mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-18 17:27:20 +01:00
see #2367 upgraded unit test files and made sure tests pass. Some chain names have changed after this change but overall script structure has improved. Still need to add more tests for various combinations of Classify, Tag and Route options with different actions
This commit is contained in:
Vadim Kurland
parent
48e32aef5d
commit
49e65c2775
@ -275,7 +275,8 @@ string PolicyCompiler_ipt::getNewChainName(PolicyRule *rule,
|
||||
str << iface_name.substr(0,n) << "_";
|
||||
}
|
||||
|
||||
switch (rule->getDirection()) {
|
||||
switch (rule->getDirection())
|
||||
{
|
||||
case PolicyRule::Inbound: str << "In_"; break;
|
||||
case PolicyRule::Outbound: str << "Out_"; break;
|
||||
default: ;
|
||||
@ -4275,8 +4276,6 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new Route("process route rules"));
|
||||
add( new storeAction("store original action of this rule"));
|
||||
|
||||
//add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
|
||||
add( new Logging1("check global logging override option"));
|
||||
|
||||
add( new expandGroupsInItf("expand groups in Interface" ));
|
||||
@ -4363,6 +4362,14 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new swapMultiAddressObjectsInDst(
|
||||
" swap MultiAddress -> MultiAddressRunTime in Dst"));
|
||||
|
||||
// #2367
|
||||
add( new splitTagClassifyOrRouteIfAction(
|
||||
"split rules with options Tag, Classify or Route when action "
|
||||
"is not Continue" ) );
|
||||
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
add( new accounting("Accounting") );
|
||||
|
||||
|
||||
add( new splitIfSrcAny("split rule if src is any") );
|
||||
|
||||
if (my_table == "mangle")
|
||||
@ -4374,8 +4381,6 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new setChainPostroutingForTag("chain POSTROUTING for Tag"));
|
||||
|
||||
|
||||
|
||||
|
||||
add( new processMultiAddressObjectsInSrc(
|
||||
"process MultiAddress objects in Src"));
|
||||
add( new processMultiAddressObjectsInDst(
|
||||
@ -4487,6 +4492,8 @@ void PolicyCompiler_ipt::compile()
|
||||
add( new optimize1("optimization 1, pass 2"));
|
||||
add( new optimize1("optimization 1, pass 3"));
|
||||
|
||||
|
||||
|
||||
add( new groupServicesByProtocol("split on services"));
|
||||
add( new separateTCPWithFlags("split on TCP services with flags"));
|
||||
add( new verifyCustomServices("verify custom services"));
|
||||
@ -4500,16 +4507,14 @@ void PolicyCompiler_ipt::compile()
|
||||
|
||||
add( new optimize2("optimization 2") );
|
||||
|
||||
// add( new splitTagClassifyOrRouteIfAction(
|
||||
// "split rules with options Tag, Classify or Route when action "
|
||||
// "is not Continue" ) );
|
||||
// add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
|
||||
// add( new accounting("Accounting") );
|
||||
// add( new prepareForMultiport("prepare for multiport") );
|
||||
|
||||
add( new splitTagClassifyOrRouteIfAction(
|
||||
"split rules with options Tag, Classify or Route when action "
|
||||
"is not Continue" ) );
|
||||
|
||||
add( new splitIfTagAndConnmark("Tag+CONNMARK combo"));
|
||||
|
||||
add( new accounting("Accounting") );
|
||||
add( new prepareForMultiport("prepare for multiport") );
|
||||
|
||||
add( new ConvertToAtomicForAddresses(
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1272731422" id="root">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="19" lastModified="1272731422" id="root">
|
||||
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
|
||||
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
|
||||
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:11:00 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:32:00 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall1.fw /etc/fw/firewall1.fw
|
||||
#
|
||||
@ -682,14 +682,10 @@ script_body() {
|
||||
#
|
||||
echo "Rule 11 (global)"
|
||||
#
|
||||
$IPTABLES -N Out_RULE_11
|
||||
$IPTABLES -A Out_RULE_11 -j RETURN
|
||||
$IPTABLES -A OUTPUT -j Out_RULE_11
|
||||
$IPTABLES -N In_RULE_11
|
||||
$IPTABLES -A In_RULE_11 -j RETURN
|
||||
$IPTABLES -A INPUT -j In_RULE_11
|
||||
$IPTABLES -N RULE_11
|
||||
$IPTABLES -A RULE_11 -j RETURN
|
||||
$IPTABLES -A OUTPUT -j RULE_11
|
||||
$IPTABLES -A INPUT -j RULE_11
|
||||
$IPTABLES -A FORWARD -j RULE_11
|
||||
#
|
||||
# Rule 12 (global)
|
||||
@ -1252,7 +1248,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:11:00 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:32:00 2011 by vadim"
|
||||
check_tools
|
||||
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:11:39 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:32:31 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall2-6.fw /etc/fw/firewall2-6.fw
|
||||
#
|
||||
@ -19,12 +19,12 @@
|
||||
# firewall2-6:NAT:10: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
|
||||
# firewall2-6:NAT:11: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
|
||||
