From f196177c1eb5c63f59239d4997383a8b1ef3ca2a Mon Sep 17 00:00:00 2001 From: bbruns Date: Sat, 12 Apr 2014 18:57:23 +0000 Subject: [PATCH] Expand forward filtering to work with ports/protocols --- etc/ipv4/forward.conf | 14 +++++++++++--- etc/ipv6/forward.conf | 14 ++++++++++---- lib/iptables.inc | 20 ++++++++++++++------ 3 files changed, 35 insertions(+), 13 deletions(-) diff --git a/etc/ipv4/forward.conf b/etc/ipv4/forward.conf index cfae29f..15af94e 100644 --- a/etc/ipv4/forward.conf +++ b/etc/ipv4/forward.conf @@ -2,18 +2,26 @@ # Use this file to set up network address translation rules # Use tabs or single space to separate # -# +# # # Action: Required ( ACCEPT | DROP ) # Source Interface: Optional ( interface name, aka eth0 ) # Source Address: Optional ( IP address with optional netmask ) # Destination Interface: Optional ( interface name, aka eth0 ) # Destination Address: Optional ( IP address with optional netmask ) -# Syn: Optional, only match (not) syn packets (syn | notsyn ) # Bidirectional: Optional ( yes | no, defaults to no if '-' ) +# +# The next set can be safely left off the end if not desired +# Source Port: Optional ( source port number, or range 1:65535 ) +# Destination Port: Optional ( destination port number, or range 1:65535 ) +# Protocol: Optional, required if port numbers specified ( tcp | udp ) +# Syn: Optional, only match (not) syn packets (syn | notsyn ) +# # You can use '-' for optional fields #============================================================ -# +# #ACCEPT eth0 - eth1 - yes #DROP eth1 192.168.2.0/24 eth0 0/0 no +#DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn + diff --git a/etc/ipv6/forward.conf b/etc/ipv6/forward.conf index 88774a4..d0dada4 100644 --- a/etc/ipv6/forward.conf +++ b/etc/ipv6/forward.conf @@ -2,18 +2,24 @@ # Use this file to set up network address translation rules # Use tabs or single space to separate # -# +# # # Action: Required ( ACCEPT | DROP ) # Source Interface: Optional ( interface name, aka eth0 ) # Source Address: Optional ( IP address with optional netmask ) # Destination Interface: Optional ( interface name, aka eth0 ) # Destination Address: Optional ( IP address with optional netmask ) -# Syn: Optional, only match (not) syn packets (syn | notsyn ) # Bidirectional: Optional ( yes | no, defaults to no if '-' ) +# +# The next set can be safely left off the end if not desired +# Source Port: Optional ( source port number, or range 1:65535 ) +# Destination Port: Optional ( destination port number, or range 1:65535 ) +# Protocol: Optional, required if port numbers specified ( tcp | udp ) +# Syn: Optional, only match (not) syn packets (syn | notsyn ) +# # You can use '-' for optional fields #============================================================ -# +# #ACCEPT eth0 - eth1 - yes #DROP eth1 2002::/64 eth0 2001::/3 no - +#DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn \ No newline at end of file diff --git a/lib/iptables.inc b/lib/iptables.inc index 933a827..d20d0d9 100644 --- a/lib/iptables.inc +++ b/lib/iptables.inc @@ -359,11 +359,11 @@ function enable_forwarding { use_conntrack="no" ([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" ([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" - while read -r action srcinterface srcaddress dstinterface dstaddress syn bidirectional; do + while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn; do [[ ${action} = \#* ]] && continue [[ ${action} = "" ]] && continue ([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \ - && ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${syn} ${bidirectional}" && continue + && ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${src-port} ${dst-port} ${protocol} ${syn}" && continue # Do some creative work with variables to make building the iptables rules fairly painless ([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}" @@ -376,21 +376,29 @@ function enable_forwarding { [[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}" [[ ${syn} == "syn" ]] && syn="--syn" [[ ${syn} == "notsyn" ]] && syn="! --syn" + [[ ${dstport} != "-" ]] && dstport="--dport ${dstport}" + [[ ${srcport} != "-" ]] && srcport="--sport ${srcport}" + ([[ ${bidirectional} == "yes" ]] && [[ ${srcport} != "-" ]]) && revsrcport="--dport ${srcport}" + ([[ ${bidirectional} == "yes" ]] && [[ ${dstport} != "-" ]]) && revdstport="--sport ${dstport}" + [[ ${protocol} != "-" ]] && protocol="-p ${protocol}" - ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${syn} ${bidirectional}" + ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${src-port} ${dst-port} ${protocol} ${syn}" # Blank variables that we're not going to use. [[ ${srcinterface} == "-" ]] && srcinterface="" [[ ${dstinterface} == "-" ]] && dstinterface="" [[ ${dstaddress} == "-" ]] && dstaddress="" [[ ${srcaddress} == "-" ]] && srcaddress="" + [[ ${dstport} == "-" ]] && dstport="" + [[ ${srcport} == "-" ]] && srcport="" + [[ ${syn} == "-" ]] && syn="" [[ ${bidirectional} == "-" ]] && bidirectional="no" [[ ${action} == "DROP" ]] && conntrack_state="" - [[ ${syn} == "-" ]] && syn="" + - ${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${syn} ${dstinterface} ${dstaddress} ${conntrack_state} -j ${action} - [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${syn} ${revdstinterface} ${revdstaddress} ${conntrack_state} -j ${action} + ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} -j ${action} + [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} -j ${action} done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" fi