You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 

1143 lines
35 KiB

#/bin/bash
# By Brielle Bruns <bruns@2mbit.com>
# URL: http://www.sosdg.org/freestuff/firewall
# License: GPLv3
#
# Copyright (C) 2009 - 2011 Brielle Bruns
# Copyright (C) 2009 - 2011 The Summit Open Source Development Group
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
FW_VERSION="1.1"
# These option is here to help pre-1.0 users easily upgrade, defines critical defaults
# that would otherwise require remaking their options file. I leave this on by default,
# but if you want to make sure you have a current options file, define this to 0.
COMPAT_CONFIG=1
BASEDIR=/etc/firewall-sosdg
PATH=/usr/sbin:/usr/bin:/sbin:/bin
#BASEDIR=`pwd`
# We require at least bash v3 or later at this point given some of the more complex
# operations we do to make the firewall script work.
if (( ${BASH_VERSINFO[0]} <= "2" )); then
echo "Error: We can only run with bash 3.0 or higher. Please upgrade your version"
echo "of bash to something more recent, preferably the latest which is, as of this"
echo "writing, 4.x"
exit 1
fi
TWEAKS=$BASEDIR/tweaks
if [ ! -r $BASEDIR/include/static ] || [ ! -r $BASEDIR/include/functions ]; then
echo "Error: Missing either include/static or include/functions. These are critical to operation"
echo "of this script. Please make sure they are readable and exist!"
exit 1
fi
if [ -r $BASEDIR/include/static ]; then
. $BASEDIR/include/static
else
echo -e "${RED}Error: Can not load static variables file. There is no way to make this tool work without it."
exit 1
fi
if [ -r $BASEDIR/options ]; then
. $BASEDIR/options
else
echo -e "${RED}Error: Can not load options file. Did you forget to rename options.default?"
exit 1
fi
if [ -r $BASEDIR/include/functions ]; then
. $BASEDIR/include/functions
else
echo -e "${RED}Error: Can not load functions library file. There is no way to make this tool work without it."
exit 1
fi
while [ $# -gt 0 ]; do
case "$1" in
-f|--flush)
iptables_policy_reset ipv4 ACCEPT
iptables_policy_reset ipv6 ACCEPT
iptables_rules_flush ipv4
iptables_rules_flush ipv6
exit 0
;;
-h|--help)
show_help
exit 0
;;
--generate-cache)
GEN_CACHE="force"
;;
esac
shift
done
if [ ${PORTFW} ] && [ ! -r "${PORTFW}" ]; then
display_c RED "Error: Missing ${PORTFW} as defined in the PORTFW option. Please make sure"
display_c RED "it exists, or comment out the PORTFW line in options."
exit 1
fi
echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Firewall/SOSDG ${FW_VERSION}
Brielle Bruns <bruns@2mbit.com>
http://www.sosdg.org/freestuff/firewall
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to
redistribute it under certain conditions.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-="
if [ "$UID" != "0" ]; then
display_c RED "You must be root to run this script."
exit 2
fi
if [ ! -x "${IPTABLES}" ]; then
display_c RED "iptables command not found. Please make sure you have the iptables"
display_c RED "installed (package or source) and you have the IPTABLES option properly"
display_c RED "defined in the 'options' file."
exit 3
fi
if [ ! -x "${IP6TABLES}" ] && [ $IPV6 == "1" ]; then
display_c RED "ip6tables command not found. Please make sure you have the iptables"
display_c RED "installed (package or source) and you have the IP6TABLES option properly"
display_c RED "defined in the 'options' file."
exit 3
fi
if [[ "${EXTIF}" == "auto" ]]; then
EXTIF=`$EXTIF_FIND`
display_c YELLOW "Found default interface at: ${BLUE}${EXTIF}${DEFAULT_COLOR}"
fi
if [[ "${EXTIP}" == "auto" ]]; then
EXTIP=`$EXTIP_FIND ${EXTIF}`
display_c YELLOW "Found default interface IP at: ${BLUE}${EXTIP}${DEFAULT_COLOR}"
fi
iptables_rules_flush ipv4
if [ -s "${BASEDIR}/include/ipv4_custom_flush" ]; then
display_c YELLOW "Loading custom flush rules..."
. "${BASEDIR}/include/ipv4_custom_flush"
fi
if [ -x "${PRERUN}" ]; then
${PRERUN}
fi
if [ "$MODULES_LOAD" ]; then
display_c YELLOW "Loading modules: " N
for i in $MODULES_LOAD; do
display_c BLUE "$i " N
${MODPROBE} $i
done
echo -ne "\n"
fi
if [ "$STATE_TYPE" ]; then
case $STATE_TYPE in
conntrack|CONNTRACK|*)
M_STATE="-m conntrack"
C_STATE="--ctstate"
;;
state|STATE)
M_STATE="-m state"
C_STATE="--state"
esac
else
M_STATE="-m conntrack"
C_STATE="--ctstate"
fi
# This function currently isn't implemented entirely or properly. It's mostly
# used for debugging purposes, and to see what iptables rules will be generated
# before running.
if [ "$GEN_CACHE" ]; then
case $GEN_CACHE in
force)
IPTABLES="write_out_rules"
if [ "$IPV6" ]; then
IP6TABLES="write_out_rules_v6"
rm -f "${RULE_CACHE_V6}" &>/dev/null
fi
rm -f "${RULE_CACHE}" &>/dev/null
;;
esac
fi
if [ "$IPTABLES_MULTIPORT" ]; then
case $IPTABLES_MULTIPORT in
auto|AUTO|Auto)
if `${MODPROBE} ${NF_MULTIPORT} &>/dev/null`; then
display_c YELLOW "Multiport successfully loaded."
IPTABLES_MULTIPORT="yes"
else
display_c RED "Multiport was not loaded successfully. Disabling."
IPTABLES_MULTIPORT="no"
fi ;;
yes|YES|Yes)
${MODPROBE} ${NF_MULTIPORT}
display_c PURPLE "Multiport loading forced, not error checking."
