mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-18 17:27:20 +01:00
15bab71f49
single object negation in "Inbound Interface" and "Outbound Interface" columns in compiler for iptables. * NATCompiler_pf.cpp (compile): see #2456 Added support for single object negation in "Interface" rule element of PF NAT rules. Now compiler can produce PF commands such as "nat on ! em0 ... " (for PF <4.7) or "match on ! em0 ..." (for PF >= 4.7) * Compiler.cpp (singleObjectNegation::processNext): moved rule processor that processes single object negation in any rule element to the base class Compiler.
1047 lines
35 KiB
Bash
Executable File
1047 lines
35 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# This is automatically generated file. DO NOT MODIFY !
|
|
#
|
|
# Firewall Builder fwb_ipt v5.0.0.3547
|
|
#
|
|
# Generated Fri Jun 3 17:28:08 2011 PDT by vadim
|
|
#
|
|
# files: * firewall37-1.fw /etc/fw/firewall37-1.fw
|
|
#
|
|
# Compiled for iptables (any version)
|
|
#
|
|
# testing TAG and CLASSIFY rules
|
|
|
|
# same as firewall37 except rules are made to be terminating
|
|
|
|
|
|
|
|
|
|
FWBDEBUG=""
|
|
|
|
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
|
|
export PATH
|
|
|
|
|
|
|
|
LSMOD="/sbin/lsmod"
|
|
MODPROBE="/sbin/modprobe"
|
|
IPTABLES="/sbin/iptables"
|
|
IP6TABLES="/sbin/ip6tables"
|
|
IPTABLES_RESTORE="/sbin/iptables-restore"
|
|
IP6TABLES_RESTORE="/sbin/ip6tables-restore"
|
|
IP="/sbin/ip"
|
|
IFCONFIG="/sbin/ifconfig"
|
|
VCONFIG="/sbin/vconfig"
|
|
BRCTL="/sbin/brctl"
|
|
IFENSLAVE="/sbin/ifenslave"
|
|
IPSET="/usr/sbin/ipset"
|
|
LOGGER="/usr/bin/logger"
|
|
|
|
log() {
|
|
echo "$1"
|
|
command -v "$LOGGER" >/dev/null 2>&1 && $LOGGER -p info "$1"
|
|
}
|
|
|
|
getInterfaceVarName() {
|
|
echo $1 | sed 's/\./_/'
|
|
}
|
|
|
|
getaddr_internal() {
|
|
dev=$1
|
|
name=$2
|
|
af=$3
|
|
L=$($IP $af addr show dev $dev | sed -n '/inet/{s!.*inet6* !!;s!/.*!!p}' | sed 's/peer.*//')
|
|
test -z "$L" && {
|
|
eval "$name=''"
|
|
return
|
|
}
|
|
eval "${name}_list=\"$L\""
|
|
}
|
|
|
|
getnet_internal() {
|
|
dev=$1
|
|
name=$2
|
|
af=$3
|
|
L=$($IP route list proto kernel | grep $dev | grep -v default | sed 's! .*$!!')
|
|
test -z "$L" && {
|
|
eval "$name=''"
|
|
return
|
|
}
|
|
eval "${name}_list=\"$L\""
|
|
}
|
|
|
|
|
|
getaddr() {
|
|
getaddr_internal $1 $2 "-4"
|
|
}
|
|
|
|
getaddr6() {
|
|
getaddr_internal $1 $2 "-6"
|
|
}
|
|
|
|
getnet() {
|
|
getnet_internal $1 $2 "-4"
|
|
}
|
|
|
|
getnet6() {
|
|
getnet_internal $1 $2 "-6"
|
|
}
|
|
|
|
# function getinterfaces is used to process wildcard interfaces
|
|
getinterfaces() {
|
|
NAME=$1
|
|
$IP link show | grep ": $NAME" | while read L; do
|
|
OIFS=$IFS
|
|
IFS=" :"
|
|
set $L
|
|
IFS=$OIFS
|
|
echo $2
|
|
done
|
|
}
|
|
|
|
diff_intf() {
|
|
func=$1
|
|
list1=$2
|
|
list2=$3
|
|
cmd=$4
|
|
for intf in $list1
|
|
do
|
|
echo $list2 | grep -q $intf || {
|
|
# $vlan is absent in list 2
|
|
$func $intf $cmd
|
|
}
|
|
done
|
|
}
|
|
|
|
find_program() {
|
|
PGM=$1
|
|
command -v $PGM >/dev/null 2>&1 || {
|
|
echo "$PGM not found"
|
|
exit 1
|
|
}
|
|
}
|
|
check_tools() {
|
|
find_program $IPTABLES
|
|
find_program $MODPROBE
|
|
find_program $IP
|
|
}
|
|
reset_iptables_v4() {
|
|
$IPTABLES -P OUTPUT DROP
|
|
$IPTABLES -P INPUT DROP
|
|
$IPTABLES -P FORWARD DROP
|
|
|
|
cat /proc/net/ip_tables_names | while read table; do
|
|
$IPTABLES -t $table -L -n | while read c chain rest; do
|
|
if test "X$c" = "XChain" ; then
|
|
$IPTABLES -t $table -F $chain
|
|
fi
|
|
done
|
|
$IPTABLES -t $table -X
|
|
done
|
|
}
|
|
|
|
reset_iptables_v6() {
|
|