# firewall2-6:NAT:12: error: Can not use inbound interface specification with rules that translate source because iptables does not allow "-i" in POSTROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:18: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:19: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:20: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:21: error: Can not use inbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:17: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:18: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:19: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:20: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
# firewall2-6:NAT:21: error: Can not use outbound interface specification with rules that translate destination because iptables does not allow "-o" in PREROUTING chain
|
||||
|
||||
# firewall2-6::: warning: Can not add virtual address 22.22.22.0 (object external_net)
|
||||
|
||||
@ -482,7 +482,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:11:39 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:32:31 2011 by vadim"
|
||||
check_tools
|
||||
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:07 2011 PDT by vadim
|
||||
# Generated Tue May 3 20:22:31 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall37-1.fw /etc/fw/firewall37-1.fw
|
||||
#
|
||||
@ -349,20 +349,11 @@ script_body() {
|
||||
# terminating target
|
||||
$IPTABLES -N Cid45AB5AAD25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AAD25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AAD25451.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AAD25451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AAD25451.2 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AAD25451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.2 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AAD25451.3 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AAD25451.3
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AAD25451.3 -j ACCEPT
|
||||
#
|
||||
# Rule 1 (global)
|
||||
#
|
||||
@ -374,7 +365,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_1 -j ACCEPT
|
||||
#
|
||||
@ -392,7 +383,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_2_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -j RULE_2_3
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j LOG --log-level info --log-prefix "RULE 2 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j LOG --log-level info --log-prefix "RULE 2 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_2_3 -j ACCEPT
|
||||
#
|
||||
@ -403,12 +394,9 @@ script_body() {
|
||||
# terminating target
|
||||
$IPTABLES -N Cid45AB5AD225451.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid45AB5AD225451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5AD225451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AD225451.1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5AD225451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5AD225451.1 -j ACCEPT
|
||||
#
|
||||
# Rule 4 (eth1)
|
||||
#
|
||||
@ -417,34 +405,25 @@ script_body() {
|
||||
# temrinating target
|
||||
$IPTABLES -N Cid45AB5ADE25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5ADE25451.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5ADE25451.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5ADE25451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.2 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5ADE25451.3 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5ADE25451.3
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid45AB5ADE25451.3 -j ACCEPT
|
||||
#
|
||||
# Rule 5 (global)
|
||||
#
|
||||
echo "Rule 5 (global)"
|
||||
#
|
||||
# terminating and CONNMARK
|
||||
$IPTABLES -N RULE_5 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_5
|
||||
$IPTABLES -t mangle -A RULE_5 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_5 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_5 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5AEA25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AEA25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid45AB5AEA25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 6 (global)
|
||||
#
|
||||
@ -456,7 +435,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_6
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_6
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_6
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_6 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_6 -j ACCEPT
|
||||
@ -473,38 +452,38 @@ script_body() {
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5B0225451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_7 -t mangle
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -j RULE_7
|
||||
$IPTABLES -t mangle -A RULE_7 -j LOG --log-level info --log-prefix "RULE 7 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_7 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_7 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_7 -j ACCEPT
|
||||
$IPTABLES -N RULE_7_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -j RULE_7_3