IPTABLES_MULTIPORT="yes" ;;
*) IPTABLES_MULTIPORT="no"
esac
fi
# Trying to better clean up some of my code, so lets try using a blackhole target
$IPTABLES -N BLACKHOLE-IN
$IPTABLES -N BLACKHOLE-OUT
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
if [ -s "$BASEDIR/include/ipv4_custom_trust" ]; then
display_c YELLOW "Loading custom trust rules..."
. "$BASEDIR/include/ipv4_custom_trust"
fi
if [ "$TRUSTEDIP" ]; then
display_c YELLOW "Adding trusted IP: " N
for i in $TRUSTEDIP; do
echo -n "$i "
$IPTABLES -A INPUT -s $i -j ACCEPT
$IPTABLES -A OUTPUT -d $i -j ACCEPT
done
echo -ne "\n"
fi
if [ "$CLAMPMSS" ]; then
display_c YELLOW "Clamping MSS to PMTU..."
for i in $CLAMPMSS; do
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
$IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
done
echo -en "\n"
fi
if [ "$DNS_REQUESTS_OUT" ]; then
display_c YELLOW "Adding DNS reply allows for trusted DNS servers.."
for i in $DNS_REQUESTS_OUT; do
if [[ "$i" =~ "|" ]]; then
IFS_OLD=${IFS};IFS=\|
DNSREQ=($i)
IFS=${IFS_OLD}
SRCIF=${DNSREQ[0]}
DNSIP_NUM=${#DNSREQ[@]}
DNSIP_COUNT_CURR=1
for ((i=$DNSIP_COUNT_CURR; i <= $DNSIP_NUM; i++)); do
if [ ${DNSREQ[$i]} ]; then
${IPTABLES} -A INPUT -i ${SRCIF} -p udp --sport 53 -s ${DNSREQ[$i]} --destination-port 1024:65535 -j ACCEPT
fi
done
else
${IPTABLES} -A INPUT -i $i -p udp --sport 53 --destination-port 1024:65535 -j ACCEPT
fi
done
fi
if [ -s "$BASEDIR/include/ipv4_custom_allowedports" ]; then
display_c YELLOW "Loading custom allowed port rules..."
. "$BASEDIR/include/ipv4_custom_allowedports"
fi
if [ "$IPV4_ALLOWED" ]; then
display_c YELLOW "Adding allowed IPs and ports... "
for i in `grep -v "\#" $IPV4_ALLOWED`; do
if [[ "$i" =~ "|" ]]; then
IFS_OLD=${IFS};IFS=\|
ADVALLOWIP=($i)
IFS=${IFS_OLD}
SRCIF=${ADVALLOWIP[0]}
SRCIP=${ADVALLOWIP[1]}
SRCPORT=${ADVALLOWIP[2]}
DSTIF=${ADVALLOWIP[3]}
DSTIP=${ADVALLOWIP[4]}
DSTPORT=${ADVALLOWIP[5]}
DIRECTION=${ADVALLOWIP[6]}
PROTO=${ADVALLOWIP[7]}
if [ "$SRCIF" ]; then
SRCIF="-i ${SRCIF} "
fi
if [ "$SRCIP" ]; then
SRCIP="-s ${SRCIP} "
fi
if [ "$SRCPORT" ]; then
SRCPORT="--sport ${SRCPORT/-/:} "
fi
if [ "$DSTIF" ]; then
DSTIF="-o ${DSTIF} "
fi
if [ "$DSTIP" ]; then
DSTIP="-d ${DSTIP} "
fi
if [ "$DSTPORT" ]; then
DSTPORT="--dport ${DSTPORT/-/:} "
fi
if [ "$PROTO" ]; then
case $PROTO in
TCP|tcp) PROTO="-p tcp";;
UDP|udp) PROTO="-p udp";;
*) PROTO="-p ${PROTO}";;
esac
fi
case $DIRECTION in
IN) DIRECTION="INPUT" ;;
OUT) DIRECTION="OUTPUT" ;;
FWD) DIRECTION="FORWARD" ;;
*) DIRECTION="INPUT" ;;
esac
${IPTABLES} -A ${DIRECTION} ${PROTO} ${SRCIF} ${SRCIP} ${SRCPORT} ${DSTIF} ${DSTIP} ${DSTPORT} -j ACCEPT
fi
done
fi
if [ -s "$BASEDIR/include/ipv4_custom_blockip" ]; then
display_c YELLOW "Loading custom ip block rules..."