$IP6TABLES -P OUTPUT DROP
|
|
$IP6TABLES -P INPUT DROP
|
|
$IP6TABLES -P FORWARD DROP
|
|
|
|
cat /proc/net/ip6_tables_names | while read table; do
|
|
$IP6TABLES -t $table -L -n | while read c chain rest; do
|
|
if test "X$c" = "XChain" ; then
|
|
$IP6TABLES -t $table -F $chain
|
|
fi
|
|
done
|
|
$IP6TABLES -t $table -X
|
|
done
|
|
}
|
|
|
|
|
|
P2P_INTERFACE_WARNING=""
|
|
|
|
missing_address() {
|
|
address=$1
|
|
cmd=$2
|
|
|
|
oldIFS=$IFS
|
|
IFS="@"
|
|
set $address
|
|
addr=$1
|
|
interface=$2
|
|
IFS=$oldIFS
|
|
|
|
|
|
|
|
$IP addr show dev $interface | grep -q POINTOPOINT && {
|
|
test -z "$P2P_INTERFACE_WARNING" && echo "Warning: Can not update address of interface $interface. fwbuilder can not manage addresses of point-to-point interfaces yet"
|
|
P2P_INTERFACE_WARNING="yes"
|
|
return
|
|
}
|
|
|
|
test "$cmd" = "add" && {
|
|
echo "# Adding ip address: $interface $addr"
|
|
echo $addr | grep -q ':' && {
|
|
$FWBDEBUG $IP addr $cmd $addr dev $interface
|
|
} || {
|
|
$FWBDEBUG $IP addr $cmd $addr broadcast + dev $interface
|
|
}
|
|
}
|
|
|
|
test "$cmd" = "del" && {
|
|
echo "# Removing ip address: $interface $addr"
|
|
$FWBDEBUG $IP addr $cmd $addr dev $interface || exit 1
|
|
}
|
|
|
|
$FWBDEBUG $IP link set $interface up
|
|
}
|
|
|
|
list_addresses_by_scope() {
|
|
interface=$1
|
|
scope=$2
|
|
ignore_list=$3
|
|
$IP addr ls dev $interface | \
|
|
awk -v IGNORED="$ignore_list" -v SCOPE="$scope" \
|
|
'BEGIN {
|
|
split(IGNORED,ignored_arr);
|
|
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
|
}
|
|
(/inet |inet6 / && $0 ~ SCOPE && !($2 in ignored_dict)) {print $2;}' | \
|
|
while read addr; do
|
|
echo "${addr}@$interface"
|
|
done | sort
|
|
}
|
|
|
|
|
|
update_addresses_of_interface() {
|
|
ignore_list=$2
|
|
set $1
|
|
interface=$1
|
|
shift
|
|
|
|
FWB_ADDRS=$(
|
|
for addr in $*; do
|
|
echo "${addr}@$interface"
|
|
done | sort
|
|
)
|
|
|
|
CURRENT_ADDRS_ALL_SCOPES=""
|
|
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
|
|
|
$IP link show dev $interface >/dev/null 2>&1 && {
|
|
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface 'scope .*' "$ignore_list")
|
|
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scope global' "$ignore_list")
|
|
} || {
|
|
echo "# Interface $interface does not exist"
|
|
# Stop the script if we are not in test mode
|
|
test -z "$FWBDEBUG" && exit 1
|
|
}
|
|
|
|
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
|
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
|
}
|
|
|
|
clear_addresses_except_known_interfaces() {
|
|
$IP link show | sed 's/://g' | awk -v IGNORED="$*" \
|
|
'BEGIN {
|
|
split(IGNORED,ignored_arr);
|
|
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
|
}
|
|
(/state/ && !($2 in ignored_dict)) {print $2;}' | \
|
|
while read intf; do
|
|
echo "# Removing addresses not configured in fwbuilder from interface $intf"
|
|
$FWBDEBUG $IP addr flush dev $intf scope global
|
|
$FWBDEBUG $IP link set $intf down
|
|
done
|
|
}
|
|
|
|
check_file() {
|
|
test -r "$2" || {
|
|
echo "Can not find file $2 referenced by address table object $1"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
check_run_time_address_table_files() {
|
|
:
|
|
|
|
}
|
|
|
|
load_modules() {
|
|
:
|
|
OPTS=$1
|
|
MODULES_DIR="/lib/modules/`uname -r`/kernel/net/"
|
|
MODULES=$(find $MODULES_DIR -name '*conntrack*' \! -name '*ipv6*'|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')
|
|
echo $OPTS | grep -q nat && {
|
|
MODULES="$MODULES $(find $MODULES_DIR -name '*nat*'|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')"
|
|
}
|
|