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j LOG --log-level info --log-prefix "RULE 7 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_7_3 -j ACCEPT
|
||||
#
|
||||
# Rule 8 (eth1)
|
||||
#
|
||||
echo "Rule 8 (eth1)"
|
||||
#
|
||||
# terminating and CONNMARK
|
||||
$IPTABLES -N In_RULE_8 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j In_RULE_8
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j In_RULE_8
|
||||
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j MARK --set-mark 8
|
||||
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A In_RULE_8 -i eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5B0F25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid45AB5B0F25451.0
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid45AB5B0F25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j MARK --set-mark 8
|
||||
$IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid45AB5B0F25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 9 (eth1)
|
||||
#
|
||||
echo "Rule 9 (eth1)"
|
||||
#
|
||||
# terminating and CONNMARK
|
||||
$IPTABLES -N Out_RULE_9 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Out_RULE_9
|
||||
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j MARK --set-mark 9
|
||||
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Out_RULE_9 -o eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5B1B25451.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid45AB5B1B25451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j MARK --set-mark 9
|
||||
$IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid45AB5B1B25451.0 -j ACCEPT
|
||||
#
|
||||
# Rule 11 (global)
|
||||
#
|
||||
@ -564,16 +543,10 @@ script_body() {
|
||||
# of that
|
||||
$IPTABLES -N Cid45AB5BC825451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5BC825451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5BC825451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5BC825451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5BC825451.1 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5BC825451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.1 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5BC825451.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5BC825451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.2 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5BC825451.2 -j ACCEPT
|
||||
#
|
||||
# Rule 16 (global)
|
||||
#
|
||||
@ -604,7 +577,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Out_RULE_18 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j Out_RULE_18
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Out_RULE_18 -j ACCEPT
|
||||
#
|
||||
@ -643,16 +616,10 @@ script_body() {
|
||||
# of that
|
||||
$IPTABLES -N Cid45AB5C1425451.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid45AB5C1425451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5C1425451.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5C1425451.0
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.0 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5C1425451.1 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid45AB5C1425451.1
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.1 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.1 -j ACCEPT
|
||||
$IPTABLES -N Cid45AB5C1425451.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid45AB5C1425451.2
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.2 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid45AB5C1425451.2 -j ACCEPT
|
||||
#
|
||||
# Rule 22 (global)
|
||||
#
|
||||
@ -769,7 +736,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:07 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 20:22:31 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:04 2011 PDT by vadim
|
||||
# Generated Tue May 3 20:28:13 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall37.fw /etc/fw/firewall37.fw
|
||||
#
|
||||
@ -14,11 +14,11 @@
|
||||
|
||||
# normal script mode (not using iptables-restore)
|
||||
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:7: warning: Empty group or address table object 'empty Ogroup'
|
||||
# firewall37:mangle_rules:7: warning: After removal of all empty groups and address table objects rule element Src becomes 'any' in the rule mangle_rules 7 (global)
|
||||
# Dropping rule mangle_rules 7 (global) because option 'Ignore rules with empty groups' is in effect
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:4: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
# firewall37:mangle_rules:13: error: DNSName object "6bone.net (ct)" (compile time) can not resolve dns name "6bone.net" (AF_INET): Host or network '6bone.net' not found; last error: Unknown error Using dummy address in test mode
|
||||
|
||||
|
||||
@ -351,20 +351,11 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43BBA6A09745.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid43BBA6A09745.0
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBA6A09745.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid43BBA6A09745.1