. "$BASEDIR/include/ipv4_custom_blockip"
fi
if [ "$BLOCKEDIP" ]; then
display_c YELLOW "Adding blocked IPs... "
for i in `grep -v "\#" $BLOCKEDIP`; do
#echo -n "$i "
if [[ "$i" =~ "|" ]]; then
IFS_OLD=${IFS};IFS=\|
ADVBLKIP=($i)
IFS=${IFS_OLD}
SRCIF=${ADVBLKIP[0]}
SRCIP=${ADVBLKIP[1]}
SRCPORT=${ADVBLKIP[2]}
DSTIF=${ADVBLKIP[3]}
DSTIP=${ADVBLKIP[4]}
DSTPORT=${ADVBLKIP[5]}
DIRECTION=${ADVBLKIP[6]}
PROTO=${ADVBLKIP[7]}
if [ "$SRCIF" ]; then
SRCIF="-i ${SRCIF} "
fi
if [ "$SRCIP" ]; then
SRCIP="-s ${SRCIP} "
fi
if [ "$SRCPORT" ]; then
SRCPORT="--sport ${SRCPORT/-/:} "
fi
if [ "$DSTIF" ]; then
DSTIF="-o ${DSTIF} "
fi
if [ "$DSTIP" ]; then
DSTIP="-d ${DSTIP} "
fi
if [ "$DSTPORT" ]; then
DSTPORT="--dport ${DSTPORT/-/:} "
fi
if [ "$PROTO" ]; then
case $PROTO in
TCP|tcp) PROTO="-p tcp";;
UDP|udp) PROTO="-p udp";;
*) PROTO="-p ${PROTO}";;
esac
fi
case $DIRECTION in
IN) DIRECTION="INPUT" ;;
OUT) DIRECTION="OUTPUT" ;;
FWD) DIRECTION="FORWARD" ;;
*) DIRECTION="INPUT" ;;
esac
${IPTABLES} -A ${DIRECTION} ${PROTO} ${SRCIF} ${SRCIP} ${SRCPORT} ${DSTIF} ${DSTIP} ${DSTPORT} -j DROP
else
$IPTABLES -A INPUT -s $i -j DROP
$IPTABLES -A OUTPUT -d $i -j DROP
fi
done
fi
if [ "$BLOCK_OUTGOING_RFC1918" ]; then
display_c YELLOW "Blocking RFC1918 space going out on: " N
for i in $BLOCK_OUTGOING_RFC1918; do
display_c BLUE "$i " N
for x in $RFC1918_SPACE; do
$IPTABLES -A INPUT -i $i -s $x -j DROP
$IPTABLES -A FORWARD -i $i -s $x -j DROP
done
done
echo -ne "\n"
unset i x
fi
if [ "$BLOCK_INCOMING_RFC1918" ]; then
display_c YELLOW "Blocking RFC1918 space coming in on: " N
for i in $BLOCK_INCOMING_RFC1918; do
display_c BLUE "$i " N
for x in $RFC1918_SPACE; do
$IPTABLES -A INPUT -i $i -s $x -j DROP
$IPTABLES -A FORWARD -i $i -s $x -j DROP
done
done
echo -ne "\n"
unset i x
fi
if [ "$STRIPECN" ]; then
display_c YELLOW "Stripping ECN off of TCP packets to " N
for i in $STRIPECN; do
echo -en "$i "
$IPTABLES -A PREROUTING -t mangle -p tcp -d $i -j ECN \
--ecn-tcp-remove
done
echo -ne "\n"
fi
if [ -s "$BASEDIR/include/ipv4_custom_mssclamp" ]; then
display_c YELLOW "Loading custom MSS Clamp rules..."
. "$BASEDIR/include/ipv4_custom_mssclamp"
fi
if [ "$HACK_IPV4" ]; then
apply_ipv4_hack $HACK_IPV4
fi
if [ -s "$BASEDIR/include/ipv4_custom_conntrack" ]; then
display_c YELLOW "Loading custom conntrack rules..."
. "$BASEDIR/include/ipv4_custom_conntrack"
fi
if [ "$CONNTRACK" ]; then
#$IPTABLES -A INPUT ${M_STATE} ${C_STATE} NEW -j ACCEPT
$IPTABLES -A INPUT ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -j ACCEPT
# Now in the NAT rules
#$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -j ACCEPT
#$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} NEW -j ACCEPT
$IPTABLES -A OUTPUT ${M_STATE} ${C_STATE} NEW,RELATED,ESTABLISHED -j ACCEPT
#$IPTABLES -A OUTPUT ${M_STATE} ${C_STATE} NEW -j ACCEPT
$IPTABLES -A INPUT ${M_STATE} ${C_STATE} INVALID -j DROP
$IPTABLES -A OUTPUT ${M_STATE} ${C_STATE} INVALID -j DROP
#$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} INVALID -j DROP
fi
if [ -s "$BASEDIR/include/ipv4_custom_blockoutports" ]; then
display_c YELLOW "Loading custom blocked outbound port rules..."
. "$BASEDIR/include/ipv4_custom_blockoutports"
fi
if [ "$BLOCKTCPPORTS" ] || [ "$BLOCKUDPPORTS" ]; then
display_c YELLOW "Blocking outbound port: " N
if [ "$BLOCKTCPPORTS" ]; then
for i in $BLOCKTCPPORTS; do
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
$IPTABLES -A OUTPUT -p tcp --dport $i --syn -j DROP
done
fi
if [ "$BLOCKUDPPORTS" ]; then
for i in $BLOCKUDPPORTS; do
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
$IPTABLES -A OUTPUT -p udp --dport $i -j DROP
done
fi
reset_color
fi
if [ "$TCPPORTS" ] || [ "$UDPPORTS" ]; then
display_c YELLOW "Adding allowed port: " N
if [ "$TCPPORTS" ]; then
if [ "$IPTABLES_MULTIPORT" == "yes" ] && [ "$NF_MULTIPORT_MAX_PORTS" ]; then
TCPPORTS=($TCPPORTS)
PORTS_COUNT=${#TCPPORTS[@]}
PORTS_COUNT_CURR=0
while (( "$PORTS_COUNT_CURR" < "$PORTS_COUNT" )); do
for ((i=$PORTS_COUNT_CURR; i <=(($PORTS_COUNT_CURR+(($NF_MULTIPORT_MAX_PORTS-1)))); i++)); do
if [ ${TCPPORTS[$i]} ]; then
PORTS="${PORTS},${TCPPORTS[$i]}"
fi
done
echo -en "${PURPLE}Multiport-TCP${DEFAULT_COLOR}/${GREEN}${PORTS#,} "
$IPTABLES -A INPUT -p tcp -m multiport --dports ${PORTS#,} -j ACCEPT
unset PORTS
PORTS_COUNT_CURR=$i
done
unset i PORTS PORTS_COUNT_CURR PORTS_COUNT
else
for i in $TCPPORTS; do
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
$IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT
done
fi
fi
if [ "$UDPPORTS" ]; then
for i in $UDPPORTS; do
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
#$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT
$IPTABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
$IPTABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
$IPTABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
done
fi
reset_color
fi
if [ -s "$BASEDIR/include/ipv4_custom_proto" ]; then
display_c YELLOW "Loading custom protocol rules..."
