Subversion Repositories ALCASAR

Rev

Rev 2538 | Rev 2621 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log

Rev 2538 Rev 2547
Line 1... Line 1...
1
#!/bin/sh
1
#!/bin/sh
2
#
2
#
3
# $Id: alcasar-iptables-local.sh 2538 2018-04-30 04:26:41Z tom.houdayer $
3
# $Id: alcasar-iptables-local.sh 2547 2018-05-06 01:49:28Z tom.houdayer $
4
#
4
#
5
# Custom rules for ALCASAR firewall
5
# Custom rules for ALCASAR firewall
6
#
6
#
7
# Examples:
7
# Examples:
8
# 	- Local MAC addresses filtering (MAC are in '/usr/local/etc/alcasar-iptables-local-mac-filtered'. Format : aa:09:23:2f:4d:ee)
8
# 	- Local MAC addresses filtering (MAC are in '/usr/local/etc/alcasar-iptables-local-mac-filtered'. Format : aa:09:23:2f:4d:ee)
Line 49... Line 49...
49
#$IPTABLES -A FORWARD -i $EXTIF -p tcp -d $to_ip -m multiport --dports $m_ports -j ACCEPT
49
#$IPTABLES -A FORWARD -i $EXTIF -p tcp -d $to_ip -m multiport --dports $m_ports -j ACCEPT
50
#$IPTABLES -A FORWARD -o $EXTIF -p tcp -s $to_ip -m multiport --sports $m_ports -j ACCEPT
50
#$IPTABLES -A FORWARD -o $EXTIF -p tcp -s $to_ip -m multiport --sports $m_ports -j ACCEPT
51
 
51
 
52
# Deny access to protected networks from internal LAN
52
# Deny access to protected networks from internal LAN
53
#protectedNetworks='10.0.0.0/8,172.16.0.0/12,192.168.0.0/16' # (RFC 1918)
53
#protectedNetworks='10.0.0.0/8,172.16.0.0/12,192.168.0.0/16' # (RFC 1918)
-
 
54
#[ -n "$TUNIF" ] && consultationIF=$TUNIF || consultationIF=$INTIF
54
#$IPTABLES -A FORWARD -i $TUNIF -d $protectedNetworks -j DROP
55
#$IPTABLES -A FORWARD -i $consultationIF -d $protectedNetworks -j DROP
-
 
56
#$IPTABLES -A FORWARD -o $consultationIF -s $protectedNetworks -j DROP
55
 
57
 
56
# Allow managers to access ACC from the external network
58
# Allow managers to access ACC from the external network
57
#managerIPs='192.168.111.10'
59
#managerIPs='192.168.111.10'
58
#externalPort='34443'
60
#externalPort='34443'
59
#$IPTABLES -t mangle -A PREROUTING -i $EXTIF -s $managerIPs -p tcp -d $PUBLIC_IP --dport 443 -j MARK --set-mark 1
61
#$IPTABLES -t mangle -A PREROUTING -i $EXTIF -s $managerIPs -p tcp -d $PUBLIC_IP --dport 443 -j MARK --set-mark 1