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBA6A09745.2 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid43BBA6A09745.2
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.2 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBA6A09745.3 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid43BBA6A09745.3
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBA6A09745.3 -j ACCEPT
|
||||
#
|
||||
# Rule 1 (global)
|
||||
#
|
||||
@ -375,7 +366,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_1
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_1 -j ACCEPT
|
||||
#
|
||||
@ -385,12 +376,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid483502D710047.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid483502D710047.0
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid483502D710047.0
|
||||
$IPTABLES -t mangle -A Cid483502D710047.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid483502D710047.0 -j ACCEPT
|
||||
$IPTABLES -N Cid483502D710047.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid483502D710047.1
|
||||
$IPTABLES -t mangle -A Cid483502D710047.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid483502D710047.1 -j ACCEPT
|
||||
#
|
||||
# Rule 3 (eth1)
|
||||
#
|
||||
@ -398,12 +386,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid30009X2275.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid30009X2275.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid30009X2275.0
|
||||
$IPTABLES -t mangle -A Cid30009X2275.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid30009X2275.0 -j ACCEPT
|
||||
$IPTABLES -N Cid30009X2275.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid30009X2275.1
|
||||
$IPTABLES -t mangle -A Cid30009X2275.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid30009X2275.1 -j ACCEPT
|
||||
#
|
||||
# Rule 4 (global)
|
||||
#
|
||||
@ -412,7 +397,7 @@ script_body() {
|
||||
$IPTABLES -N RULE_4 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_4
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_4
|
||||
$IPTABLES -t mangle -A RULE_4 -j LOG --log-level info --log-prefix "RULE 4 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_4 -j LOG --log-level info --log-prefix "RULE 4 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_4 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_4 -j ACCEPT
|
||||
#
|
||||
@ -420,31 +405,25 @@ script_body() {
|
||||
#
|
||||
echo "Rule 5 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43501X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43501X5007.0
|
||||
$IPTABLES -N Cid43501X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -p 50 -j Cid43501X5007.1
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43501X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -p ah -j Cid43501X5007.2
|
||||
$IPTABLES -t mangle -A Cid43501X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43501X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43501X5007.1
|
||||
$IPTABLES -N Cid43501X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -p 50 -j Cid43501X5007.0
|
||||
$IPTABLES -t mangle -A Cid43501X5007.1 -p ah -j Cid43501X5007.0
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43501X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 6 (eth1)
|
||||
#
|
||||
echo "Rule 6 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43518X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43518X5007.0
|
||||
$IPTABLES -N Cid43518X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -p 50 -j Cid43518X5007.1
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43518X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -p ah -j Cid43518X5007.2
|
||||
$IPTABLES -t mangle -A Cid43518X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43518X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -m state --state NEW -j Cid43518X5007.1
|
||||
$IPTABLES -N Cid43518X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -p 50 -j Cid43518X5007.0
|
||||
$IPTABLES -t mangle -A Cid43518X5007.1 -p ah -j Cid43518X5007.0
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43518X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 7 (eth1)
|
||||
#
|
||||
@ -452,42 +431,33 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43535X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid43535X5007.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid43535X5007.0
|
||||
$IPTABLES -t mangle -A Cid43535X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43535X5007.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43535X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid43535X5007.1
|
||||
$IPTABLES -t mangle -A Cid43535X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43535X5007.1 -j ACCEPT
|
||||
#
|
||||
# Rule 8 (eth1)
|
||||
#
|
||||
echo "Rule 8 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43554X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43554X5007.0
|
||||
$IPTABLES -N Cid43554X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -p 50 -j Cid43554X5007.1
