126 lines
4.3 KiB
Plaintext
Executable File
126 lines
4.3 KiB
Plaintext
Executable File
#/bin/bash
|
|
# By Brielle Bruns <bruns@2mbit.com>
|
|
# URL: http://www.sosdg.org/freestuff/firewall
|
|
# License: GPLv3
|
|
#
|
|
# Copyright (C) 2009 - 2014 Brielle Bruns
|
|
# Copyright (C) 2009 - 2014 The Summit Open Source Development Group
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
# Static config options, normally do not need to change
|
|
FW_VERSION="2.0"
|
|
|
|
# Important directory locations
|
|
FWPREFIX="/usr/local"
|
|
FWCONFIGDIR="${FWPREFIX}/etc/srfirewall"
|
|
FWLIBDIR="${FWPREFIX}/lib/srfirewall"
|
|
FWBINDIR="${FWPREFIX}/bin"
|
|
|
|
# Begin sourcing critical files, because we need things like path right away
|
|
source "${FWLIBDIR}/binaries.inc"
|
|
source "${FWLIBDIR}/iptables.inc"
|
|
source "${FWLIBDIR}/display.inc"
|
|
|
|
source "${FWCONFIGDIR}/main.conf"
|
|
|
|
source "${FWCONFIGDIR}/chains.conf"
|
|
source "${FWCONFIGDIR}/ipv4.conf"
|
|
source "${FWCONFIGDIR}/ipv6.conf"
|
|
|
|
# We require at least bash v3 or later at this point given some of the more complex
|
|
# operations we do to make the firewall script work.
|
|
if (( ${BASH_VERSINFO[0]} <= "2" )); then
|
|
echo "Error: We can only run with bash 3.0 or higher. Please upgrade your version"
|
|
echo "of bash to something more recent, preferably the latest which is, as of this"
|
|
echo "writing, 4.x"
|
|
exit 1
|
|
fi
|
|
|
|
# Swap out display_c command for dummy command if they don't want
|
|
# output when command is run.
|
|
if [[ "${DisplayDetailedOutput}" == "yes" ]]; then
|
|
display="display_c"
|
|
else
|
|
display="true"
|
|
fi
|
|
|
|
# Swap out display_c command for dummy command if they don't want
|
|
# debug output when command is run.
|
|
if [[ "${DisplayDebugInfo}" == "yes" ]]; then
|
|
debug="display_c"
|
|
else
|
|
debug="true"
|
|
fi
|
|
|
|
#if [ "$UID" != "0" ] && [ "${DebugOverride}" != "yes" ]; then
|
|
# ${display} RED "You must be root to run this script."
|
|
# exit 2
|
|
#fi
|
|
|
|
if [ ! -x "${IPTABLES}" ] && [ "${EnableIPv4}" == "yes" ] && [ "${DebugOverride}" != "yes" ]; then
|
|
${display} RED "iptables command not found. Please make sure you have the iptables"
|
|
${display} RED "installed (package or source) and you have the IPTABLES option properly"
|
|
${display} RED "defined in the 'main.conf' file if needed."
|
|
exit 3
|
|
fi
|
|
|
|
|
|
if [ ! -x "${IP6TABLES}" ] && [ "${EnableIPv6}" == "yes" ] && [ "${DebugOverride}" != "yes" ]; then
|
|
${display} RED "ip6tables command not found. Please make sure you have the iptables"
|
|
${display} RED "installed (package or source) and you have the IP6TABLES option properly"
|
|
${display} RED "defined in the 'main.conf' file if needed."
|
|
exit 3
|
|
fi
|
|
|
|
if [ ! -e "/proc/net/ip_tables_names" ] && [ "${EnableIPv4}" == "yes" ] && [ "${DebugOverride}" != "yes" ]; then
|
|
${display} RED "IPv4 Netfilter modules do not appear to be loaded. Attempting to load now..."
|
|
if ! `${MODPROBE} ${IP4TablesMod} &>/dev/null`; then
|
|
${display} RED "Module ${IP4TablesMod} failed to load."
|
|
${display} RED "Will continue with IPv4 disabled."
|
|
EnableIPv4="no"
|
|
else
|
|
${display} GREEN "Module successfully loaded."
|
|
fi
|
|
fi
|
|
|
|
if [ ! -e "/proc/net/ip6_tables_names" ] && [ "${EnableIPv6}" == "yes" ] && [ "${DebugOverride}" != "yes" ]; then
|
|
${display} RED "IPv6 Netfilter modules do not appear to be loaded. Attempting to load now..."
|
|
if ! `${MODPROBE} ${IP6TablesMod} &>/dev/null`; then
|
|
${display} RED "Module ${IP6TablesMod} failed to load."
|
|
${display} RED "Will continue with IPv6 disabled."
|
|
EnableIPv6="no"
|
|
else
|
|
${display} GREEN "Module successfully loaded."
|
|
fi
|
|
fi
|
|
|
|
if [[ "${EnableIPv4}" == "yes" ]]; then
|
|
# First flush all rules
|
|
iptables_rules_flush ipv4
|
|
|
|
# Create the chain sets we'll need and the ones that can be
|
|
# customized by users in their custom rules
|
|
setup_iptables_chains ipv4
|
|
fi
|
|
|
|
if [[ "${EnableIPv6}" == "yes" ]]; then
|
|
# First flush all rules
|
|
iptables_rules_flush ipv6
|
|
|
|
# Create the chain sets we'll need and the ones that can be
|
|
# customized by users in their custom rules
|
|
setup_iptables_chains ipv6
|
|
fi
|
|
|