Subversion Repositories ALCASAR

Rev

Rev 1056 | Rev 1063 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1056 Rev 1062
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
# $Id: alcasar-iptables-bypass.sh 1056 2013-03-26 21:46:36Z stephane $
 2 
# $Id: alcasar-iptables-bypass.sh 1062 2013-04-01 21:20:12Z richard $
3 
 
 3 
 
4 
# alcasar-iptables-bypass.sh
 4 
# alcasar-iptables-bypass.sh
5 
# by Rexy - 3abtux
 5 
# by Rexy - 3abtux
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 7 
 
Line 16... Line 16...
16 
IPTABLES="/sbin/iptables"
 16 
IPTABLES="/sbin/iptables"
17 
EXTIF="eth0"
 17 
EXTIF="eth0"
18 
INTIF="eth1"
 18 
INTIF="eth1"
19 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
 19 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
20 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
 20 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
- 
 
 21 
public_ip_mask=`grep PUBLIC_IP= $conf_file|cut -d"=" -f2`		# ALCASAR WAN IP address
- 
 
 22 
PUBLIC_IP=`echo $public_ip_mask | cut -d"/" -f1`
- 
 
 23 
SSH=`grep SSH= $conf_file|cut -d"=" -f2`				# sshd active (on/off)
- 
 
 24 
SSH=${SSH:=off}
- 
 
 25 
SSH_ADMIN_IP=`grep SSH_ADMIN_IP= $conf_file|cut -d"=" -f2`
- 
 
 26 
SSH_ADMIN_IP=${SSH_ADMIN_IP:="0.0.0.0/0.0.0.0"}				# WAN IP address to reduce ssh access (all ip allowed on LAN side)
- 
 
 27 
 
21 
 
 28 
 
22 
# On vide (flush) toutes les règles existantes
 29 
# On vide (flush) toutes les règles existantes
23 
# Flush all existing rules
 30 
# Flush all existing rules
24 
$IPTABLES -F
 31 
$IPTABLES -F
25 
$IPTABLES -t nat -F
 32 
$IPTABLES -t nat -F
Line 47... Line 54...
47 
$IPTABLES -A INPUT -i lo -j ACCEPT
 54 
$IPTABLES -A INPUT -i lo -j ACCEPT
48 
 
 55 
 
49 
# Insertion de règles de blocage (Devel)
 56 
# Insertion de règles de blocage (Devel)
50 
# Here, we add block rules (Devel)
 57 
# Here, we add block rules (Devel)
51 
if [ -s /usr/local/etc/alcasar-iptables-block ]; then
58 
if [ -s /usr/local/etc/alcasar-iptables-block ]; then
52 
    while read ip_blocked
 59 
	while read ip_line
53 
    do
 60 
	do
54 
      echo "Network Address blocked : $ip_blocked"
 61 
		ip_on=`echo $ip_line|cut -b1`
55 
      $IPTABLES -A FORWARD -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
 62 
		if [ $ip_on != "#" ]
- 
 
 63 
		then
56 
      $IPTABLES -A FORWARD -d $ip_blocked -j REJECT
 64 
			ip_blocked=`echo $ip_line|cut -d" " -f1`
57 
      $IPTABLES -A FORWARD -s $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
 65 
			$IPTABLES -A FORWARD -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
58 
      $IPTABLES -A FORWARD -s $ip_blocked -j REJECT
 66 
			$IPTABLES -A FORWARD -d $ip_blocked -j REJECT
- 
 
 67 
		fi
59 
    done < /usr/local/etc/alcasar-iptables-block
 68 
	done < /usr/local/etc/alcasar-iptables-block
60 
fi
 69 
fi
61 
 
 70 
 
62 
# SSHD rules if activate
71 
# SSHD rules if activate
63 
if [ $SSH = on ]
 72 
if [ $SSH = on ]
64 
	then
 73 
	then
65 
	$IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
 74 
	$IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -m state --state NEW -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-LAN -- ACCEPT"
66 
	$IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
 75 
	$IPTABLES -A INPUT -i $INTIF -s $PRIVATE_NETWORK_MASK -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
67 
	$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
 76 
	$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW --syn -j ULOG --ulog-nlgroup 2 --ulog-prefix "RULE ssh-from-WAN -- ACCEPT"
68 
	$IPTABLES -A INPUT -i $EXTIF -s $Admin_from_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
 77 
	$IPTABLES -A INPUT -i $EXTIF -s $SSH_ADMIN_IP -d $PUBLIC_IP -p tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
69 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT
 78 
	$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport ssh -m state --state ESTABLISHED -j ACCEPT
70 
fi
 79 
fi
71 
 
 80 
 
- 
 
 81 
# Insertion de règles locales
- 
 
 82 
# Here, we add local rules (i.e. VPN from Internet)
- 
 
 83 
if [ -f /usr/local/etc/alcasar-iptables-local.sh ]; then
- 
 
 84 
        . /usr/local/etc/alcasar-iptables-local.sh
- 
 
 85 
fi
- 
 
 86 
 
72 
# on autorise les requêtes dhcp
 87 
# on autorise les requêtes dhcp
73 
# accept dhcp
 88 
# accept dhcp
74 
$IPTABLES -A INPUT -i $INTIF -p udp -m udp --sport bootpc --dport bootps -j ACCEPT
 89 
$IPTABLES -A INPUT -i $INTIF -p udp -m udp --sport bootpc --dport bootps -j ACCEPT
75 
 
 90 
 
76 
# On drop le broadcast et le multicast sur les interfaces (sans Log)
 91 
# On drop le broadcast et le multicast sur les interfaces (sans Log)
Line 93... Line 108...
93 
 
 108 
 
94 
# On autorise les demandes de connexions sortantes
 109 
# On autorise les demandes de connexions sortantes
95 
$IPTABLES -A FORWARD -i $INTIF -m state --state NEW -j ULOG --ulog-prefix "RULE Transfert -- ACCEPT "
 110 
$IPTABLES -A FORWARD -i $INTIF -m state --state NEW -j ULOG --ulog-prefix "RULE Transfert -- ACCEPT "
96 
$IPTABLES -A FORWARD -i $INTIF -m state --state NEW -j ACCEPT
 111 
$IPTABLES -A FORWARD -i $INTIF -m state --state NEW -j ACCEPT
97 
 
 112 
 
98 
# On autorise les flux entrant ntp, dns et ssh via INTIF
 113 
# On autorise les flux entrant ntp et dns via INTIF
99 
$IPTABLES -A INPUT -i $INTIF -d $PRIVATE_IP -p udp --dport domain -j ACCEPT
 114 
$IPTABLES -A INPUT -i $INTIF -d $PRIVATE_IP -p udp --dport domain -j ACCEPT
100 
$IPTABLES -A INPUT -i $INTIF -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT
 115 
$IPTABLES -A INPUT -i $INTIF -d $PRIVATE_IP -p udp --dport ntp -j ACCEPT
101 
$IPTABLES -A INPUT -i $INTIF -d $PRIVATE_IP -p tcp --dport ssh -j ACCEPT
 - 
 
102 
 
 116 
 
103 
# On autorise le retour des connexions entrante déjà acceptées
 117 
# On autorise le retour des connexions entrante déjà acceptées
104 
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 118 
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
105 
 
 119 
 
106 
# On interdit et on log le reste sur les 2 interfaces d'accès
 120 
# On interdit et on log le reste sur les 2 interfaces d'accès