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43554X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -p ah -j Cid43554X5007.2
|
||||
$IPTABLES -t mangle -A Cid43554X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43554X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43554X5007.1
|
||||
$IPTABLES -N Cid43554X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -p 50 -j Cid43554X5007.0
|
||||
$IPTABLES -t mangle -A Cid43554X5007.1 -p ah -j Cid43554X5007.0
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43554X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 9 (eth1)
|
||||
#
|
||||
echo "Rule 9 (eth1)"
|
||||
#
|
||||
$IPTABLES -N Cid43571X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43571X5007.0
|
||||
$IPTABLES -N Cid43571X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -p 50 -j Cid43571X5007.1
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -j ACCEPT
|
||||
$IPTABLES -N Cid43571X5007.2 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -p ah -j Cid43571X5007.2
|
||||
$IPTABLES -t mangle -A Cid43571X5007.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43571X5007.2 -j ACCEPT
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -s 22.22.23.22 -j Cid43571X5007.1
|
||||
$IPTABLES -N Cid43571X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -p 50 -j Cid43571X5007.0
|
||||
$IPTABLES -t mangle -A Cid43571X5007.1 -p ah -j Cid43571X5007.0
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43571X5007.0 -j ACCEPT
|
||||
#
|
||||
# Rule 10 (eth1)
|
||||
#
|
||||
@ -495,12 +465,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43588X5007.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -j Cid43588X5007.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -j Cid43588X5007.0
|
||||
$IPTABLES -t mangle -A Cid43588X5007.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43588X5007.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43588X5007.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -j Cid43588X5007.1
|
||||
$IPTABLES -t mangle -A Cid43588X5007.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43588X5007.1 -j ACCEPT
|
||||
#
|
||||
# Rule 11 (global)
|
||||
#
|
||||
@ -515,7 +482,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A Cid43BBCC139745.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_11_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid43BBCC139745.0 -j RULE_11_3
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j LOG --log-level info --log-prefix "RULE 11 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j LOG --log-level info --log-prefix "RULE 11 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A RULE_11_3 -j ACCEPT
|
||||
#
|
||||
@ -525,28 +492,16 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid4665E24F7765.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.0
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4665E24F7765.0
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.0 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.1
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.1 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.2 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.2
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.2 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.3 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.3
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.3 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.4 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid4665E24F7765.4
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.4 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.4 -j ACCEPT
|
||||
$IPTABLES -N Cid4665E24F7765.5 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid4665E24F7765.5
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.5 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid4665E24F7765.5 -j ACCEPT
|
||||
#
|
||||
# Rule 13 (eth1)
|
||||
#
|
||||
@ -554,12 +509,9 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid43BBCC3D9745.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid43BBCC3D9745.0
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid43BBCC3D9745.0
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.0 -j ACCEPT
|
||||
$IPTABLES -N Cid43BBCC3D9745.1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid43BBCC3D9745.1
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid43BBCC3D9745.1 -j ACCEPT
|
||||
#
|
||||
# Rule 14 (eth1)
|
||||
#
|
||||
@ -567,34 +519,25 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Cid459E471C10946.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.0
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.0 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.0 -j ACCEPT
|
||||
$IPTABLES -N Cid459E471C10946.1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.1
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.1 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.1 -j ACCEPT
|
||||