echo $OPTS | grep -q ipv6 && {
|
|
MODULES="$MODULES $(find $MODULES_DIR -name nf_conntrack_ipv6|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')"
|
|
}
|
|
for module in $MODULES; do
|
|
if $LSMOD | grep ${module} >/dev/null; then continue; fi
|
|
$MODPROBE ${module} || exit 1
|
|
done
|
|
}
|
|
|
|
verify_interfaces() {
|
|
:
|
|
|
|
}
|
|
|
|
prolog_commands() {
|
|
echo "Running prolog script"
|
|
|
|
}
|
|
|
|
epilog_commands() {
|
|
echo "Running epilog script"
|
|
|
|
}
|
|
|
|
run_epilog_and_exit() {
|
|
epilog_commands
|
|
exit $1
|
|
}
|
|
|
|
configure_interfaces() {
|
|
:
|
|
# Configure interfaces
|
|
update_addresses_of_interface "eth0 192.168.1.22/24" ""
|
|
update_addresses_of_interface "eth1 22.22.23.22/24" ""
|
|
update_addresses_of_interface "eth2 192.168.2.1/24" ""
|
|
}
|
|
|
|
script_body() {
|
|
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
|
|
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_intvl
|
|
|
|
|
|
# ================ IPv4
|
|
|
|
|
|
# ================ Table 'filter', automatic rules
|
|
# accept established sessions
|
|
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
# ================ Table 'mangle', automatic rules
|
|
$IPTABLES -t mangle -A PREROUTING -j CONNMARK --restore-mark
|
|
$IPTABLES -t mangle -A OUTPUT -j CONNMARK --restore-mark
|
|
|
|
# ================ Table 'nat', rule set NAT
|
|
#
|
|
# Rule 0 (NAT)
|
|
#
|
|
echo "Rule 0 (NAT)"
|
|
#
|
|
$IPTABLES -t nat -A POSTROUTING -s 22.22.23.22 -j ACCEPT
|
|
$IPTABLES -t nat -A POSTROUTING -s 192.168.1.22 -j ACCEPT
|
|
$IPTABLES -t nat -A POSTROUTING -s 192.168.2.1 -j ACCEPT
|
|
$IPTABLES -t nat -A OUTPUT -j ACCEPT
|
|
$IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/24 -j ACCEPT
|
|
$IPTABLES -t nat -A PREROUTING -s 192.168.1.0/24 -j ACCEPT
|
|
|
|
# ================ Table 'mangle', rule set rule27_branch
|
|
#
|
|
# Rule rule27_branch 0 (global)
|
|
#
|
|
echo "Rule rule27_branch 0 (global)"
|
|
#
|
|
$IPTABLES -N rule27_branch -t mangle
|
|
$IPTABLES -t mangle -A rule27_branch -p tcp -m tcp --tcp-flags ALL ACK -j CLASSIFY --set-class 1:16
|
|
# ================ Table 'mangle', rule set Policy
|
|
#
|
|
# Rule 0 (global)
|
|
#
|
|
echo "Rule 0 (global)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 16
|
|
#
|
|
# Rule 1 (global)
|
|
#
|
|
echo "Rule 1 (global)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 16
|
|
#
|
|
# Rule 2 (global)
|
|
#
|
|
echo "Rule 2 (global)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -N Cid45AB5AC525451.0 -t mangle
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5AC525451.0 -j MARK --set-mark 16
|
|
#
|
|
# Rule 3 (eth1)
|
|
#
|
|
echo "Rule 3 (eth1)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j MARK --set-mark 16
|
|
#
|
|
# Rule 4 (eth1)
|
|
#
|
|
echo "Rule 4 (eth1)"
|
|
#
|
|
# temrinating target
|
|
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j MARK --set-mark 16
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j MARK --set-mark 16
|
|
#
|
|
# Rule 5 (global)
|
|
#
|
|
echo "Rule 5 (global)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j CONNMARK --save-mark
|
|
#
|
|
# Rule 6 (global)
|
|
#
|
|
echo "Rule 6 (global)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j CONNMARK --save-mark
|
|
#
|
|
# Rule 7 (global)
|
|
#
|
|
echo "Rule 7 (global)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -N Cid45AB5B0225451.0 -t mangle
|
|
$IPTABLES -t mangle -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -t mangle -A OUTPUT -p ah -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -t mangle -A PREROUTING -p 50 -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -t mangle -A PREROUTING -p ah -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -j MARK --set-mark 10
