mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-05-02 08:12:54 +02:00
Forward Firewall: added new files
This commit is contained in:
Alexander Marx
committed by
Michael Tremer
Michael Tremer
parent
111c99ddfa
commit
2a81ab0d77
252
config/forwardfw/firewall-lib.pl
Normal file
252
config/forwardfw/firewall-lib.pl
Normal file
@@ -0,0 +1,252 @@
|
|||||||
|
#!/usr/bin/perl
|
||||||
|
###############################################################################
|
||||||
|
# #
|
||||||
|
# IPFire.org - A linux based firewall #
|
||||||
|
# Copyright (C) 2012 #
|
||||||
|
# #
|
||||||
|
# This program is free software: you can redistribute it and/or modify #
|
||||||
|
# it under the terms of the GNU General Public License as published by #
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or #
|
||||||
|
# (at your option) any later version. #
|
||||||
|
# #
|
||||||
|
# This program is distributed in the hope that it will be useful, #
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
||||||
|
# GNU General Public License for more details. #
|
||||||
|
# #
|
||||||
|
# You should have received a copy of the GNU General Public License #
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
||||||
|
# #
|
||||||
|
###############################################################################
|
||||||
|
|
||||||
|
|
||||||
|
use strict;
|
||||||
|
no warnings 'uninitialized';
|
||||||
|
|
||||||
|
package fwlib;
|
||||||
|
|
||||||
|
my %customnetwork=();
|
||||||
|
my %customhost=();
|
||||||
|
my %customgrp=();
|
||||||
|
my %customservice=();
|
||||||
|
my %customservicegrp=();
|
||||||
|
my %ccdnet=();
|
||||||
|
my %ccdhost=();
|
||||||
|
my %ipsecconf=();
|
||||||
|
my %ipsecsettings=();
|
||||||
|
my %netsettings=();
|
||||||
|
my %ovpnsettings=();
|
||||||
|
|
||||||
|
require '/var/ipfire/general-functions.pl';
|
||||||
|
|
||||||
|
my $confignet = "${General::swroot}/fwhosts/customnetworks";
|
||||||
|
my $confighost = "${General::swroot}/fwhosts/customhosts";
|
||||||
|
my $configgrp = "${General::swroot}/fwhosts/customgroups";
|
||||||
|
my $configsrv = "${General::swroot}/fwhosts/customservices";
|
||||||
|
my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
|
||||||
|
my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
|
||||||
|
my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
|
||||||
|
my $configipsec = "${General::swroot}/vpn/config";
|
||||||
|
my $configovpn = "${General::swroot}/ovpn/settings";
|
||||||
|
my $val;
|
||||||
|
my $field;
|
||||||
|
|
||||||
|
&General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
|
||||||
|
&General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
|
||||||
|
&General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
|
||||||
|
|
||||||
|
|
||||||
|
&General::readhasharray("$confignet", \%customnetwork);
|
||||||
|
&General::readhasharray("$confighost", \%customhost);
|
||||||
|
&General::readhasharray("$configgrp", \%customgrp);
|
||||||
|
&General::readhasharray("$configccdnet", \%ccdnet);
|
||||||
|
&General::readhasharray("$configccdhost", \%ccdhost);
|
||||||
|
&General::readhasharray("$configipsec", \%ipsecconf);
|
||||||
|
&General::readhasharray("$configsrv", \%customservice);
|
||||||
|
&General::readhasharray("$configsrvgrp", \%customservicegrp);
|
||||||
|
|
||||||
|
sub get_srv_prot
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
foreach my $key (sort keys %customservice){
|
||||||
|
if($customservice{$key}[0] eq $val){
|
||||||
|
if ($customservice{$key}[0] eq $val){
|
||||||
|
return $customservice{$key}[2];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_srvgrp_prot
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my @ips=();
|
||||||
|
my $tcp;
|
||||||
|
my $udp;
|
||||||
|
my $icmp;
|
||||||
|
foreach my $key (sort keys %customservicegrp){
|
||||||
|
if($customservicegrp{$key}[0] eq $val){
|
||||||
|
if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
|
||||||
|
$tcp=1;
|
||||||
|
}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
|
||||||
|
$udp=1;
|
||||||
|
}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
|
||||||
|
$icmp=1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if ($tcp eq '1'){push (@ips,'TCP');}
|
||||||
|
if ($udp eq '1'){push (@ips,'UDP');}
|
||||||
|
if ($icmp eq '1'){push (@ips,'ICMP');}
|
||||||
|
my $back=join(",",@ips);
|
||||||
|
return $back;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
sub get_srv_port