. "$BASEDIR/include/ipv4_custom_proto"
fi
if [ "$ALLOWEDPROTO" ]; then
display_c YELLOW "Adding allowed protocols: " N
for i in $ALLOWEDPROTO; do
echo -n "$i "
$IPTABLES -A INPUT -p $i -j ACCEPT
$IPTABLES -A OUTPUT -p $i -j ACCEPT
done
reset_color
fi
if [ "$IPV4_INTERCEPT" ]; then
display_c YELLOW "Adding packet interception rules: "
for i in `grep -v "\#" $IPV4_INTERCEPT`; do
IFS_OLD=${IFS};IFS=\|
INTERCEPTADD=($i)
IFS=${IFS_OLD}
SRCIF=${INTERCEPTADD[0]}
SRCIP=${INTERCEPTADD[1]}
DSTIP=${INTERCEPTADD[2]}
DSTPROTO=${INTERCEPTADD[3]}
DSTPORT=${INTERCEPTADD[4]}
PROXY=${INTERCEPTADD[5]}
if [ "$SRCIF" ]; then
SRCIF="-i ${SRCIF}"
fi
if [ "$SRCIP" ]; then
SRCIP="-s ${SRCIP}"
fi
if [ "$DSTIP" ]; then
DSTIP="-d $DSTIP"
fi
if [ "$PROXY" != "BYPASS" ]; then
FINAL_RULE="-j DNAT --to-destination ${PROXY}"
else
FINAL_RULE="-j ACCEPT"
fi
$IPTABLES -t nat -A PREROUTING ${SRCIF} ${SRCIP} ${DSTIP} -p ${DSTPROTO} --dport ${DSTPORT} \
${FINAL_RULE}
display_c DEFAULT "\t${GREEN}${INTERCEPTADD[0]}:${BLUE}${INTERCEPTADD[1]}:${PURPLE}${INTERCEPTADD[2]}->${INTERCEPTADD[3]}:${INTERCEPTADD[4]}${AQUA}:proxy->${BLUE}${INTERCEPTADD[5]} "
done
reset_color
fi
if [ -s "$BASEDIR/include/ipv4_custom_notrack" ]; then
display_c YELLOW "Loading custom NOTRACK rules..."
. "$BASEDIR/include/ipv4_custom_notrack"
fi
if [ $CONNTRACK ]; then
for i in $DONTTRACK; do
$IPTABLES -t raw -I PREROUTING -s $i -j NOTRACK
$IPTABLES -t raw -I PREROUTING -d $i -j NOTRACK
$IPTABLES -t raw -I OUTPUT -s $i -j NOTRACK
$IPTABLES -t raw -I OUTPUT -d $i -j NOTRACK
done
fi
if [ -s "$BASEDIR/include/ipv4_custom_routing" ]; then
display_c YELLOW "Loading custom routing rules..."
. "$BASEDIR/include/ipv4_custom_routing"
fi
if [ $ROUTING ]; then
display_c YELLOW "Adding route: "
for i in `grep -v "\#" $ROUTING`; do
ROUTE=( ${i//:/ } )
FWINT1=${ROUTE[0]}
FWINT2=${ROUTE[2]}
FWIP1=${ROUTE[1]}
FWIP2=${ROUTE[3]}
if [ -e "/proc/sys/net/ipv4/conf/$FWINT1/forwarding" ]; then
echo 1 > /proc/sys/net/ipv4/conf/$FWINT1/forwarding
fi
if [ -e "/proc/sys/net/ipv4/conf/$FWINT2/forwarding" ]; then
echo 1 > /proc/sys/net/ipv4/conf/$FWINT2/forwarding
fi
$IPTABLES -A FORWARD -i $FWINT1 -o $FWINT2 \
-s $FWIP1 -d $FWIP2 -j ACCEPT
if [ ${ROUTE[4]} == "1" ]; then
display_c DEFAULT "\t${GREEN}$FWINT1:${PURPLE}$FWIP1${AQUA}<->${BLUE}$FWINT2:$FWIP2"
$IPTABLES -A FORWARD -o $FWINT1 -i $FWINT2 \
-d $FWIP1 -s $FWIP2 -j ACCEPT
else
display_c DEFAULT "\t${GREEN}$FWINT1:${PURPLE}$FWIP1${AQUA}->${BLUE}$FWINT2:$FWIP2"
fi
done
echo -ne "\n"
fi
if [ -s "$BASEDIR/include/ipv4_custom_portforward" ]; then
display_c YELLOW "Loading custom port forwarding rules..."
. "$BASEDIR/include/ipv4_custom_portforward"
fi
if [ "$PORTFW" ] && [ "$NAT" ]; then
display_c YELLOW "Adding port forward for:"
for i in `grep -v "\#" $PORTFW`; do
IFS_OLD=${IFS};IFS=\:
PORTFWADD=($i)
IFS=${IFS_OLD}
DSTIF=${PORTFWADD[0]}
SRCIP=${PORTFWADD[1]}
DSTIP=${PORTFWADD[2]}
DSTPORT=${PORTFWADD[3]}
DSTPROTO=${PORTFWADD[4]}
DSTINTIP=${PORTFWADD[5]}
DSTINTPORT=${PORTFWADD[6]}
if [ "$DSTIF" ]; then
DSTIF="-i ${DSTIF}"
fi
if [ "$SRCIP" ]; then
SRCIP="-s ${SRCIP}"
fi
if [ "$DSTIP" ]; then
DSTIP="-d $DSTIP"
fi
if [ ! "$DSTIP" ] && [ ! "$DSTIF" ]; then
DSTIP="-d $EXTIP"
fi
#PORTADD=( ${i//:/ } )
$IPTABLES -A PREROUTING -t nat ${DSTIF} -p ${DSTPROTO} ${SRCIP} \
--dport ${DSTPORT} ${DSTIP} -j DNAT --to \
${DSTINTIP}:${DSTINTPORT}
$IPTABLES -A INPUT -p ${DSTPROTO} ${M_STATE} ${C_STATE} NEW ${DSTIF} ${SRCIP} \
--dport ${DSTPORT} ${DSTIP} -j ACCEPT
display_c DEFAULT "\t${GREEN}${PORTFWADD[0]}:${BLUE}${PORTFWADD[1]}:${PURPLE}${PORTFWADD[2]}:${PORTFWADD[3]}:${PORTFWADD[4]}${AQUA}->${BLUE}${PORTFWADD[5]}:${PORTFWADD[6]} "
done
reset_color
fi
if [ "$LANDHCPSERVER" ]; then
for i in $LANDHCPSERVER; do
$IPTABLES -A INPUT -i $i -p udp --sport 67:68 --dport 67:68 -j ACCEPT
$IPTABLES -A OUTPUT -o $i -p udp --sport 67:68 --dport 67:68 -j ACCEPT
#$IPTABLES -A INPUT -i $i -s 0.0.0.0 -j ACCEPT
#$IPTABLES -A INPUT -i $i -p udp --dport 67:68 -j ACCEPT
#$IPTABLES -A INPUT -i $i -p tcp --dport 67:68 -j ACCEPT
#$IPTABLES -A OUTPUT -o $i -p udp --dport 67:68 -j ACCEPT
#$IPTABLES -A OUTPUT -o $i -p tcp --dport 67:68 -j ACCEPT
#$IPTABLES -A INPUT -i $i -p udp -d 255.255.255.255 --dport 67:68 -j ACCEPT
#$IPTABLES -A INPUT -i $i -p tcp -d 255.255.255.255 --dport 67:68 -j ACCEPT
#$IPTABLES -A OUTPUT -o $i -p udp -d 255.255.255.255 --dport 67:68 -j ACCEPT
#$IPTABLES -A OUTPUT -o $i -p tcp -d 255.255.255.255 --dport 67:68 -j ACCEPT
done
fi
if [ -s "$BASEDIR/include/ipv4_custom_mark" ]; then
display_c YELLOW "Loading custom mark rules..."