$IPTABLES -N Cid459E471C10946.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E471C10946.2
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.2 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.2 -j ACCEPT
|
||||
$IPTABLES -N Cid459E471C10946.3 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E471C10946.3
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.3 -j MARK --set-mark 16
|
||||
$IPTABLES -t mangle -A Cid459E471C10946.3 -j ACCEPT
|
||||
#
|
||||
# Rule 15 (global)
|
||||
#
|
||||
echo "Rule 15 (global)"
|
||||
#
|
||||
# using CONNMARK
|
||||
$IPTABLES -N RULE_15 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_15
|
||||
$IPTABLES -t mangle -A RULE_15 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_15 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_15 -j ACCEPT
|
||||
$IPTABLES -N Cid4483A4BD1810.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid4483A4BD1810.0
|
||||
$IPTABLES -t mangle -A Cid4483A4BD1810.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid4483A4BD1810.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid4483A4BD1810.0 -j ACCEPT
|
||||
#
|
||||
# Rule 16 (global)
|
||||
#
|
||||
@ -606,7 +549,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j RULE_16
|
||||
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j RULE_16
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j RULE_16
|
||||
$IPTABLES -t mangle -A RULE_16 -j LOG --log-level info --log-prefix "RULE 16 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_16 -j LOG --log-level info --log-prefix "RULE 16 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_16 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_16 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_16 -j ACCEPT
|
||||
@ -623,38 +566,38 @@ script_body() {
|
||||
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid4483A4DF1810.0
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.1.0/24 -j RETURN
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_17 -t mangle
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -j RULE_17
|
||||
$IPTABLES -t mangle -A RULE_17 -j LOG --log-level info --log-prefix "RULE 17 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_17 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_17 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_17 -j ACCEPT
|
||||
$IPTABLES -N RULE_17_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid4483A4DF1810.0 -j RULE_17_3
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j LOG --log-level info --log-prefix "RULE 17 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A RULE_17_3 -j ACCEPT
|
||||
#
|
||||
# Rule 18 (eth1)
|
||||
#
|
||||
echo "Rule 18 (eth1)"
|
||||
#
|
||||
# using CONNMARK
|
||||
$IPTABLES -N In_RULE_18 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j In_RULE_18
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j In_RULE_18
|
||||
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A In_RULE_18 -i eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid4483A4F01810.0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j Cid4483A4F01810.0
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j Cid4483A4F01810.0
|
||||
$IPTABLES -t mangle -A Cid4483A4F01810.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid4483A4F01810.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid4483A4F01810.0 -j ACCEPT
|
||||
#
|
||||
# Rule 19 (eth1)
|
||||
#
|
||||
echo "Rule 19 (eth1)"
|
||||
#
|
||||
# using CONNMARK
|
||||
$IPTABLES -N Out_RULE_19 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Out_RULE_19
|
||||
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Out_RULE_19 -o eth1 -j ACCEPT
|
||||
$IPTABLES -N Cid459E472D10946.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j Cid459E472D10946.0
|
||||
$IPTABLES -t mangle -A Cid459E472D10946.0 -j MARK --set-mark 10
|
||||
$IPTABLES -t mangle -A Cid459E472D10946.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid459E472D10946.0 -j ACCEPT
|
||||
#
|
||||
# Rule 22 (global)
|
||||
#
|
||||
@ -671,7 +614,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N RULE_23 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -s 192.168.1.0/24 -j RULE_23
|
||||
$IPTABLES -t mangle -A RULE_23 -j LOG --log-level info --log-prefix "RULE 23 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A RULE_23 -j LOG --log-level info --log-prefix "RULE 23 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_23 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A RULE_23 -j ACCEPT
|
||||
#
|
||||
@ -696,7 +639,7 @@ script_body() {
|
||||
$IPTABLES -t mangle -A Cid451E56A46383.0 -s 192.168.2.0/24 -j RETURN
|
||||
$IPTABLES -N RULE_25_3 -t mangle
|
||||
$IPTABLES -t mangle -A Cid451E56A46383.0 -j RULE_25_3
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j LOG --log-level info --log-prefix "RULE 25 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j LOG --log-level info --log-prefix "RULE 25 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A RULE_25_3 -j ACCEPT
|
||||
#
|
||||
