brielle
/
SRFirewall
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Expand forward filtering to work with ports/protocols

master
bbruns 2014-04-12 18:57:23 +00:00
parent 4e3cbeced3
commit f196177c1e
3 changed files with 35 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
etc/ipv4/forward.conf
View File

@ -2,18 +2,26 @@
# Use this file to set up network address translation rules # Use this file to set up network address translation rules
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional> # <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn>
# #
# Action: Required ( ACCEPT | DROP ) # Action: Required ( ACCEPT | DROP )
# Source Interface: Optional ( interface name, aka eth0 ) # Source Interface: Optional ( interface name, aka eth0 )
# Source Address: Optional ( IP address with optional netmask ) # Source Address: Optional ( IP address with optional netmask )
# Destination Interface: Optional ( interface name, aka eth0 ) # Destination Interface: Optional ( interface name, aka eth0 )
# Destination Address: Optional ( IP address with optional netmask ) # Destination Address: Optional ( IP address with optional netmask )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
# Bidirectional: Optional ( yes | no, defaults to no if '-' ) # Bidirectional: Optional ( yes | no, defaults to no if '-' )
#
# The next set can be safely left off the end if not desired
# Source Port: Optional ( source port number, or range 1:65535 )
# Destination Port: Optional ( destination port number, or range 1:65535 )
# Protocol: Optional, required if port numbers specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
#
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional> #<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn>
#ACCEPT eth0 - eth1 - yes #ACCEPT eth0 - eth1 - yes
#DROP eth1 192.168.2.0/24 eth0 0/0 no #DROP eth1 192.168.2.0/24 eth0 0/0 no
#DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn

14
etc/ipv6/forward.conf
View File

@ -2,18 +2,24 @@
# Use this file to set up network address translation rules # Use this file to set up network address translation rules
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional> # <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn>
# #
# Action: Required ( ACCEPT | DROP ) # Action: Required ( ACCEPT | DROP )
# Source Interface: Optional ( interface name, aka eth0 ) # Source Interface: Optional ( interface name, aka eth0 )
# Source Address: Optional ( IP address with optional netmask ) # Source Address: Optional ( IP address with optional netmask )
# Destination Interface: Optional ( interface name, aka eth0 ) # Destination Interface: Optional ( interface name, aka eth0 )
# Destination Address: Optional ( IP address with optional netmask ) # Destination Address: Optional ( IP address with optional netmask )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
# Bidirectional: Optional ( yes | no, defaults to no if '-' ) # Bidirectional: Optional ( yes | no, defaults to no if '-' )
#
# The next set can be safely left off the end if not desired
# Source Port: Optional ( source port number, or range 1:65535 )
# Destination Port: Optional ( destination port number, or range 1:65535 )
# Protocol: Optional, required if port numbers specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
#
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <syn> <bidirectional> #<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn>
#ACCEPT eth0 - eth1 - yes #ACCEPT eth0 - eth1 - yes
#DROP eth1 2002::/64 eth0 2001::/3 no #DROP eth1 2002::/64 eth0 2001::/3 no
#DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn

20
lib/iptables.inc
View File

@ -359,11 +359,11 @@ function enable_forwarding {
use_conntrack="no" use_conntrack="no"
([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" ([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" ([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED"
while read -r action srcinterface srcaddress dstinterface dstaddress syn bidirectional; do while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn; do
[[ ${action} = \#* ]] && continue [[ ${action} = \#* ]] && continue
[[ ${action} = "" ]] && continue [[ ${action} = "" ]] && continue
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \ ([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
&& ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${syn} ${bidirectional}" && continue && ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${src-port} ${dst-port} ${protocol} ${syn}" && continue
# Do some creative work with variables to make building the iptables rules fairly painless # Do some creative work with variables to make building the iptables rules fairly painless
([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}" ([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}"
@ -376,21 +376,29 @@ function enable_forwarding {
[[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}" [[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}"
[[ ${syn} == "syn" ]] && syn="--syn" [[ ${syn} == "syn" ]] && syn="--syn"
[[ ${syn} == "notsyn" ]] && syn="! --syn" [[ ${syn} == "notsyn" ]] && syn="! --syn"
[[ ${dstport} != "-" ]] && dstport="--dport ${dstport}"
[[ ${srcport} != "-" ]] && srcport="--sport ${srcport}"
([[ ${bidirectional} == "yes" ]] && [[ ${srcport} != "-" ]]) && revsrcport="--dport ${srcport}"
([[ ${bidirectional} == "yes" ]] && [[ ${dstport} != "-" ]]) && revdstport="--sport ${dstport}"
[[ ${protocol} != "-" ]] && protocol="-p ${protocol}"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${syn} ${bidirectional}" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${src-port} ${dst-port} ${protocol} ${syn}"
# Blank variables that we're not going to use. # Blank variables that we're not going to use.
[[ ${srcinterface} == "-" ]] && srcinterface="" [[ ${srcinterface} == "-" ]] && srcinterface=""
[[ ${dstinterface} == "-" ]] && dstinterface="" [[ ${dstinterface} == "-" ]] && dstinterface=""
[[ ${dstaddress} == "-" ]] && dstaddress="" [[ ${dstaddress} == "-" ]] && dstaddress=""
[[ ${srcaddress} == "-" ]] && srcaddress="" [[ ${srcaddress} == "-" ]] && srcaddress=""
[[ ${dstport} == "-" ]] && dstport=""
[[ ${srcport} == "-" ]] && srcport=""
[[ ${syn} == "-" ]] && syn=""
[[ ${bidirectional} == "-" ]] && bidirectional="no" [[ ${bidirectional} == "-" ]] && bidirectional="no"
[[ ${action} == "DROP" ]] && conntrack_state="" [[ ${action} == "DROP" ]] && conntrack_state=""
[[ ${syn} == "-" ]] && syn=""
${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${syn} ${dstinterface} ${dstaddress} ${conntrack_state} -j ${action}
[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${syn} ${revdstinterface} ${revdstaddress} ${conntrack_state} -j ${action} ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} -j ${action}
[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} -j ${action}
done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
fi fi