. "$BASEDIR/include/ipv4_custom_mark"
fi
if [ -r "$IPv4_MARK" ]; then
display_c YELLOW "Adding mark: "
for i in `grep -v "\#" $IPv4_MARK`; do
MARK=( ${i//|/ } )
INIF=${MARK[0]}
INIP=${MARK[1]}
DSTIP=${MARK[2]}
IPMARK=${MARK[3]}
case $INIP in
!*) INNEG="!"
INIP=${INIP#\!};;
esac
case $DSTIP in
!*) DSTNEG="!"
DSTIP=${DSTIP#\!};;
esac
$IPTABLES -t mangle -A PREROUTING -i ${INIF} ${INNEG} -s ${INIP} \
${DSTNEG} -d ${DSTIP} -j MARK --set-mark=${IPMARK}
display_c DEFAULT "\t${GREEN}${INNEG}${INIF}:${PURPLE}${INIP}${AQUA}->${BLUE}${DSTNEG}${DSTIP}:${RED}${IPMARK}"
unset INNEG DSTNEG
done
echo -ne "\n"
fi
if [ -s "$BASEDIR/include/ipv4_custom_nat" ]; then
display_c YELLOW "Loading custom nat rules..."
. "$BASEDIR/include/ipv4_custom_nat"
fi
if [ $NAT ]; then
if [ "$NAT_RANGE" ]; then
display_c YELLOW "Adding NAT rule:"
unset INIF_EXISTS FWDIF_EXISTS
for i in $NAT_RANGE; do
NAT_RULE=( ${i//:/ } )
case ${NAT_RULE[0]} in
SNAT)
$IPTABLES -A POSTROUTING -t nat -s ${NAT_RULE[2]} -j SNAT \
-o ${NAT_RULE[3]} --to-source ${NAT_RULE[4]}
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} NEW,RELATED,ESTABLISHED -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} -o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -o ${NAT_RULE[1]} -d ${NAT_RULE[2]} -i ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} INVALID -o ${NAT_RULE[1]} -d ${NAT_RULE[2]} -i ${NAT_RULE[3]} -j DROP
display_c DEFAULT "\t${GREEN}SNAT:${PURPLE}${NAT_RULE[1]}:${NAT_RULE[2]}${AQUA}->${BLUE}${NAT_RULE[3]}:${NAT_RULE[4]}"
if [[ ! "$INIF_EXISTS" =~ "${NAT_RULE[1]}:${NAT_RULE[2]}" ]]; then
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded -i ${NAT_RULE[1]} \
-s ${NAT_RULE[2]} -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed -i ${NAT_RULE[1]} \
-s ${NAT_RULE[2]} -j ACCEPT
INIF_EXISTS="${INIF_EXISTS} ${NAT_RULE[1]}:${NAT_RULE[2]}"
fi
if [[ ! "$FWDIF_EXISTS" =~ "${NAT_RULE[1]}:${NAT_RULE[2]}:${NAT_RULE[3]}" ]]; then
$IPTABLES -A FORWARD -p icmp --icmp-type time-exceeded -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} \
-o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type fragmentation-needed -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} \
-o ${NAT_RULE[3]} -j ACCEPT
FWDIF_EXISTS="${FWDIF_EXISTS} ${NAT_RULE[1]}:${NAT_RULE[2]}:${NAT_RULE[3]}"
fi
;;
MASQ)
$IPTABLES -A POSTROUTING -t nat -s ${NAT_RULE[2]} -j MASQUERADE -o ${NAT_RULE[3]}
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} NEW,RELATED,ESTABLISHED -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} -o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -o ${NAT_RULE[1]} -d ${NAT_RULE[2]} -i ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} INVALID -o ${NAT_RULE[1]} -d ${NAT_RULE[2]} -i ${NAT_RULE[3]} -j DROP
display_c DEFAULT "\t${GREEN}MASQ:${PURPLE}${NAT_RULE[2]}${AQUA}->${BLUE}${NAT_RULE[3]}"
if [[ ! "$INIF_EXISTS" =~ "${NAT_RULE[1]}:${NAT_RULE[2]}" ]]; then
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded -i ${NAT_RULE[1]} \
-s ${NAT_RULE[2]} -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed -i ${NAT_RULE[1]} \
-s ${NAT_RULE[2]} -j ACCEPT
INIF_EXISTS="${INIF_EXISTS} ${NAT_RULE[1]}:${NAT_RULE[2]}"
fi
if [[ ! "$FWDIF_EXISTS" =~ "${NAT_RULE[1]}:${NAT_RULE[2]}:${NAT_RULE[3]}" ]]; then
$IPTABLES -A FORWARD -p icmp --icmp-type time-exceeded -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} \
-o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type fragmentation-needed -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} \
-o ${NAT_RULE[3]} -j ACCEPT
FWDIF_EXISTS="${FWDIF_EXISTS} ${NAT_RULE[1]}:${NAT_RULE[2]}:${NAT_RULE[3]}"
fi
;;
NETMAP)
$IPTABLES -A PREROUTING -t nat -s ${NAT_RULE[2]} -j NETMAP --to ${NAT_RULE[4]}
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} NEW,RELATED,ESTABLISHED -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} -o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -o ${NAT_RULE[1]} -d ${NAT_RULE[2]} -i ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD ${M_STATE} ${C_STATE} INVALID -o ${NAT_RULE[1]} -d ${NAT_RULE[2]} -i ${NAT_RULE[3]} -j DROP
