brielle/Firewall-SOSDG
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Removed support code for NATRANGE

Browse Source
This commit is contained in:
bbruns 2010-09-30 01:17:38 +00:00
parent 790fb9bb0c
commit 8a1f7558af
2 changed files with 0 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
bin/firewall-sosdg
View File

@ -241,22 +241,12 @@ if [ "$BLOCKTCPPORTS" ] || [ "$BLOCKUDPPORTS" ]; then
for i in $BLOCKTCPPORTS; do for i in $BLOCKTCPPORTS; do
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i " echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
$IPTABLES -A OUTPUT -p tcp --dport $i --syn -j DROP $IPTABLES -A OUTPUT -p tcp --dport $i --syn -j DROP
#if [ "$NATRANGE" ]; then
# for src in $NATRANGE; do
# $IPTABLES -A FORWARD -p tcp -s $src --dport $i --syn -j DROP
# done
#fi
done done
fi fi
if [ "$BLOCKUDPPORTS" ]; then if [ "$BLOCKUDPPORTS" ]; then
for i in $BLOCKUDPPORTS; do for i in $BLOCKUDPPORTS; do
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i " echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
$IPTABLES -A OUTPUT -p udp --dport $i -j DROP $IPTABLES -A OUTPUT -p udp --dport $i -j DROP
#if [ "$NATRANGE" ]; then
# for src in $NATRANGE; do
# $IPTABLES -A FORWARD -p udp -s $src --dport $i -j DROP
# done
#fi
done done
fi fi
reset_color reset_color
@ -479,23 +469,6 @@ if [ $NAT ]; then
done done
reset_color reset_color
fi fi
#=================
# This section is going away in 1.0
if [ "$NATRANGE" ]; then
echo -e "${RED} **** WARNING ****"
echo -e "${RED} NATRANGE option detected. Please switch to using"
echo -e "${RED} NAT_RANGE which uses the newer style NAT mappings."
echo -e "${RED} NATRANGE will be removed in v1.0"
for i in $NATRANGE; do
$IPTABLES -A POSTROUTING -t nat -s $i -o $NATEXTIF -j SNAT --to-source $NATEXTIP
done
#This is necessary to make sure that PMTU works
$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o $NATEXTIF \
-j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
-o $NATEXTIF -j ACCEPT
#=================
fi
fi fi
$IPTABLES --policy INPUT ACCEPT $IPTABLES --policy INPUT ACCEPT

9
options.default
View File

@ -82,15 +82,6 @@ IPv4_MARK=$BASEDIR/ipv4-marks
# #
HACK_IPV4="NS-IN-DDOS" HACK_IPV4="NS-IN-DDOS"
#==============
# Obsolete - DO NOT USE ANYMORE. Will be removed in 1.0
# IP ranges(s) to NAT using SNAT.
#NATRANGE="192.168.1.0/24"
# External IP and interface for SNAT
#NATEXTIP="172.16.1.1"
#NATEXTIF="eth0"
#==============
# IP NAT Rules # IP NAT Rules
# SNAT:<INT IF>:<INT IP>:<EXT IF>:<EXT IP> # SNAT:<INT IF>:<INT IP>:<EXT IF>:<EXT IP>
# MASQ:<INT IF>:<INT IP>:<EXT IF> # MASQ:<INT IF>:<INT IP>:<EXT IF>