|
|
$IPTABLES -t mangle -A Cid45AB5B0225451.0 -j CONNMARK --save-mark
|
|
#
|
|
# Rule 8 (eth1)
|
|
#
|
|
echo "Rule 8 (eth1)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j MARK --set-mark 8
|
|
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j MARK --set-mark 8
|
|
$IPTABLES -t mangle -A PREROUTING -i eth1 -p 50 -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A PREROUTING -i eth1 -p ah -m state --state NEW -j CONNMARK --save-mark
|
|
#
|
|
# Rule 9 (eth1)
|
|
#
|
|
echo "Rule 9 (eth1)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j MARK --set-mark 9
|
|
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j MARK --set-mark 9
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j MARK --set-mark 9
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j MARK --set-mark 9
|
|
$IPTABLES -t mangle -A OUTPUT -o eth1 -p 50 -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A OUTPUT -o eth1 -p ah -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p 50 -m state --state NEW -j CONNMARK --save-mark
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth1 -p ah -m state --state NEW -j CONNMARK --save-mark
|
|
#
|
|
# Rule 11 (global)
|
|
#
|
|
echo "Rule 11 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
# this rule, and the next one, should place
|
|
# CLASSIFY rule in a separate chain
|
|
# and pass control to it using -g
|
|
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j CLASSIFY --set-class 1:10
|
|
#
|
|
# Rule 12 (eth0)
|
|
#
|
|
echo "Rule 12 (eth0)"
|
|
#
|
|
# second rule for bug #1618381
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j CLASSIFY --set-class 1:11
|
|
#
|
|
# Rule 13 (global)
|
|
#
|
|
echo "Rule 13 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5BAD25451.0 -t mangle
|
|
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BAD25451.0
|
|
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5BAD25451.0 -j CLASSIFY --set-class 1:10
|
|
#
|
|
# Rule 14 (global)
|
|
#
|
|
echo "Rule 14 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5BBA25451.0 -t mangle
|
|
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5BBA25451.0 -j CLASSIFY --set-class 1:10
|
|
#
|
|
# Rule 15 (eth0)
|
|
#
|
|
echo "Rule 15 (eth0)"
|
|
#
|
|
# bug #1618381
|
|
# this rule uses multiport
|
|
# and has to be split because
|
|
# of that
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j CLASSIFY --set-class 1:11
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j CLASSIFY --set-class 1:11
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j CLASSIFY --set-class 1:11
|
|
#
|
|
# Rule 16 (global)
|
|
#
|
|
echo "Rule 16 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
# this rule, and the next one, should place
|
|
# CLASSIFY rule in a separate chain
|
|
# and pass control to it using -g
|
|
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j CLASSIFY --set-class 1:10
|
|
#
|
|
# Rule 17 (eth0)
|
|
#
|
|
echo "Rule 17 (eth0)"
|
|
#
|
|
# second rule for bug #1618381
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -j CLASSIFY --set-class 1:11
|
|
#
|
|
# Rule 18 (eth0)
|
|
#
|
|
echo "Rule 18 (eth0)"
|
|
#
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j CLASSIFY --set-class 1:11
|
|
#
|
|
# Rule 19 (global)
|
|
#
|
|
echo "Rule 19 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5BF925451.0 -t mangle
|
|
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5BF925451.0
|
|