@ -715,7 +658,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Out_RULE_27 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j Out_RULE_27
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j LOG --log-level info --log-prefix "RULE 27 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j LOG --log-level info --log-prefix "RULE 27 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Out_RULE_27 -j ACCEPT
|
||||
#
|
||||
@ -734,7 +677,7 @@ script_body() {
|
||||
#
|
||||
$IPTABLES -N Out_RULE_29 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o ! eth1 -s 192.168.1.0/24 -j Out_RULE_29
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j LOG --log-level info --log-prefix "RULE 29 -- CLASSIFY "
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j LOG --log-level info --log-prefix "RULE 29 -- ACCEPT "
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j CLASSIFY --set-class 1:2
|
||||
$IPTABLES -t mangle -A Out_RULE_29 -j ACCEPT
|
||||
#
|
||||
@ -795,16 +738,10 @@ script_body() {
|
||||
# of that
|
||||
$IPTABLES -N Cid459A875F19324.0 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j Cid459A875F19324.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid459A875F19324.0
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid459A875F19324.0
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.0 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.0 -j ACCEPT
|
||||
$IPTABLES -N Cid459A875F19324.1 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j Cid459A875F19324.1
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.1 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.1 -j ACCEPT
|
||||
$IPTABLES -N Cid459A875F19324.2 -t mangle
|
||||
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j Cid459A875F19324.2
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.2 -j CLASSIFY --set-class 1:11
|
||||
$IPTABLES -t mangle -A Cid459A875F19324.2 -j ACCEPT
|
||||
#
|
||||
# Rule 36 (global)
|
||||
#
|
||||
@ -830,12 +767,12 @@ script_body() {
|
||||
#
|
||||
echo "Rule mangle_rules 1 (global)"
|
||||
#
|
||||
$IPTABLES -N mangle_rules_1 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j mangle_rules_1
|
||||
$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -m state --state NEW -j mangle_rules_1
|
||||
$IPTABLES -t mangle -A mangle_rules_1 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A mangle_rules_1 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A mangle_rules_1 -j ACCEPT
|
||||
$IPTABLES -N Cid56804X29169.0 -t mangle
|
||||
$IPTABLES -t mangle -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j Cid56804X29169.0
|
||||
$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -m state --state NEW -j Cid56804X29169.0
|
||||
$IPTABLES -t mangle -A Cid56804X29169.0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A Cid56804X29169.0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Cid56804X29169.0 -j ACCEPT
|
||||
#
|
||||
# Rule mangle_rules 2 (global)
|
||||
#
|
||||
@ -1050,7 +987,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:04 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 20:28:13 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:07 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:32:56 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall38.fw /etc/fw/firewall38.fw
|
||||
#
|
||||
@ -377,7 +377,7 @@ script_body() {
|
||||
echo "-A OUTPUT -p ah -m state --state NEW -j RULE_1 "
|
||||
echo "-A PREROUTING -p 50 -m state --state NEW -j RULE_1 "
|
||||
echo "-A PREROUTING -p ah -m state --state NEW -j RULE_1 "
|
||||
echo "-A RULE_1 -j LOG --log-level info --log-prefix \"RULE 1 -- TAG \""
|
||||
echo "-A RULE_1 -j LOG --log-level info --log-prefix \"RULE 1 -- CONTINUE \""
|
||||
echo "-A RULE_1 -j MARK --set-mark 16"
|
||||
#
|
||||
# Rule 2 (global)
|
||||
@ -390,7 +390,7 @@ script_body() {
|
||||
echo "-A PREROUTING -s ! 192.168.1.0/24 -m state --state NEW -j Cid43BBF1AD9745.1 "
|
||||
echo "-A Cid43BBF1AD9745.1 -p 50 -j RULE_2 "
|
||||
echo "-A Cid43BBF1AD9745.1 -p ah -j RULE_2 "
|
||||
echo "-A RULE_2 -j LOG --log-level info --log-prefix \"RULE 2 -- TAG \""
|
||||
echo "-A RULE_2 -j LOG --log-level info --log-prefix \"RULE 2 -- CONTINUE \""
|
||||
echo "-A RULE_2 -j MARK --set-mark 16"
|
||||
#
|
||||
# Rule 3 (eth1)
|
||||
@ -404,7 +404,7 @@ script_body() {
|
||||
# Rule 5 (global)
|
||||
echo ":RULE_5 - [0:0]"
|
||||
echo "-A OUTPUT -p tcp -m tcp -s 22.22.23.22 --dport 80 -m state --state NEW -j RULE_5 "
|
||||
echo "-A RULE_5 -j LOG --log-level info --log-prefix \"RULE 5 -- TAG \""
|
||||
echo "-A RULE_5 -j LOG --log-level info --log-prefix \"RULE 5 -- CONTINUE \""
|
||||
echo "-A RULE_5 -j MARK --set-mark 2"
|
||||
#
|
||||
# Rule 6 (eth1)
|
||||
@ -498,7 +498,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:07 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:32:56 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:13 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:33:01 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall40-1.fw /etc/firewall40-1.fw
