| 7,10 → 7,10 |
|---|
| # Reminders |
| # There are four channels for log : |
| # 1 tracability of the consultation equipment with The 'Netflow' kernel module (iptables target = NETFLOW); |
| # 2 protection of ALCASAR with the Ulog group 1 (default group) |
| # 2 protection of ALCASAR with the Ulog group 1 (default group) |
| # 3 SSH on ALCASAR with the Ulog group 2; |
| # 4 extern access attempts on ALCASAR with the Ulog group 3. |
| # The bootps/dhcp (67) port is always open on tun0/INTIF by coova |
| # The bootps/dhcp (67) port is always open on tun0/INTIF by coova |
| CONF_FILE="/usr/local/etc/alcasar.conf" |
| EXTIF=`grep ^EXTIF= $CONF_FILE|cut -d"=" -f2` # EXTernal InterFace |
| INTIF=`grep ^INTIF= $CONF_FILE|cut -d"=" -f2` # INTernal InterFace |
| 35,7 → 35,7 |
|---|
| DNSSERVERS="$dns1,$dns2" # first and second public DNS servers |
| BL_IP_CAT="/usr/local/share/iptables-bl-enabled" # categories files of the BlackListed IP |
| WL_IP_CAT="/usr/local/share/iptables-wl-enabled" # categories files of the WhiteListed IP |
| TMP_users_set_save="/tmp/users_set_save" # tmp file for backup users set |
| TMP_users_set_save="/tmp/users_set_save" # tmp file for backup users set |
| TMP_set_save="/tmp/ipset_save" # tmp file for blacklist and whitelist creation |
| SSH=`grep ^SSH= $CONF_FILE|cut -d"=" -f2` # sshd active (on/off) |
| SSH=${SSH:=off} |
| 129,7 → 129,7 |
|---|
| ipset -! restore < $TMP_set_save |
| rm -f $TMP_set_save |
| |
| # Restoration des SET des utilisateurs connectés si ils existent sinon création des SET |
| # Restoration des SET des utilisateurs connectés si ils existent sinon création des SET |
| # Restoring the connected users SETs if available, otherwise creating SETs |
| if [ -e $TMP_users_set_save ]; |
| then |
| 188,7 → 188,7 |
|---|
| # redirect DNS of 'havp_wl' users to port 55 |
| $IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_wl src -d $PRIVATE_IP -p udp --dport domain -j REDIRECT --to-port 55 |
| |
| # Journalisation HTTP_Internet des usagers 'havp_bl' (paquets SYN uniquement). Les autres protocoles sont journalisés en FORWARD par netflow. |
| # Journalisation HTTP_Internet des usagers 'havp_bl' (paquets SYN uniquement). Les autres protocoles sont journalisés en FORWARD par netflow. |
| # Log Internet HTTP of 'havp_bl' users" (only syn packets). Other protocols are logged in FORWARD by netflow |
| $IPTABLES -A PREROUTING -t nat -i $TUNIF -m set --match-set havp_bl src ! -d $PRIVATE_IP -p tcp --dport http -m state --state NEW -j NFLOG --nflog-group 1 --nflog-prefix "RULE F_http -- ACCEPT " |
| |
| 230,7 → 230,7 |
|---|
| $IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP |
| $IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP |
| |
| # Si configéré, on autorise les réponses DHCP |
| # Si configéré, on autorise les réponses DHCP |
| # Allow DHCP answers if configured |
| public_ip_mask=`grep ^PUBLIC_IP= $CONF_FILE|cut -d"=" -f2` # ALCASAR WAN IP address |
| if [[ "$public_ip_mask" == "dhcp" ]] |
| 239,7 → 239,7 |
|---|
| $IPTABLES -A OUTPUT -o $EXTIF -p udp --dport 68 -j ACCEPT |
| fi |
| # On rejette les trame en broadcast et en multicast sur EXTIF (évite leur journalisation) |
| # Drop broadcast & multicast on EXTIF to avoid log |
| # Drop broadcast & multicast on EXTIF to avoid log |
| $IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP |
| |
| # On autorise les retours de connexions légitimes par INPUT |
| 250,7 → 250,7 |
|---|
| # Deny direct connections on DansGuardian port (8080). The concerned paquets have been marked and logged in mangle table (PREROUTING) |
| $IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset |
| |
| # Autorisation des connexions légitimes à DansGuardian |
| # Autorisation des connexions légitimes à DansGuardian |
| # Allow connections for DansGuardian |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT |
| |
| 258,7 → 258,7 |
|---|
| # Deny direct connections on tinyproxy port (8090). The concerned paquets have been marked in mangle table (PREROUTING) |
| $IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8090 -m mark --mark 2 -j REJECT --reject-with tcp-reset |
| |
| # Autorisation des connexions légitimes vers tinyproxy |
| # Autorisation des connexions légitimes vers tinyproxy |
| # Allow connections to tinyproxy |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8090 -m state --state NEW --syn -j ACCEPT |