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5BF925451.0 -j CLASSIFY --set-class 1:10
|
|
#
|
|
# Rule 20 (global)
|
|
#
|
|
echo "Rule 20 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5C0625451.0 -t mangle
|
|
$IPTABLES -t mangle -A POSTROUTING -p icmp -m icmp --icmp-type 3 -j Cid45AB5C0625451.0
|
|
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp --dport 80 -j Cid45AB5C0625451.0
|
|
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -t mangle -A Cid45AB5C0625451.0 -j CLASSIFY --set-class 1:10
|
|
#
|
|
# Rule 21 (eth0)
|
|
#
|
|
echo "Rule 21 (eth0)"
|
|
#
|
|
# bug #1618381
|
|
# this rule uses multiport
|
|
# and has to be split because
|
|
# of that
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp --dport 10000:11000 -j CLASSIFY --set-class 1:11
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j CLASSIFY --set-class 1:11
|
|
$IPTABLES -t mangle -A POSTROUTING -o eth0 -p udp -m udp -m multiport --dports 53,161 -j CLASSIFY --set-class 1:11
|
|
#
|
|
# Rule 22 (global)
|
|
#
|
|
echo "Rule 22 (global)"
|
|
#
|
|
# bug #1618381
|
|
# should generate branching code
|
|
# in both filter and mangle tables
|
|
$IPTABLES -t mangle -A PREROUTING -p tcp -m tcp -j rule27_branch
|
|
$IPTABLES -t mangle -A POSTROUTING -p tcp -m tcp -j rule27_branch
|
|
$IPTABLES -t mangle -A FORWARD -p tcp -m tcp -j rule27_branch
|
|
|
|
# ================ Table 'filter', rule set rule27_branch
|
|
#
|
|
# Rule rule27_branch 0 (global)
|
|
#
|
|
echo "Rule rule27_branch 0 (global)"
|
|
#
|
|
$IPTABLES -N rule27_branch
|
|
$IPTABLES -A rule27_branch -p tcp -m tcp --tcp-flags ALL ACK -j ACCEPT
|
|
#
|
|
# Rule rule27_branch 1 (global)
|
|
#
|
|
echo "Rule rule27_branch 1 (global)"
|
|
#
|
|
$IPTABLES -N rule27_branch_1
|
|
$IPTABLES -A rule27_branch -p tcp -m tcp --dport 80 -m state --state NEW -j rule27_branch_1
|
|
$IPTABLES -A rule27_branch_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
|
|
$IPTABLES -A rule27_branch_1 -j ACCEPT
|
|
# ================ Table 'filter', rule set Policy
|
|
#
|
|
# Rule 0 (global)
|
|
#
|
|
echo "Rule 0 (global)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -A OUTPUT -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -p ah -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 1 (global)
|
|
#
|
|
echo "Rule 1 (global)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -N RULE_1
|
|
$IPTABLES -A OUTPUT -p 50 -m state --state NEW -j RULE_1
|
|
$IPTABLES -A OUTPUT -p ah -m state --state NEW -j RULE_1
|
|
$IPTABLES -A INPUT -p 50 -m state --state NEW -j RULE_1
|
|
$IPTABLES -A INPUT -p ah -m state --state NEW -j RULE_1
|
|
$IPTABLES -A FORWARD -p 50 -m state --state NEW -j RULE_1
|
|
$IPTABLES -A FORWARD -p ah -m state --state NEW -j RULE_1
|
|
$IPTABLES -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "
|
|
$IPTABLES -A RULE_1 -j ACCEPT
|
|
#
|
|
# Rule 2 (global)
|
|
#
|
|
echo "Rule 2 (global)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -N Cid45AB5AC525451.0
|
|
$IPTABLES -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -A OUTPUT -p ah -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -A INPUT -p 50 -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -A INPUT -p ah -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -A FORWARD -p 50 -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -A FORWARD -p ah -m state --state NEW -j Cid45AB5AC525451.0
|
|
$IPTABLES -A Cid45AB5AC525451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5AC525451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -N RULE_2_3
|
|
$IPTABLES -A Cid45AB5AC525451.0 -j RULE_2_3
|
|
