Menu
▾
▴
[Devil-linux-commit] build/config/etc/init.d firewall.rules.2nic,1.13,1.13.2.1 firewall.rules.3nic,1.10,1.10.2.1
|
From: Bruce S. <bl...@us...> - 2005-08-10 05:07:19
|
Update of /cvsroot/devil-linux/build/config/etc/init.d In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv9378 Modified Files: Tag: rel-1-2-patches firewall.rules.2nic firewall.rules.3nic Log Message: Rules for BScap captive portal. Index: firewall.rules.3nic =================================================================== RCS file: /cvsroot/devil-linux/build/config/etc/init.d/firewall.rules.3nic,v retrieving revision 1.10 retrieving revision 1.10.2.1 diff -u -d -r1.10 -r1.10.2.1 --- firewall.rules.3nic 12 Apr 2004 00:24:03 -0000 1.10 +++ firewall.rules.3nic 8 Aug 2005 20:41:12 -0000 1.10.2.1 @@ -38,7 +38,14 @@ echo "0" > /proc/sys/net/ipv4/ip_forward # Uncomment the following line to enable logging: -# LOGGING="yes" +LOGGING="yes" + +# Uncomment & set the next three vars to activate the BScap captive portal. +#BSCAP="yes" +# set to your DNS server IP's: (for BScap) +#DNSHOSTS="192.168.1.254 192.168.9.254" +# set to your private IP range: (for BScap) +#CAPNET="192.168.9.0/24" # Optional Modules: ${MODPROBE} ip_conntrack_ftp @@ -46,10 +53,17 @@ ${MODPROBE} ip_conntrack_irc ${MODPROBE} ip_nat_irc #${MODPROBE} ip_owner +${MODPROBE} ipt_state # Only needed if we're going to log. [ -n "$LOGGING" ] && ${MODPROBE} ipt_LOG +if [ -n "$BSCAP" ]; then + ${MODPROBE} ipt_mac + ${MODPROBE} ipt_mark + ${MODPROBE} ipt_REDIRECT +fi + # Flush tables & setup Policy ${IPTABLES} -F # flush chains ${IPTABLES} -X # delete user chains @@ -60,10 +74,19 @@ ${IPTABLES} -X -t $t ${IPTABLES} -Z -t $t done + +### BEGIN IPTABLES rules ### + ${IPTABLES} -P INPUT DROP # Policy = DROP ${IPTABLES} -P OUTPUT DROP # Drop all packets that are ${IPTABLES} -P FORWARD DROP # not specifically accepted. +# make interactive sesions a bit more interactive under load +${IPTABLES} -t mangle -N SETTOS +${IPTABLES} -A SETTOS -t mangle -p TCP --sport ssh -j TOS --set-tos Minimize-Delay +${IPTABLES} -A SETTOS -t mangle -p TCP --sport ftp -j TOS --set-tos Minimize-Delay +${IPTABLES} -A SETTOS -t mangle -p TCP --sport ftp-data -j TOS --set-tos Maximize-Throughput + # Local interface - do not delete! ${IPTABLES} -A INPUT -i lo -j ACCEPT ${IPTABLES} -A OUTPUT -o lo -j ACCEPT @@ -83,9 +106,6 @@ # Fast reject for Ident to eliminate email delays. ${IPTABLES} -A INPUT -p TCP --dport 113 -i ${OUT_DEV} -j REJECT --reject-with tcp-reset -# Masquerading (aka NAT, PAT, ...) -${IPTABLES} -t nat -A POSTROUTING -o ${OUT_DEV} -j MASQUERADE - # Uncomment/modify the next 3 lines to allow access to one port on one IP on internal host from DMZ: # SERVER_IP=192.168.1.1 # Internal IP. # PORT=22 # 22 = SSH. Change to 80 for web server, etc. @@ -107,6 +127,43 @@ # PORT=25 # 25 = SMTP. Change to the port you wish to open. # ${IPTABLES} -A INPUT -p tcp --dport $PORT -i ${DMZ_DEV} -j ACCEPT +${IPTABLES} -t mangle -A PREROUTING -j SETTOS + +if [ -n "$BSCAP" ]; then + # Block outgoing port 25 to prevent spam from being sent + [ -n "$LOGGING" ] && \ + ${IPTABLES} -A FORWARD -p tcp --dport 25 -i ${DMZ_DEV} -j LOG --log-prefix "Outgoing email: " + ${IPTABLES} -A FORWARD -p tcp --dport 25 -i ${DMZ_DEV} -j REJECT + # Open up 443 (https) for BScap admin connections from the outside. + # Add a "-s" to limit the connections to a specific network or IP. + ${IPTABLES} -A INPUT -p tcp --dport 443 -i ${OUT_DEV} -j ACCEPT + # Open up 22 (SSH) for remote DL administration + # Add a "-s" to limit the connections to a specific network or IP. + ${IPTABLES} -A INPUT -p tcp --dport 22 -i ${OUT_DEV} -j ACCEPT + # Allow DMZ connections to Apache for BScap + ${IPTABLES} -A INPUT -p tcp --dport 80 -i ${DMZ_DEV} -j ACCEPT + ${IPTABLES} -A INPUT -p tcp --dport 443 -i ${DMZ_DEV} -j ACCEPT + # Allow internal network access to Internet (Masquerading) + ${IPTABLES} -t nat -A POSTROUTING ! -s ${CAPNET} -o ${OUT_DEV} -j MASQUERADE + # Chain for BScap rules (manipulated externally with PHP) + ${IPTABLES} -t mangle -N BScap + ${IPTABLES} -t mangle -A PREROUTING -s ${CAPNET} -j MARK --set-mark 0x4 + ${IPTABLES} -t mangle -A PREROUTING -j BScap + # Redirect all unauthenticated Internet access to local web server + ${IPTABLES} -t nat -A PREROUTING -p tcp -m mark --mark 0x4 --dport 80 -j REDIRECT --to-ports 80 + ${IPTABLES} -t nat -A PREROUTING -p tcp -m mark --mark 0x4 --dport 443 -j REDIRECT --to-ports 443 + # Always allow DNS lookups + for h in $DNSHOSTS + do + ${IPTABLES} -t nat -A POSTROUTING -s ${CAPNET} -d $h -p tcp --dport 53 -j MASQUERADE + ${IPTABLES} -t nat -A POSTROUTING -s ${CAPNET} -d $h -p udp --dport 53 -j MASQUERADE + done + # Allow only BScap authenticated IP/MAC combo's access to Internet (Masquerading) + ${IPTABLES} -t nat -A POSTROUTING -s ${CAPNET} -o ${OUT_DEV} -m mark --mark 0x2 -j MASQUERADE +else + # Masquerading for everyone (aka NAT, PAT, ...) + ${IPTABLES} -t nat -A POSTROUTING -o ${OUT_DEV} -j MASQUERADE +fi # Block invalid connections from the internet. [ -n "$LOGGING" ] && \ ${IPTABLES} -A FORWARD -m state --state NEW,INVALID -i ${OUT_DEV} -j LOG --log-prefix "FORWARD INVALID: " @@ -132,11 +189,6 @@ ${IPTABLES} -t nat -A PREROUTING -p TCP --dport 445 -j DROP ${IPTABLES} -t nat -A PREROUTING -p UDP --dport 445 -j DROP -# make interactive sesions a bit more interactive under load -${IPTABLES} -A PREROUTING -t mangle -p TCP --sport ssh -j TOS --set-tos Minimize-Delay -${IPTABLES} -A PREROUTING -t mangle -p TCP --sport ftp -j TOS --set-tos Minimize-Delay -${IPTABLES} -A PREROUTING -t mangle -p TCP --sport ftp-data -j TOS --set-tos Maximize-Throughput - # Log invalid packets from DROP policy: if [ -n "$LOGGING" ] ; then ${IPTABLES} -A INPUT -d 255.255.255.255 -j DROP # do not log broadcasts @@ -146,6 +198,8 @@ ${IPTABLES} -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "FORWARD policy: " fi +### END IPTABLES rules ### + # enable dynamic IP address following echo 2 > /proc/sys/net/ipv4/ip_dynaddr Index: firewall.rules.2nic =================================================================== RCS file: /cvsroot/devil-linux/build/config/etc/init.d/firewall.rules.2nic,v retrieving revision 1.13 retrieving revision 1.13.2.1 diff -u -d -r1.13 -r1.13.2.1 --- firewall.rules.2nic 12 Apr 2004 00:24:03 -0000 1.13 +++ firewall.rules.2nic 8 Aug 2005 20:41:12 -0000 1.13.2.1 @@ -39,16 +39,30 @@ # Uncomment the following line to enable logging: # LOGGING="yes" +# Uncomment & set the next three vars to activate the BScap captive portal. +#BSCAP="yes" +# set to your DNS server IP's: (for BScap) +#DNSHOSTS="192.168.1.254 192.168.9.254" +# set to your private IP range: (for BScap) +#CAPNET="192.168.1.0/24" + # Optional Modules: ${MODPROBE} ip_conntrack_ftp ${MODPROBE} ip_nat_ftp ${MODPROBE} ip_conntrack_irc ${MODPROBE} ip_nat_irc #${MODPROBE} ip_owner +${MODPROBE} ipt_state # Only needed if we're going to log. [ -n "$LOGGING" ] && ${MODPROBE} ipt_LOG +if [ -n "$BSCAP" ]; then + ${MODPROBE} ipt_mac + ${MODPROBE} ipt_mark + ${MODPROBE} ipt_REDIRECT +fi + # Flush tables & setup Policy ${IPTABLES} -F # flush chains ${IPTABLES} -X # delete user chains @@ -59,10 +73,19 @@ ${IPTABLES} -X -t $t ${IPTABLES} -Z -t $t done + +### BEGIN IPTABLES rules ### + ${IPTABLES} -P INPUT DROP # Policy = DROP ${IPTABLES} -P OUTPUT DROP # Drop all packets that are ${IPTABLES} -P FORWARD DROP # not specifically accepted. +# make interactive sesions a bit more interactive under