display_c DEFAULT "\t${GREEN}NETMAP:${PURPLE}${NAT_RULE[2]}${AQUA}->${BLUE}${NAT_RULE[4]}"
if [[ ! "$INIF_EXISTS" =~ "${NAT_RULE[1]}:${NAT_RULE[2]}" ]]; then
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded -i ${NAT_RULE[1]} \
-s ${NAT_RULE[2]} -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed -i ${NAT_RULE[1]} \
-s ${NAT_RULE[2]} -j ACCEPT
INIF_EXISTS="${INIF_EXISTS} ${NAT_RULE[1]}:${NAT_RULE[2]}"
fi
if [[ ! "$FWDIF_EXISTS" =~ "${NAT_RULE[1]}:${NAT_RULE[2]}:${NAT_RULE[3]}" ]]; then
$IPTABLES -A FORWARD -p icmp --icmp-type time-exceeded -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} \
-o ${NAT_RULE[3]} -j ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type fragmentation-needed -i ${NAT_RULE[1]} -s ${NAT_RULE[2]} \
-o ${NAT_RULE[3]} -j ACCEPT
FWDIF_EXISTS="${FWDIF_EXISTS} ${NAT_RULE[1]}:${NAT_RULE[2]}:${NAT_RULE[3]}"
fi
;;
*) display_c RED "Invalid NAT rule in NAT_RANGE" ;;
esac
done
reset_color
fi
fi
$IPTABLES --policy INPUT ${IPV4_PINPUT}
$IPTABLES --policy OUTPUT ${IPV4_POUTPUT}
$IPTABLES --policy FORWARD ${IPV4_PFORWARD}
if [ -s "$BASEDIR/include/ipv4_custom_blockincoming" ]; then
display_c YELLOW "Loading custom incoming blocked rules..."
. "$BASEDIR/include/ipv4_custom_blockincoming"
fi
if [ $BLOCKINCOMING ]; then
$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -A INPUT -p udp -j DROP
fi
#================[IPv6]================
if [ $IPV6 ]; then
iptables_rules_flush ipv6
if [ -s "$BASEDIR/include/ipv6_custom_flush" ]; then
display_c YELLOW "Loading custom IPv6 flush rules..."
. "$BASEDIR/include/ipv6_custom_flush"
fi
display_c YELLOW "Adding trusted IPv6: " N
$IP6TABLES -A INPUT -i lo -j ACCEPT
$IP6TABLES -A OUTPUT -o lo -j ACCEPT
if [ -s "$BASEDIR/include/ipv6_custom_trust" ]; then
display_c YELLOW "Loading custom IPv6 trust rules..."
. "$BASEDIR/include/ipv6_custom_trust"
fi
if [ "$IPV6_TRUSTED" ]; then
for i in $IPV6_TRUSTED; do
echo -n "$i "
$IP6TABLES -A INPUT -s $i -j ACCEPT
$IP6TABLES -A OUTPUT -d $i -j ACCEPT
done
fi
reset_color
if [ -s "$BASEDIR/include/ipv6_custom_blockip" ]; then
display_c YELLOW "Loading custom IPv6 block rules..."
. "$BASEDIR/include/ipv6_custom_blockip"
fi
if [ "$IPV6_LANDHCPSERVER" ]; then
for i in $IPV6_LANDHCPSERVER; do
$IP6TABLES -A INPUT -i $i -p udp --sport 546:547 --dport 546:547 -j ACCEPT
#$IP6TABLES -A INPUT -i $i -p tcp --sport 546:547 --dport 546:547 -j ACCEPT
$IP6TABLES -A OUTPUT -o $i -p udp --sport 546:547 --dport 546:547 -j ACCEPT
#$IP6TABLES -A OUTPUT -o $i -p tcp --sport 546:547 --dport 546:547 -j ACCEPT
#$IP6TABLES -A INPUT -i $i -p udp -d ff02::1:2 --sport 546:547 --dport 546:547 -j ACCEPT
#$IP6TABLES -A INPUT -i $i -p tcp -d ff02::1:2 --sport 546:547 --dport 546:547 -j ACCEPT
#$IP6TABLES -A OUTPUT -o $i -p udp -d fe80::/16 --sport 546:547 --dport 546:547 -j ACCEPT
#$IP6TABLES -A OUTPUT -o $i -p tcp -d fe80::/16 --sport 546:547 --dport 546:547 -j ACCEPT
done
fi
if [ -s "$BASEDIR/include/ipv6_custom_conntrack" ]; then
display_c YELLOW "Loading custom IPv6 conntrack rules..."
. "$BASEDIR/include/ipv6_custom_conntrack"
fi
if [ "$IPV6_CONNTRACK" ]; then
#$IP6TABLES -A INPUT ${M_STATE} ${C_STATE} NEW -j ACCEPT
$IP6TABLES -A INPUT ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -j ACCEPT
$IP6TABLES -A FORWARD ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -j ACCEPT
#$IP6TABLES -A FORWARD ${M_STATE} ${C_STATE} NEW -j ACCEPT
$IP6TABLES -A OUTPUT ${M_STATE} ${C_STATE} RELATED,ESTABLISHED -j ACCEPT
$IP6TABLES -A OUTPUT ${M_STATE} ${C_STATE} NEW -j ACCEPT
$IP6TABLES -A INPUT ${M_STATE} ${C_STATE} INVALID -j DROP
$IP6TABLES -A OUTPUT ${M_STATE} ${C_STATE} INVALID -j DROP
$IP6TABLES -A FORWARD ${M_STATE} ${C_STATE} INVALID -j DROP
fi
if [ "$IPV6_DNS_REQUESTS_OUT" ]; then
display_c YELLOW "Adding IPv6 DNS reply allows for trusted DNS servers.."
