Subversion Repositories ALCASAR

#!/bin/sh
# by rexy (version 1.8 du 12/2009)
# Changelog : rajout des modules iptables  ???

# a voir la relation avec nf_nat_ftp
# modprobe ip_conntrack_irc
# modprobe ip_conntrack_ftp

################# FILTRAGE APPLICATIF ####################
## Positionnez la variable "FILTERING" du fichier "alcasar-iptables.sh" à "yes" pour activer le filtrage
## Modifiez le fichier /usr/local/etc/alcasar-services pour l'adapter à vos besoins
if [ $FILTERING = "yes" ]
        then
        while read svc_line
        do
                svc_on=`echo $svc_line|cut -b1`
                if [ $svc_on != "#" ]
                        then    
                        svc_name=`echo $svc_line|cut -d" " -f1`
                        svc_port=`echo $svc_line|cut -d" " -f2`
                        nb_domains=`wc -w /usr/local/etc/alcasar-wl-$svc_name | cut -d" " -f1`
                        # si le fichier "wl" est renseigné on le traite, sinon le protocole passe sans restriction (traité dans une prochaine version)
                        if [ $nb_domains != "0" ]
                                then
                                while read wl_line
                                        do
                                        $ip_addr = `/usr/bin/host $wl_line | grep -Eo '(0-9{1-3}+\.){3}[0-9]{1-3}'`
                                        $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -d $ip_addr -m state --state NEW -j ULOG --ulog-prefix "RULE F_$svc_name -- ACCEPT "
                                        $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -d $ip_addr -m state --state NEW,ESTABLISHED -j ACCEPT
                                        done < /usr/local/etc/alcasar-wl-$svc_name
                                else
                                if [ $svc_name = "icmp" ]
                                        then
                                        $IPTABLES -A FORWARD -i $TUNIF -p icmp -j ACCEPT 
                                else    
                                        $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_$svc_name -- ACCEPT "
                                        $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW,ESTABLISHED -j ACCEPT
#                                       if [ $svc_name = "ftp-passif" ]
#                                       then
#                                               /sbin/modprobe nf_nat_ftp
#                                               $IPTABLES -A FORWARD -i $TUNIF -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ULOG --ulog-prefix "RULE F_ftp-passifE -- ACCEPT "
#                                               $IPTABLES -A FORWARD -i $TUNIF -p tcp --sport 1024: --dport 1024: -m state --state RELATED -j ULOG --ulog-prefix "RULE F_ftp-passifR -- ACCEPT "
#                                               $IPTABLES -A FORWARD -i $TUNIF -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
#                                       fi
                                fi
                        fi
                fi
        done < /usr/local/etc/alcasar-services
#tout le reste est bloqué
$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT 
fi