| |
| 294,7 → 294,7 |
|---|
| |
| # Accès direct aux services internes |
| # Internal services access |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j ACCEPT # DNS |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport domain -j ACCEPT # DNS |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport domain -j ACCEPT # DNS |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 8 -j ACCEPT # Réponse ping # ping responce |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p icmp --icmp-type 0 -j ACCEPT # Requête ping # ping request |
| 303,7 → 303,7 |
|---|
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport 3990:3991 -j ACCEPT # Requêtes de deconnexion usagers # Users logout requests |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT # Serveur local de temps # local time server |
| |
| # SSHD rules if activate |
| # SSHD rules if activate |
| if [ $SSH = on ] |
| then |
| $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j NFLOG --nflog-group 2 --nflog-prefix "RULE ssh-from-LAN -- ACCEPT" |
| 315,7 → 315,7 |
|---|
| # Insertion de règles locales |
| # Here, we add local rules (i.e. VPN from Internet) |
| if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then |
| . /usr/local/etc/alcasar-iptables-local.sh |
| . /usr/local/etc/alcasar-iptables-local.sh |
| fi |
| |
| # Journalisation et rejet des connexions (autres que celles autorisées) effectuées depuis le LAN |
| 352,11 → 352,11 |
|---|
| # Allow Conntrack |
| $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
| |
| # Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...) |
| # Compute uamallowed IP (IP address of equipments connected between ALCASAR and Internet (DMZ, own servers, ...) |
| nb_uamallowed=`wc -l /usr/local/etc/alcasar-uamallowed | cut -d" " -f1` |
| if [ $nb_uamallowed != "0" ] |
| then |
| while read ip_allowed_line |
| while read ip_allowed_line |
| do |
| ip_allowed=`echo $ip_allowed_line|cut -d"\"" -f2` |
| $IPTABLES -A FORWARD -i $TUNIF -d $ip_allowed -m state --state NEW -j NETFLOW |
| 421,7 → 421,7 |
|---|
| $IPTABLES -A FORWARD -i $TUNIF -m set --match-set proto_3 src -s $PRIVATE_NETWORK_MASK -p udp -m multiport ! --dports $custom_udp_protocols_list -m state --state NEW -j REJECT --reject-with icmp-port-unreachable |
| fi |
| |
| # journalisation et autorisation des connections sortant du LAN |
| # journalisation et autorisation des connections sortant du LAN |
| # Allow forward connections with log |
| $IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j NETFLOW |
| $IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT |
| 433,7 → 433,7 |
|---|
| # Everything is allowed but traffic through outside network interface |
| $IPTABLES -A OUTPUT ! -o $EXTIF -j ACCEPT |
| |
| # Si configéré, on autorise les requêtes DHCP |
| # Si configéré, on autorise les requêtes DHCP |
| # Allow DHCP requests if configured |
| public_ip_mask=`grep ^PUBLIC_IP= $CONF_FILE|cut -d"=" -f2` # ALCASAR WAN IP address |
| if [[ "$public_ip_mask" == "dhcp" ]] |
| 442,7 → 442,7 |
|---|
| $IPTABLES -A OUTPUT -o $EXTIF -p udp --dport 67 -j ACCEPT |
| fi |
| |
| # On autorise les requêtes DNS vers les serveurs DNS identifiés |
| # On autorise les requêtes DNS vers les serveurs DNS identifiés |
| # Allow DNS requests to identified DNS servers |
| $IPTABLES -A OUTPUT -o $EXTIF -d $DNSSERVERS -p udp --dport domain -m state --state NEW -j ACCEPT |
| |
| 459,17 → 459,17 |
|---|
| # RSYNC requests are allowed (to update BL of Toulouse) |
| $IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport rsync -j ACCEPT |
| |
| # On autorise les requêtes FTP |
| # On autorise les requêtes FTP |
| # FTP requests are allowed |
| modprobe nf_conntrack_ftp |
| $IPTABLES -A OUTPUT -o $EXTIF -p tcp --dport ftp -j ACCEPT |
| $IPTABLES -A OUTPUT -o $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT |
| |
| # On autorise les requêtes NTP |
| # On autorise les requêtes NTP |
| # NTP requests are allowed |
| $IPTABLES -A OUTPUT -o $EXTIF -p udp --dport ntp -j ACCEPT |
| |
| # On autorise les requêtes ICMP (ping) |
| # On autorise les requêtes ICMP (ping) |
| # ICMP (ping) requests are allowed |
| $IPTABLES -A OUTPUT -o $EXTIF -p icmp --icmp-type 8 -j ACCEPT |
| |
| 489,4 → 489,3 |
|---|
| $IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE |
| |
| # End of script |
| |