|
||||
#
|
||||
@ -325,19 +325,15 @@ script_body() {
|
||||
echo "Rule Policy_1 0 (eth0)"
|
||||
#
|
||||
$IPTABLES -N Policy_1 -t mangle
|
||||
$IPTABLES -N In_Policy_1_0 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j In_Policy_1_0
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 1 (eth2)
|
||||
#
|
||||
echo "Rule Policy_1 1 (eth2)"
|
||||
#
|
||||
$IPTABLES -N In_Policy_1_1 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j In_Policy_1_1
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 3 (global)
|
||||
#
|
||||
@ -360,7 +356,7 @@ script_body() {
|
||||
$IPTABLES -N Policy_1_6 -t mangle
|
||||
$IPTABLES -t mangle -A Cid55038X29165.0 -d 22.22.22.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Cid55038X29165.0 -d 33.33.33.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
|
||||
|
||||
# ================ Table 'filter', rule set Policy_1
|
||||
@ -450,7 +446,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:13 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:33:01 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:14 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:33:02 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall40-2.fw /etc/firewall40-2.fw
|
||||
#
|
||||
@ -325,19 +325,15 @@ script_body() {
|
||||
echo "Rule Policy_1 0 (eth0)"
|
||||
#
|
||||
$IPTABLES -N Policy_1 -t mangle
|
||||
$IPTABLES -N In_Policy_1_0 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j In_Policy_1_0
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A In_Policy_1_0 -i eth0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth0 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 1 (eth2)
|
||||
#
|
||||
echo "Rule Policy_1 1 (eth2)"
|
||||
#
|
||||
$IPTABLES -N In_Policy_1_1 -t mangle
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j In_Policy_1_1
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A In_Policy_1_1 -i eth2 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A Policy_1 -i eth2 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule Policy_1 3 (global)
|
||||
#
|
||||
@ -360,7 +356,7 @@ script_body() {
|
||||
$IPTABLES -N Policy_1_6 -t mangle
|
||||
$IPTABLES -t mangle -A Cid55227X22068.0 -d 22.22.22.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Cid55227X22068.0 -d 33.33.33.0/24 -j Policy_1_6
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
|
||||
$IPTABLES -t mangle -A Policy_1_6 -j MARK --set-mark 8
|
||||
|
||||
# ================ Table 'filter', rule set Policy_1
|
||||
@ -437,7 +433,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:14 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:33:02 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:12:13 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:33:00 2011 PDT by vadim
|
||||
#
|
||||
# files: * firewall40.fw /etc/firewall40.fw
|
||||
#
|
||||
@ -324,19 +324,15 @@ script_body() {
|
||||
#
|
||||
echo "Rule 0 (eth0)"
|
||||
#
|
||||
$IPTABLES -N In_RULE_0 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j In_RULE_0
|
||||
$IPTABLES -t mangle -A In_RULE_0 -i eth0 -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A In_RULE_0 -i eth0 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j MARK --set-mark 1
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth0 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule 1 (eth2)
|
||||
#
|
||||
echo "Rule 1 (eth2)"
|
||||
#
|
||||
$IPTABLES -N In_RULE_1 -t mangle
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j In_RULE_1
|
||||
$IPTABLES -t mangle -A In_RULE_1 -i eth2 -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A In_RULE_1 -i eth2 -j CONNMARK --save-mark
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j MARK --set-mark 2
|
||||
$IPTABLES -t mangle -A PREROUTING -i eth2 -m state --state NEW -j CONNMARK --save-mark
|
||||
#
|
||||
# Rule 3 (global)
|
||||
#
|
||||
@ -359,7 +355,7 @@ script_body() {
|
||||
$IPTABLES -N RULE_6 -t mangle
|
||||
$IPTABLES -t mangle -A Cid37084X26841.0 -d 22.22.22.0/24 -j RULE_6
|
||||
$IPTABLES -t mangle -A Cid37084X26841.0 -d 33.33.33.0/24 -j RULE_6
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- TAG "
|
||||
$IPTABLES -t mangle -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- CONTINUE "
|
||||
$IPTABLES -t mangle -A RULE_6 -j MARK --set-mark 8
|
||||
|
||||
# ================ Table 'filter', rule set Policy
|
||||
@ -439,7 +435,7 @@ test -z "$cmd" && {
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Apr 19 14:12:13 2011 by vadim"
|
||||
log "Activating firewall script generated Tue May 3 19:33:00 2011 by vadim"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -2,9 +2,9 @@
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v4.2.0.3529
|
||||
# Firewall Builder fwb_ipt v4.2.1.ma_1
|
||||
#
|
||||
# Generated Tue Apr 19 14:13:40 2011 PDT by vadim
|
||||
# Generated Tue May 3 19:34:11 2011 PDT by vadim
|
||||
#
|
||||
# files: * rc.firewall.local /etc/rc.d//rc.firewall.local
|
||||
#
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user