$IPTABLES -A RULE_2_3 -j LOG --log-level info --log-prefix "RULE 2 -- ACCEPT "
|
|
$IPTABLES -A RULE_2_3 -j ACCEPT
|
|
#
|
|
# Rule 3 (eth1)
|
|
#
|
|
echo "Rule 3 (eth1)"
|
|
#
|
|
# terminating target
|
|
$IPTABLES -A INPUT -i eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth1 -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth1 -p ah -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 4 (eth1)
|
|
#
|
|
echo "Rule 4 (eth1)"
|
|
#
|
|
# temrinating target
|
|
$IPTABLES -A OUTPUT -o eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth1 -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth1 -p ah -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 5 (global)
|
|
#
|
|
echo "Rule 5 (global)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -A OUTPUT -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -p ah -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 6 (global)
|
|
#
|
|
echo "Rule 6 (global)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -N RULE_6
|
|
$IPTABLES -A OUTPUT -p 50 -m state --state NEW -j RULE_6
|
|
$IPTABLES -A OUTPUT -p ah -m state --state NEW -j RULE_6
|
|
$IPTABLES -A INPUT -p 50 -m state --state NEW -j RULE_6
|
|
$IPTABLES -A INPUT -p ah -m state --state NEW -j RULE_6
|
|
$IPTABLES -A FORWARD -p 50 -m state --state NEW -j RULE_6
|
|
$IPTABLES -A FORWARD -p ah -m state --state NEW -j RULE_6
|
|
$IPTABLES -A RULE_6 -j LOG --log-level info --log-prefix "RULE 6 -- ACCEPT "
|
|
$IPTABLES -A RULE_6 -j ACCEPT
|
|
#
|
|
# Rule 7 (global)
|
|
#
|
|
echo "Rule 7 (global)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -N Cid45AB5B0225451.0
|
|
$IPTABLES -A OUTPUT -p 50 -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -A OUTPUT -p ah -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -A INPUT -p 50 -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -A INPUT -p ah -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -A FORWARD -p 50 -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -A FORWARD -p ah -m state --state NEW -j Cid45AB5B0225451.0
|
|
$IPTABLES -A Cid45AB5B0225451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5B0225451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -N RULE_7_3
|
|
$IPTABLES -A Cid45AB5B0225451.0 -j RULE_7_3
|
|
$IPTABLES -A RULE_7_3 -j LOG --log-level info --log-prefix "RULE 7 -- ACCEPT "
|
|
$IPTABLES -A RULE_7_3 -j ACCEPT
|
|
#
|
|
# Rule 8 (eth1)
|
|
#
|
|
echo "Rule 8 (eth1)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -A INPUT -i eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth1 -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth1 -p ah -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 9 (eth1)
|
|
#
|
|
echo "Rule 9 (eth1)"
|
|
#
|
|
# terminating and CONNMARK
|
|
$IPTABLES -A OUTPUT -o eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth1 -p ah -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth1 -p 50 -m state --state NEW -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth1 -p ah -m state --state NEW -j ACCEPT
|
|
#
|
|
# Rule 10 (global)
|
|
#
|
|
echo "Rule 10 (global)"
|
|
#
|
|
$IPTABLES -A OUTPUT -p tcp -m tcp -d 192.168.2.10 --dport 80 -j QUEUE
|
|
$IPTABLES -A FORWARD -p tcp -m tcp -d 192.168.2.10 --dport 80 -j QUEUE
|
|
#
|
|
# Rule 11 (global)
|
|
#
|
|
echo "Rule 11 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
# this rule, and the next one, should place
|
|
# CLASSIFY rule in a separate chain
|
|
# and pass control to it using -g
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
|
|
$IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 3 -j ACCEPT
|
|
