diff --git a/CHANGELOG b/CHANGELOG index b99a4c9..00fad9f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,9 @@ +2.1 Alpha 1 - 11/29/2014 + - Added support for custom fields in NAT and ACL rules, as this allows + definition of Policy rules in the ACL files (mostly useful for IPSec) + - NAT rules no longer add accept state rules, should be added in forward.conf + manually + 2.01 Alpha 1 - 07/27/2014 - Fix executable bits on .sh files in custom - Make MSS clamp optional and allow setting MSS size manually diff --git a/bin/srfirewall b/bin/srfirewall index bd96258..01372ad 100755 --- a/bin/srfirewall +++ b/bin/srfirewall @@ -19,7 +19,7 @@ # along with this program. If not, see . # Static config options, normally do not need to change -FW_VERSION="2.0" +FW_VERSION="2.1a1" # Important directory locations FWPREFIX="/usr/local" diff --git a/etc/ipv4/acl.conf b/etc/ipv4/acl.conf index 7aa227c..2a9655d 100644 --- a/etc/ipv4/acl.conf +++ b/etc/ipv4/acl.conf @@ -2,7 +2,7 @@ # Use this file to set up more complex access control lists. # Use tabs or single space to separate # -# +# # # Direction: Required ( IN | OUT ) # Action: Required (ACCEPT | DROP) @@ -14,10 +14,13 @@ # Protocol: Optional, Required if port is specified ( tcp | udp ) # Syn: Optional, only match (not) syn packets (syn | notsyn ) # State: Optional, set the connection tracking states ( comma separated list ) +# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP +# (must surround with quotes) # You can use '-' for optional fields #============================================================ -# +# #IN ACCEPT eth0 10.0.0.1 22 - - tcp - #IN DROP - - - - 22 tcp syn +#IN ACCEPT eth0 192.168.0.0/24 - 192.168.1.0/24 - - - "-m policy --dir in --pol ipsec --proto esp" diff --git a/etc/ipv4/forward.conf b/etc/ipv4/forward.conf index 12554bd..b42da87 100644 --- a/etc/ipv4/forward.conf +++ b/etc/ipv4/forward.conf @@ -2,7 +2,7 @@ # Use this file to set up network address translation rules # Use tabs or single space to separate # -# +# # # Action: Required ( ACCEPT | DROP ) # Source Interface: Optional ( interface name, aka eth0 ) @@ -17,13 +17,16 @@ # Protocol: Optional, required if port numbers specified ( tcp | udp ) # Syn: Optional, only match (not) syn packets (syn | notsyn ) # State: Optional, set the connection tracking states ( comma separated list ) +# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP +# (must surround with quotes) # # You can use '-' for optional fields #============================================================ -# +# #ACCEPT eth0 - eth1 - yes #DROP eth1 192.168.2.0/24 eth0 0/0 no #DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn NEW #ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED +#IN ACCEPT eth0 192.168.0.0/24 eth1 192.168.1.0/24 yes - - - - - "-m policy --dir in --pol ipsec --proto esp" diff --git a/etc/ipv4/nat.conf b/etc/ipv4/nat.conf index 9549267..6e674d9 100644 --- a/etc/ipv4/nat.conf +++ b/etc/ipv4/nat.conf @@ -2,16 +2,18 @@ # Use this file to set up network address translation rules # Use tabs or single space to separate # -# +# # -# Type: Required ( SNAT | MASQ | NETMAP ) +# Type: Required ( SNAT | MASQ | NETMAP | ACCEPT) # Source Interface: Optional ( interface name, aka eth0 ) # Source Address: Optional ( IP address with optional netmask ) # Destination Interface: Optional for all but MASQ ( interface name, aka eth0 ) # Destination Address: Required for all but MASQ ( IP address with optional netmask ) +# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP +# (must surround with quotes) # You can use '-' for optional fields #============================================================ -# +# #SNAT eth1 10.0.0.0/24 eth0 172.16.1.1 #MASQ - - eth0 - #NETMAP eth1 192.168.0.0/24 vpn0 172.16.10.0/24 diff --git a/etc/ipv6/acl.conf b/etc/ipv6/acl.conf index dc5aa7f..528c997 100644 --- a/etc/ipv6/acl.conf +++ b/etc/ipv6/acl.conf @@ -2,7 +2,7 @@ # Use this file to set up more complex access control lists. # Use tabs or single space to separate # -# +# # # Direction: Required ( IN | OUT ) # Action: Required (ACCEPT | DROP) @@ -14,10 +14,12 @@ # Protocol: Optional, Required if port is specified ( tcp | udp ) # Syn: Optional, only match (not) syn packets (syn | notsyn ) # State: Optional, set the connection tracking states ( comma separated list ) +# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP +# (must surround with quotes) # # You can use '-' for optional fields #============================================================ -# +# #IN ACCEPT eth0 2002:dead:beef::/64 22 - - tcp - #IN DROP - - - - 22 tcp syn - +#IN ACCEPT eth0 2002:dead:beef::/64 - 2002:dead:bfff::/64 - - - "-m policy --dir in --pol ipsec --proto esp" diff --git a/etc/ipv6/forward.conf b/etc/ipv6/forward.conf index eff38bc..f39fe19 100644 --- a/etc/ipv6/forward.conf +++ b/etc/ipv6/forward.conf @@ -2,7 +2,7 @@ # Use this file to set up network address translation rules # Use tabs or single space to separate # -# +# # # Action: Required ( ACCEPT | DROP ) # Source Interface: Optional ( interface name, aka eth0 ) @@ -17,11 +17,14 @@ # Protocol: Optional, required if port numbers specified ( tcp | udp ) # Syn: Optional, only match (not) syn packets (syn | notsyn ) # State: Optional, set the connection tracking states ( comma separated list ) +# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP +# (must surround with quotes) # # You can use '-' for optional fields #============================================================ -# +# #ACCEPT eth0 - eth1 - yes #DROP eth1 2002::/64 eth0 2001::/3 no #DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn -#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED \ No newline at end of file +#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED +#IN ACCEPT eth0 2002:dead:beef::/64 eth1 2002:dead:bfff::/64 yes - - - - - "-m policy --dir in --pol ipsec --proto esp" \ No newline at end of file diff --git a/etc/ipv6/nat.conf b/etc/ipv6/nat.conf index 5b33ffb..676b05f 100644 --- a/etc/ipv6/nat.conf +++ b/etc/ipv6/nat.conf @@ -2,16 +2,18 @@ # Use this file to set up network address translation rules # Use tabs or single space to separate # -# +# # -# Type: Required ( SNAT | MASQ | NETMAP ) +# Type: Required ( SNAT | MASQ | NETMAP | ACCEPT) # Source Interface: Optional ( interface name, aka eth0 ) # Source Address: Optional ( IP address with optional netmask ) # Destination Interface: Optional for all but MASQ ( interface name, aka eth0 ) # Destination Address: Required for all but MASQ ( IP address with optional netmask ) +# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP +# (must surround with quotes) # You can use '-' for optional fields #============================================================ -# +# #SNAT eth1 2002::/64 eth0 2001::1 #MASQ - - eth0 - #NETMAP eth1 2002::/64 vpn0 fc00::/64 diff --git a/lib/iptables.inc b/lib/iptables.inc index 930a49b..5bf8ad8 100644 --- a/lib/iptables.inc +++ b/lib/iptables.inc @@ -317,7 +317,7 @@ function enable_filtering { ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading" if [ -e "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" ]; then ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/acl.conf successful" - while read -r direction action interface srcaddress srcport dstaddress dstport protocol syn state; do + while read -r direction action interface srcaddress srcport dstaddress dstport protocol syn state custom; do [[ ${direction} = \#* ]] && continue [[ ${direction} = "" ]] && continue ([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \ @@ -343,7 +343,7 @@ function enable_filtering { [[ ${syn} == "syn" ]] && syn="--syn" [[ ${syn} == "notsyn" ]] && syn="! --syn" - ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn}" + ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn} ${custom}" # Blank variables that we're not going to use. [[ ${interface} == "-" ]] && interface="" @@ -353,8 +353,9 @@ function enable_filtering { [[ ${srcaddress} == "-" ]] && srcaddress="" [[ ${protocol} == "-" ]] && protocol="" [[ ${syn} == "-" ]] && syn="" + [[ ${custom} == "-" ]] && custom="" - ${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${syn} ${dstaddress} ${dstport} ${conntrack_state} -j ${action} + ${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${syn} ${dstaddress} ${dstport} ${conntrack_state} ${custom} -j ${action} done < "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" fi @@ -371,7 +372,7 @@ function enable_forwarding { ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading" if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful" - while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn state; do + while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn state custom; do unset conntrack_state conntrack_udp_new revsrcaddress revdstaddress revdstinterface revsrcinterface revsrcport revdstport [[ ${action} = \#* ]] && continue [[ -z ${action} ]] && continue @@ -425,9 +426,10 @@ function enable_forwarding { [[ ${state} == "-" ]] && state="" [[ ${protocol} == "-" ]] && protocol="" [[ ${bidirectional} == "-" ]] && bidirectional="no" + [[ ${custom} == "-" ]] && custom="" - ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} -j ${action} - [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} -j ${action} + ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} ${custom} -j ${action} + [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} ${custom} -j ${action} done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" fi @@ -447,16 +449,16 @@ function enable_nat { if [ -e "${FWCONFIGDIR}/ipv${IPVER}/nat.conf" ]; then ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/nat.conf successful" - while read -r type srcinterface srcaddress dstinterface dstaddress; do + while read -r type srcinterface srcaddress dstinterface dstaddress custom; do [[ ${type} = \#* ]] && continue [[ ${type} = "" ]] && continue - ([[ ${type} != "SNAT" ]] && [[ ${type} != "MASQ" ]] && [[ ${type} != "NETMAP" ]]) \ - && ${display} RED "nat.conf: Error - must begin with SNAT/MASQ/NETMAP: ${DEFAULT_COLOR}${type} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress}" && continue + ([[ ${type} != "SNAT" ]] && [[ ${type} != "MASQ" ]] && [[ ${type} != "NETMAP" ]] && [[ ${type} != "ACCEPT") \ + && ${display} RED "nat.conf: Error - must begin with SNAT/MASQ/NETMAP/ACCEPT: ${DEFAULT_COLOR}${type} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${custom}" && continue # Do some creative work with variables to make building the iptables rules fairly painless - [[ ${srcaddress} != "-" ]] && revsrcaddress="-d ${srcaddress}" - [[ ${dstinterface} != "-" ]] && revdstinterface="-i ${dstinterface}" - [[ ${srcinterface} != "-" ]] && revsrcinterface="-o ${srcinterface}" + #[[ ${srcaddress} != "-" ]] && revsrcaddress="-d ${srcaddress}" + #[[ ${dstinterface} != "-" ]] && revdstinterface="-i ${dstinterface}" + #[[ ${srcinterface} != "-" ]] && revsrcinterface="-o ${srcinterface}" [[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}" [[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}" ([[ ${srcaddress} != "-" ]] && [[ ${type} != "NETMAP" ]]) && srcaddress="-s ${srcaddress}" @@ -474,17 +476,18 @@ function enable_nat { ([[ ${srcaddress} != "-" ]] && [[ ${dstaddress} != "-" ]] && [[ ${type} == "NETMAP" ]]) && action="-j NETMAP" && srcaddress="-d ${srcaddress}" && dstaddress="--to ${dstaddress}" - ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" + ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${custom}" # Blank variables that we're not going to use. [[ ${srcinterface} == "-" ]] && srcinterface="" [[ ${dstinterface} == "-" ]] && dstinterface="" [[ ${dstaddress} == "-" ]] && dstaddress="" [[ ${srcaddress} == "-" ]] && srcaddress="" + [[ ${custom} == "-" ]] && custom="" - ${VER_IPTABLES} -A ${NAT} -t nat ${srcaddress} ${action} ${dstinterface} ${dstaddress} - ${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED,NEW ${srcinterface} ${srcaddress} ${dstinterface} -j ACCEPT - ${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED ${revsrcinterface} ${revsrcaddress} ${revdstinterface} -j ACCEPT + ${VER_IPTABLES} -A ${NAT} -t nat ${srcaddress} ${dstinterface} ${dstaddress} ${custom} ${action} + #${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED,NEW ${srcinterface} ${srcaddress} ${dstinterface} -j ACCEPT + #${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED ${revsrcinterface} ${revsrcaddress} ${revdstinterface} -j ACCEPT done < "${FWCONFIGDIR}/ipv${IPVER}/nat.conf" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" fi