for i in $DNS_REQUESTS_OUT; do
if [[ "$i" =~ "|" ]]; then
IFS_OLD=${IFS};IFS=\|
DNSREQ=($i)
IFS=${IFS_OLD}
SRCIF=${DNSREQ[0]}
DNSIP_NUM=${#DNSREQ[@]}
DNSIP_COUNT_CURR=1
for ((i=$DNSIP_COUNT_CURR; i <= $DNSIP_NUM; i++)); do
if [ ${DNSREQ[$i]} ]; then
${IP6TABLES} -A INPUT -i ${SRCIF} -p udp --sport 53 -s ${DNSREQ[$i]} --destination-port 1024:65535 -j ACCEPT
fi
done
else
${IP6TABLES} -A INPUT -i $i -p udp --sport 53 --destination-port 1024:65535 -j ACCEPT
fi
done
fi
if [ -s "$BASEDIR/include/ipv6_custom_blockoutports" ]; then
display_c YELLOW "Loading custom IPv6 blocked outbound port rules..."
. "$BASEDIR/include/ipv6_custom_blockoutports"
fi
if [ "$IPV6_BLOCKEDIP" ]; then
display_c YELLOW "Adding blocked IPv6 addresses... "
for i in `grep -v "\#" $IPV6_BLOCKEDIP`; do
if [[ "$i" =~ "|" ]]; then
IFS_OLD=${IFS};IFS=\|
ADVBLKIP=($i)
IFS=${IFS_OLD}
SRCIF=${ADVBLKIP[0]}
SRCIP=${ADVBLKIP[1]}
SRCPORT=${ADVBLKIP[2]}
DSTIF=${ADVBLKIP[3]}
DSTIP=${ADVBLKIP[4]}
DSTPORT=${ADVBLKIP[5]}
DIRECTION=${ADVBLKIP[6]}
PROTO=${ADVBLKIP[7]}
if [ "$SRCIF" ]; then
SRCIF="-i ${SRCIF} "
fi
if [ "$SRCIP" ]; then
SRCIP="-s ${SRCIP} "
fi
if [ "$SRCPORT" ]; then
SRCPORT="--sport ${SRCPORT/-/:} "
fi
if [ "$DSTIF" ]; then
DSTIF="-o ${DSTIF} "
fi
if [ "$DSTIP" ]; then
DSTIP="-d ${DSTIP} "
fi
if [ "$DSTPORT" ]; then
DSTPORT="--dport ${DSTPORT/-/:} "
fi
if [ "$PROTO" ]; then
case $PROTO in
TCP|tcp) PROTO="-p tcp";;
UDP|udp) PROTO="-p udp";;
*) PROTO="-p ${PROTO}";;
esac
fi
case $DIRECTION in
IN) DIRECTION="INPUT" ;;
OUT) DIRECTION="OUTPUT" ;;
FWD) DIRECTION="FORWARD" ;;
*) DIRECTION="INPUT" ;;
esac
${IP6TABLES} -A ${DIRECTION} ${PROTO} ${SRCIF} ${SRCIP} ${SRCPORT} ${DSTIF} ${DSTIP} ${DSTPORT} -j DROP
else
$IP6TABLES -A INPUT -s $i -j DROP
$IP6TABLES -A OUTPUT -d $i -j DROP
fi
done
fi
if [ "$IPV6_ICMP_CRITICAL" ]; then
# This is necessary to make sure that PMTU works
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded \
-j ACCEPT
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type time-exceeded \
-j ACCEPT
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big \
-j ACCEPT
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type packet-too-big \
-j ACCEPT
if [ "$IPV6_FORWARDRANGE" ]; then
$IP6TABLES -A FORWARD -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
$IP6TABLES -A FORWARD -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
fi
fi
if [ "$IPV6_ICMP_OPT" ]; then
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
if [ "$IPV6_FORWARDRANGE" ]; then
$IP6TABLES -A FORWARD -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
$IP6TABLES -A FORWARD -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT
fi
fi
if [ -s "$BASEDIR/include/ipv6_custom_mssclamp" ]; then
display_c YELLOW "Loading custom IPv6 MSS Clamp rules..."
. "$BASEDIR/include/ipv6_custom_mssclamp"
fi
if [ "$IPV6_CLAMPMSS" ]; then
display_c YELLOW "Clamping IPV6 MSS to PMTU..."
for i in $IPV6_CLAMPMSS; do
$IP6TABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
--mss 1280:1536
$IP6TABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
--mss 1280:1536
done
fi
if [ -s "$BASEDIR/include/ipv6_custom_allowedports" ]; then
display_c YELLOW "Loading custom IPv6 allowed port rules..."