#
|
|
# Rule 12 (eth0)
|
|
#
|
|
echo "Rule 12 (eth0)"
|
|
#
|
|
# second rule for bug #1618381
|
|
$IPTABLES -A INPUT -i eth0 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -j ACCEPT
|
|
#
|
|
# Rule 13 (global)
|
|
#
|
|
echo "Rule 13 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5BAD25451.0
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5BAD25451.0
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5BAD25451.0
|
|
$IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 3 -j Cid45AB5BAD25451.0
|
|
$IPTABLES -A Cid45AB5BAD25451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5BAD25451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5BAD25451.0 -j ACCEPT
|
|
#
|
|
# Rule 14 (global)
|
|
#
|
|
echo "Rule 14 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5BBA25451.0
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 80 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 3 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -j Cid45AB5BBA25451.0
|
|
$IPTABLES -A Cid45AB5BBA25451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5BBA25451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5BBA25451.0 -j ACCEPT
|
|
#
|
|
# Rule 15 (eth0)
|
|
#
|
|
echo "Rule 15 (eth0)"
|
|
#
|
|
# bug #1618381
|
|
# this rule uses multiport
|
|
# and has to be split because
|
|
# of that
|
|
$IPTABLES -A INPUT -i eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
#
|
|
# Rule 16 (global)
|
|
#
|
|
echo "Rule 16 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
# this rule, and the next one, should place
|
|
# CLASSIFY rule in a separate chain
|
|
# and pass control to it using -g
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
|
|
$IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 3 -j ACCEPT
|
|
#
|
|
# Rule 17 (eth0)
|
|
#
|
|
echo "Rule 17 (eth0)"
|
|
#
|
|
# second rule for bug #1618381
|
|
$IPTABLES -A INPUT -i eth0 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -j ACCEPT
|
|
#
|
|
# Rule 18 (eth0)
|
|
#
|
|
echo "Rule 18 (eth0)"
|
|
#
|
|
$IPTABLES -N Out_RULE_18
|
|
$IPTABLES -A OUTPUT -o eth0 -s 192.168.1.0/24 -j Out_RULE_18
|
|
$IPTABLES -A FORWARD -o eth0 -s 192.168.1.0/24 -j Out_RULE_18
|
|
$IPTABLES -A Out_RULE_18 -j LOG --log-level info --log-prefix "RULE 18 -- ACCEPT "
|
|
$IPTABLES -A Out_RULE_18 -j ACCEPT
|
|
#
|
|
# Rule 19 (global)
|
|
#
|
|
echo "Rule 19 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5BF925451.0
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5BF925451.0
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5BF925451.0
|
|
$IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 3 -j Cid45AB5BF925451.0
|
|
$IPTABLES -A Cid45AB5BF925451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5BF925451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5BF925451.0 -j ACCEPT
|
|
#
|
|
# Rule 20 (global)
|
|
#
|
|
echo "Rule 20 (global)"
|
|
#
|
|
# testing for bug #1618381
|
|
$IPTABLES -N Cid45AB5C0625451.0
|
|
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5C0625451.0
|
|
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 80 -j Cid45AB5C0625451.0
|
|
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -j Cid45AB5C0625451.0
|
|
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 -j Cid45AB5C0625451.0
|
|
$IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 3 -j Cid45AB5C0625451.0
|
|
$IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -j Cid45AB5C0625451.0
|
|
$IPTABLES -A Cid45AB5C0625451.0 -s 192.168.1.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5C0625451.0 -s 192.168.2.0/24 -j RETURN
|
|