load +${IPTABLES} -t mangle -N SETTOS +${IPTABLES} -A SETTOS -t mangle -p TCP --sport ssh -j TOS --set-tos Minimize-Delay +${IPTABLES} -A SETTOS -t mangle -p TCP --sport ftp -j TOS --set-tos Minimize-Delay +${IPTABLES} -A SETTOS -t mangle -p TCP --sport ftp-data -j TOS --set-tos Maximize-Throughput + # Local interface - do not delete! ${IPTABLES} -A INPUT -i lo -j ACCEPT ${IPTABLES} -A OUTPUT -o lo -j ACCEPT @@ -82,9 +105,6 @@ # Fast reject for Ident to eliminate email delays. ${IPTABLES} -A INPUT -p TCP --dport 113 -i ${OUT_DEV} -j REJECT --reject-with tcp-reset -# Masquerading (aka NAT, PAT, ...) -${IPTABLES} -t nat -A POSTROUTING -o ${OUT_DEV} -j MASQUERADE - # Uncomment/modify the next 4 lines to forward a service to an internal IP. # SERVER_IP=192.168.1.1 # Internal IP of server. # PORT=22 # 22 = SSH. Change to 80 for web server, etc. @@ -95,6 +115,39 @@ # PORT=25 # 25 = SMTP. Change to the port you wish to open. # ${IPTABLES} -A INPUT -p tcp --dport $PORT -i ${OUT_DEV} -j ACCEPT +${IPTABLES} -t mangle -A PREROUTING -j SETTOS + +if [ -n "$BSCAP" ]; then + # Block outgoing port 25 to prevent spam from being sent + [ -n "$LOGGING" ] && \ + ${IPTABLES} -A FORWARD -p tcp --dport 25 -i ${DMZ_DEV} -j LOG --log-prefix "Outgoing email: " + ${IPTABLES} -A FORWARD -p tcp --dport 25 -i ${DMZ_DEV} -j REJECT + # Open up 443 (https) for BScap admin connections from the outside. + # Add a "-s" to limit the connections to a specific network or IP. + ${IPTABLES} -A INPUT -p tcp --dport 443 -i ${OUT_DEV} -j ACCEPT + # Open up 22 (SSH) for remote DL administration + # Add a "-s" to limit the connections to a specific network or IP. + ${IPTABLES} -A INPUT -p tcp --dport 22 -i ${OUT_DEV} -j ACCEPT + # Chain for BScap rules (manipulated externally with PHP) + ${IPTABLES} -t mangle -N BScap + ${IPTABLES} -t mangle -A PREROUTING -i ${INT_DEV} -j MARK --set-mark 0x4 + ${IPTABLES} -t mangle -A PREROUTING -j BScap + # Redirect all unauthenticated Internet access to local web server + ${IPTABLES} -t nat -A PREROUTING -p tcp -m mark --mark 0x4 --dport 80 -j REDIRECT --to-ports 80 + ${IPTABLES} -t nat -A PREROUTING -p tcp -m mark --mark 0x4 --dport 443 -j REDIRECT --to-ports 443 + # Always allow DNS lookups + for h in $DNSHOSTS + do + ${IPTABLES} -t nat -A POSTROUTING -s ${CAPNET} -d $h -p tcp --dport 53 -j MASQUERADE + ${IPTABLES} -t nat -A POSTROUTING -s ${CAPNET} -d $h -p udp --dport 53 -j MASQUERADE + done + # Allow only BScap authenticated IP/MAC combo's access to Internet (Masquerading) + ${IPTABLES} -t nat -A POSTROUTING -o ${OUT_DEV} -m mark --mark 0x2 -j MASQUERADE +else + # Masquerading for everyone (aka NAT, PAT, ...) + ${IPTABLES} -t nat -A POSTROUTING -o ${OUT_DEV} -j MASQUERADE +fi + # Block invalid connections from the internet. [ -n "$LOGGING" ] && \ ${IPTABLES} -A FORWARD -m state --state NEW,INVALID -i ${OUT_DEV} -j LOG --log-prefix "FORWARD INVALID: " @@ -112,11 +165,6 @@ ${IPTABLES} -t nat -A PREROUTING -p TCP --dport 445 -j DROP ${IPTABLES} -t nat -A PREROUTING -p UDP --dport 445 -j DROP -# make interactive sesions a bit more interactive under load -${IPTABLES} -A PREROUTING -t mangle -p TCP --sport ssh -j TOS --set-tos Minimize-Delay -${IPTABLES} -A PREROUTING -t mangle -p TCP --sport ftp -j TOS --set-tos Minimize-Delay -${IPTABLES} -A PREROUTING -t mangle -p TCP --sport ftp-data -j TOS --set-tos Maximize-Throughput - # Log invalid packets from DROP policy: if [ -n "$LOGGING" ] ; then ${IPTABLES} -A INPUT -d 255.255.255.255 -j DROP # do not log broadcasts @@ -126,6 +174,8 @@ ${IPTABLES} -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "FORWARD policy: " fi +### END IPTABLES rules ### + # enable dynamic IP address following echo 2 > /proc/sys/net/ipv4/ip_dynaddr |