. "$BASEDIR/include/ipv6_custom_allowedports"
fi
if [ "$IPV6_ALLOWED" ]; then
display_c YELLOW "Adding allowed IPv6 IPs and ports... "
for i in `grep -v "\#" $IPV6_ALLOWED`; do
if [[ "$i" =~ "|" ]]; then
IFS_OLD=${IFS};IFS=\|
ADVALLOWIP=($i)
IFS=${IFS_OLD}
SRCIF=${ADVALLOWIP[0]}
SRCIP=${ADVALLOWIP[1]}
SRCPORT=${ADVALLOWIP[2]}
DSTIF=${ADVALLOWIP[3]}
DSTIP=${ADVALLOWIP[4]}
DSTPORT=${ADVALLOWIP[5]}
DIRECTION=${ADVALLOWIP[6]}
PROTO=${ADVALLOWIP[7]}
if [ "$SRCIF" ]; then
SRCIF="-i ${SRCIF} "
fi
if [ "$SRCIP" ]; then
SRCIP="-s ${SRCIP} "
fi
if [ "$SRCPORT" ]; then
SRCPORT="--sport ${SRCPORT/-/:} "
fi
if [ "$DSTIF" ]; then
DSTIF="-o ${DSTIF} "
fi
if [ "$DSTIP" ]; then
DSTIP="-d ${DSTIP} "
fi
if [ "$DSTPORT" ]; then
DSTPORT="--dport ${DSTPORT/-/:} "
fi
if [ "$PROTO" ]; then
case $PROTO in
TCP|tcp) PROTO="-p tcp";;
UDP|udp) PROTO="-p udp";;
*) PROTO="-p ${PROTO}";;
esac
fi
case $DIRECTION in
IN) DIRECTION="INPUT" ;;
OUT) DIRECTION="OUTPUT" ;;
FWD) DIRECTION="FORWARD" ;;
*) DIRECTION="INPUT" ;;
esac
${IP6TABLES} -A ${DIRECTION} ${PROTO} ${SRCIF} ${SRCIP} ${SRCPORT} ${DSTIF} ${DSTIP} ${DSTPORT} -j ACCEPT
fi
done
fi
if [ "$IPV6_TCPPORTS" ] || [ "$IPV6_UDPPORTS" ]; then
display_c YELLOW "Adding allowed IPv6 port: " N
if [ "$IPV6_TCPPORTS" ]; then
if [ "$IPTABLES_MULTIPORT" == "yes" ] && [ "$NF_MULTIPORT_MAX_PORTS" ]; then
IPV6_TCPPORTS=($IPV6_TCPPORTS)
PORTS_COUNT=${#IPV6_TCPPORTS[@]}
PORTS_COUNT_CURR=0
while (( "$PORTS_COUNT_CURR" < "$PORTS_COUNT" )); do
for ((i=$PORTS_COUNT_CURR; i <=(($PORTS_COUNT_CURR+(($NF_MULTIPORT_MAX_PORTS-1)))); i++)); do
if [ ${IPV6_TCPPORTS[$i]} ]; then
PORTS="${PORTS},${IPV6_TCPPORTS[$i]}"
fi
done
echo -en "${PURPLE}Multiport-TCP${DEFAULT_COLOR}/${GREEN}${PORTS#,} "
$IP6TABLES -A INPUT -p tcp -m multiport --dports ${PORTS#,} -j ACCEPT
unset PORTS
PORTS_COUNT_CURR=$i
done
unset i PORTS PORTS_COUNT_CURR PORTS_COUNT
else
for i in $IPV6_TCPPORTS; do
echo -en "${PURPLE}TCP${DEFAULT_COLOR}/${GREEN}$i "
$IP6TABLES -A INPUT -p tcp --dport $i -j ACCEPT
done
fi
fi
if [ "$IPV6_UDPPORTS" ]; then
for i in $IPV6_UDPPORTS; do
echo -en "${BLUE}UDP${DEFAULT_COLOR}/${GREEN}$i "
$IP6TABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
$IP6TABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
$IP6TABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
done
fi
reset_color
fi
if [ -s "$BASEDIR/include/ipv6_custom_mark" ]; then
display_c YELLOW "Loading custom IPv6 mark rules..."
. "$BASEDIR/include/ipv6_custom_mark"
fi
if [ -r "$IPV6_MARK" ]; then
display_c YELLOW "Adding IPv6 mark: "
for i in `grep -v "\#" $IPV6_MARK`; do
MARK=( ${i//|/ } )
INIF=${MARK[0]}
INIP=${MARK[1]}
DSTIP=${MARK[2]}
IPMARK=${MARK[3]}
case $INIP in
!*) INNEG="!"
INIP=${INIP#\!};;
esac
case $DSTIP in
!*) DSTNEG="!"
DSTIP=${DSTIP#\!};;
esac
${IP6TABLES} -t mangle -A PREROUTING -i ${INIF} ${INNEG} -s ${INIP} \
${DSTNEG} -d ${DSTIP} -j MARK --set-mark=${IPMARK}
display_c DEFAULT "\t${GREEN}${INNEG}${INIF};${PURPLE}${INIP}${AQUA}->${BLUE}${DSTNEG}${DSTIP};${RED}${IPMARK}"
unset INNEG DSTNEG
done
echo -ne "\n"
fi
if [ "$IPV6_ROUTEDCLIENTBLOCK" ]; then
for i in $IPV6_ROUTEDCLIENTBLOCK; do
$IP6TABLES -A OUTPUT -d $i -p tcp --syn -j DROP
$IP6TABLES -A OUTPUT -d $i -p udp ! --dport 32768:65535 -j DROP
$IP6TABLES -A FORWARD -d $i -p tcp --syn -j DROP
$IP6TABLES -A FORWARD -d $i -p udp ! --dport 32768:65535 -j DROP
done
fi
if [ -s "$BASEDIR/include/ipv6_custom_routing" ]; then
display_c YELLOW "Loading custom IPv6 routing rules..."
. "$BASEDIR/include/ipv6_custom_routing"
fi
if [ "$IPV6_FORWARDRANGE" ]; then
for i in $IPV6_FORWARDRANGE; do
$IP6TABLES -A FORWARD -s $i -j ACCEPT
$IP6TABLES -A FORWARD -d $i -j ACCEPT
done
fi
if [ -s "$BASEDIR/include/ipv6_custom_blockincoming" ]; then
display_c YELLOW "Loading custom IPv6 incoming blocked port rules..."
. "$BASEDIR/include/ipv6_custom_blockincoming"
fi
if [ $IPV6_BLOCKINCOMING ]; then
$IP6TABLES -A INPUT -p tcp --syn -j DROP
$IP6TABLES -A INPUT -p udp -j DROP
fi
$IP6TABLES --policy INPUT ${IPV6_PINPUT}
$IP6TABLES --policy OUTPUT ${IPV6_POUTPUT}
$IP6TABLES --policy FORWARD ${IPV6_PFORWARD}
fi
if [ $TWEAKS ]; then
for i in `grep -v "\#" $TWEAKS`; do
PROCOPT=( ${i//=/ } )
echo ${PROCOPT[1]} > /proc/sys/net/${PROCOPT[0]}
done
fi
if [ -x $POSTRUN ]; then
$POSTRUN
fi