$IPTABLES -A Cid45AB5C0625451.0 -j ACCEPT
|
|
#
|
|
# Rule 21 (eth0)
|
|
#
|
|
echo "Rule 21 (eth0)"
|
|
#
|
|
# bug #1618381
|
|
# this rule uses multiport
|
|
# and has to be split because
|
|
# of that
|
|
$IPTABLES -A INPUT -i eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A INPUT -i eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A FORWARD -i eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A OUTPUT -o eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p tcp -m tcp --dport 10000:11000 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p tcp -m tcp -m multiport --dports 113,13,53,2105,21,70,80,443,6667,119,25,3128,22,23,540 -j ACCEPT
|
|
$IPTABLES -A FORWARD -o eth0 -p udp -m udp -m multiport --dports 53,161 -j ACCEPT
|
|
#
|
|
# Rule 22 (global)
|
|
#
|
|
echo "Rule 22 (global)"
|
|
#
|
|
# bug #1618381
|
|
# should generate branching code
|
|
# in both filter and mangle tables
|
|
$IPTABLES -A OUTPUT -p tcp -m tcp -j rule27_branch
|
|
$IPTABLES -A INPUT -p tcp -m tcp -j rule27_branch
|
|
$IPTABLES -A FORWARD -p tcp -m tcp -j rule27_branch
|
|
#
|
|
# Rule 23 (global)
|
|
#
|
|
echo "Rule 23 (global)"
|
|
#
|
|
$IPTABLES -A INPUT -s 192.168.1.0/24 -j TCPMSS --set-mss 1400
|
|
$IPTABLES -A OUTPUT -s 192.168.1.0/24 -j TCPMSS --set-mss 1400
|
|
$IPTABLES -A FORWARD -s 192.168.1.0/24 -j TCPMSS --set-mss 1400
|
|
#
|
|
# Rule 24 (global)
|
|
#
|
|
echo "Rule 24 (global)"
|
|
#
|
|
$IPTABLES -N RULE_24
|
|
$IPTABLES -A OUTPUT -j RULE_24
|
|
$IPTABLES -A INPUT -j RULE_24
|
|
$IPTABLES -A FORWARD -j RULE_24
|
|
$IPTABLES -A RULE_24 -j LOG --log-level info --log-prefix "RULE 24 -- DENY "
|
|
$IPTABLES -A RULE_24 -j DROP
|
|
}
|
|
|
|
ip_forward() {
|
|
:
|
|
|
|
}
|
|
|
|
reset_all() {
|
|
:
|
|
reset_iptables_v4
|
|
}
|
|
|
|
block_action() {
|
|
reset_all
|
|
}
|
|
|
|
stop_action() {
|
|
reset_all
|
|
$IPTABLES -P OUTPUT ACCEPT
|
|
$IPTABLES -P INPUT ACCEPT
|
|
$IPTABLES -P FORWARD ACCEPT
|
|
}
|
|
|
|
check_iptables() {
|
|
IP_TABLES="$1"
|
|
[ ! -e $IP_TABLES ] && return 151
|
|
NF_TABLES=$(cat $IP_TABLES 2>/dev/null)
|
|
[ -z "$NF_TABLES" ] && return 152
|
|
return 0
|
|
}
|
|
status_action() {
|
|
check_iptables "/proc/net/ip_tables_names"
|
|
ret_ipv4=$?
|
|
check_iptables "/proc/net/ip6_tables_names"
|
|
ret_ipv6=$?
|
|
[ $ret_ipv4 -eq 0 -o $ret_ipv6 -eq 0 ] && return 0
|
|
[ $ret_ipv4 -eq 151 -o $ret_ipv6 -eq 151 ] && {
|
|
echo "iptables modules are not loaded"
|
|
}
|
|
[ $ret_ipv4 -eq 152 -o $ret_ipv6 -eq 152 ] && {
|
|
echo "Firewall is not configured"
|
|
}
|
|
exit 3
|
|
}
|
|
|
|
# See how we were called.
|
|
# For backwards compatibility missing argument is equivalent to 'start'
|
|
|
|
cmd=$1
|
|
test -z "$cmd" && {
|
|
cmd="start"
|
|
}
|
|
|
|
case "$cmd" in
|
|
start)
|
|
log "Activating firewall script generated Fri Jun 3 17:28:08 2011 by vadim"
|
|
check_tools
|
|
prolog_commands
|
|
check_run_time_address_table_files
|
|
|
|
load_modules "nat "
|
|
configure_interfaces
|
|
verify_interfaces
|
|
|
|
reset_all
|
|
|
|
script_body
|
|
ip_forward
|
|
epilog_commands
|
|
RETVAL=$?
|
|
;;
|
|
|
|
stop)
|
|
stop_action
|
|
RETVAL=$?
|
|
;;
|
|
|
|
status)
|
|
status_action
|
|
RETVAL=$?
|
|
;;
|
|
|
|
block)
|
|
block_action
|
|
RETVAL=$?
|
|
;;
|
|
|
|
reload)
|
|
$0 stop
|
|
$0 start
|
|
RETVAL=$?
|
|
;;
|
|
|
|
interfaces)
|
|
configure_interfaces
|
|
RETVAL=$?
|
|
;;
|
|
|
|
test_interfaces)
|
|
FWBDEBUG="echo"
|
|
configure_interfaces
|
|
RETVAL=$?
|
|
;;
|
|
|
|
|
|
|
|
*)
|
|
echo "Usage $0 [start|stop|status|block|reload|interfaces|test_interfaces]"
|
|
;;
|
|
|
|
esac
|
|
|
|
exit $RETVAL |