00
-o $i -j ACCEPT
2010-05-15 11:20:07 -06:00
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type packet-too-big \
2010-05-15 11:15:39 -06:00
-i $i -j ACCEPT
done
2010-05-15 11:07:40 -06:00
fi
2009-08-13 13:53:20 -06:00
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_blockoutports" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 blocked outbound port rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_blockoutports"
fi
2010-06-21 22:34:28 -06:00
if [ "$BLOCKIPV6TCPPORTS" ] || [ "$BLOCKIPV6UDPPORTS" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Blocking outbound port: " N
2010-06-21 22:34:28 -06:00
if [ "$BLOCKIPV6TCPPORTS" ]; then
for i in $BLOCKIPV6TCPPORTS; do
2010-08-21 20:36:50 -06:00
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
$IP6TABLES -A OUTPUT -p tcp --dport $i --syn -j DROP
done
fi
if [ "$BLOCKIPV6UDPPORTS" ]; then
for i in $BLOCKIPV6UDPPORTS; do
2010-08-21 20:36:50 -06:00
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
$IP6TABLES -A OUTPUT -p udp --dport $i -j DROP
done
fi
2010-08-20 13:47:42 -06:00
reset_color
2010-06-21 22:34:28 -06:00
fi
2009-08-13 13:53:20 -06:00
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_allowedports" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 allowed port rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_allowedports"
fi
2010-06-21 22:34:28 -06:00
if [ "$IPV6TCP" ] || [ "$IPV6UDP" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Adding allowed IPv6 port: " N
2010-06-21 22:34:28 -06:00
if [ "$IPV6TCP" ]; then
for i in $IPV6TCP; do
2010-08-21 20:36:50 -06:00
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
$IP6TABLES -A INPUT -p tcp --dport $i -j ACCEPT
done
fi
if [ "$IPV6UDP" ]; then
for i in $IPV6UDP; do
2010-08-21 20:36:50 -06:00
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
2010-06-21 22:34:28 -06:00
$IP6TABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
$IP6TABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
$IP6TABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
done
fi
2010-08-20 13:47:42 -06:00
reset_color
2010-06-21 22:34:28 -06:00
fi
fi
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_conntrack" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 conntrack rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_conntrack"
fi
2009-08-23 16:47:45 -06:00
if [ $IPV6ROUTEDCLIENTBLOCK ]; then
2010-07-14 23:44:42 -06:00
$IP6TABLES -A INPUT -m state --state NEW -j ACCEPT
$IP6TABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IP6TABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IP6TABLES -A FORWARD -m state --state NEW -j ACCEPT
$IP6TABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IP6TABLES -A OUTPUT -m state --state NEW -j ACCEPT
$IP6TABLES -A INPUT -m state --state INVALID -j DROP
$IP6TABLES -A OUTPUT -m state --state INVALID -j DROP
$IP6TABLES -A FORWARD -m state --state INVALID -j DROP
2009-08-23 16:47:45 -06:00
$IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p tcp --syn -j DROP
$IP6TABLES -A INPUT -i $IPV6INT -p tcp --syn -j DROP
$IP6TABLES -A INPUT -i $IPV6INT -p udp ! --dport 32768:65535 -j DROP
$IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p udp ! --dport 32768:65535 -j DROP
fi
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_routing" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 routing rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_routing"
fi
2010-08-14 17:25:35 -06:00
if [ "$IPV6FORWARDRANGE" ]; then
2009-08-13 13:53:20 -06:00
for i in $IPV6FORWARDRANGE; do
$IP6TABLES -A FORWARD -s $i -j ACCEPT
$IP6TABLES -A FORWARD -d $i -j ACCEPT
done
fi
2010-07-14 23:44:42 -06:00
if [ -s "$BASEDIR/include/ipv6_custom_blockincoming" ]; then
2010-08-20 13:47:42 -06:00
display_c YELLOW "Loading custom IPv6 incoming blocked port rules..."
2010-07-14 23:44:42 -06:00
. "$BASEDIR/include/ipv6_custom_blockincoming"
fi
2009-08-13 13:53:20 -06:00
if [ $IPV6BLOCKINCOMING ]; then
$IP6TABLES -A INPUT -p tcp --syn -j DROP
$IP6TABLES -A INPUT -p udp -j DROP
fi
2009-08-13 17:13:29 -06:00
if [ $TWEAKS ]; then
for i in `grep -v "\#" $TWEAKS`; do
PROCOPT=( ${i//=/ } )
echo ${PROCOPT[1]} > /proc/sys/net/${PROCOPT[0]} &>/dev/null
done
fi
2009-08-13 13:53:20 -06:00
$BASEDIR/postrun