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $field=shift;
|
||||||
|
my $prot=shift;
|
||||||
|
foreach my $key (sort keys %customservice){
|
||||||
|
if($customservice{$key}[0] eq $val){
|
||||||
|
if($customservice{$key}[2] eq $prot){
|
||||||
|
return $customservice{$key}[$field];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_srvgrp_port
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $prot=shift;
|
||||||
|
my $back;
|
||||||
|
my $value;
|
||||||
|
my @ips=();
|
||||||
|
foreach my $key (sort keys %customservicegrp){
|
||||||
|
if($customservicegrp{$key}[0] eq $val){
|
||||||
|
if ($prot ne 'ICMP'){
|
||||||
|
$value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
|
||||||
|
}elsif ($prot eq 'ICMP'){
|
||||||
|
$value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
|
||||||
|
}
|
||||||
|
push (@ips,$value) if ($value ne '') ;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if($prot ne 'ICMP'){
|
||||||
|
if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
|
||||||
|
}elsif ($prot eq 'ICMP'){
|
||||||
|
$back="--icmp-type ";
|
||||||
|
}
|
||||||
|
|
||||||
|
$back.=join(",",@ips);
|
||||||
|
return $back;
|
||||||
|
}
|
||||||
|
sub get_ipsec_net_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $field=shift;
|
||||||
|
foreach my $key (sort keys %ipsecconf){
|
||||||
|
if($ipsecconf{$key}[1] eq $val){
|
||||||
|
return $ipsecconf{$key}[$field];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_ipsec_host_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $field=shift;
|
||||||
|
foreach my $key (sort keys %ipsecconf){
|
||||||
|
if($ipsecconf{$key}[1] eq $val){
|
||||||
|
return $ipsecconf{$key}[$field];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_ovpn_n2n_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $field=shift;
|
||||||
|
foreach my $key (sort keys %ccdhost){
|
||||||
|
if($ccdhost{$key}[1] eq $val){
|
||||||
|
return $ccdhost{$key}[$field];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_ovpn_host_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $field=shift;
|
||||||
|
foreach my $key (sort keys %ccdhost){
|
||||||
|
if($ccdhost{$key}[1] eq $val){
|
||||||
|
return $ccdhost{$key}[$field];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_ovpn_net_ip
|
||||||
|
{
|
||||||
|
|
||||||
|
my $val=shift;
|
||||||
|
my $field=shift;
|
||||||
|
foreach my $key (sort keys %ccdnet){
|
||||||
|
if($ccdnet{$key}[0] eq $val){
|
||||||
|
return $ccdnet{$key}[$field];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_grp_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $src=shift;
|
||||||
|
foreach my $key (sort keys %customgrp){
|
||||||
|
if ($customgrp{$key}[0] eq $val){
|
||||||
|
&get_address($customgrp{$key}[3],$src);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
sub get_std_net_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
if ($val eq 'ALL'){
|
||||||
|
return "0.0.0.0/0.0.0.0";
|
||||||
|
}elsif($val eq 'GREEN'){
|
||||||
|
return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
|
||||||
|
}elsif($val eq 'ORANGE'){
|
||||||
|
return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
|
||||||
|
}elsif($val eq 'BLUE'){
|
||||||
|
return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
|
||||||
|
}elsif($val =~ /OpenVPN/i){
|
||||||
|
return "$ovpnsettings{'DOVPN_SUBNET'}";
|
||||||
|
}elsif($val =~ /IPsec/i){
|
||||||
|
return "$ipsecsettings{'RW_NET'}";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_net_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
foreach my $key (sort keys %customnetwork){
|
||||||
|
if($customnetwork{$key}[0] eq $val){
|
||||||
|
return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_host_ip
|
||||||
|
{
|
||||||
|
my $val=shift;
|
||||||
|
my $src=shift;
|
||||||
|
foreach my $key (sort keys %customhost){
|
||||||
|
if($customhost{$key}[0] eq $val){
|
||||||
|
if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
|
||||||
|
return "-m mac --mac-source $customhost{$key}[2]";
|
||||||
|
}elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
|
||||||
|
return "$customhost{$key}[2]";
|
||||||
|
}elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
|
||||||
|
return "$customhost{$key}[2]";
|
||||||
|
}elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
|
||||||
|
return "none";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return 1;
|
||||||
334
config/forwardfw/rules.pl
Executable file
334
config/forwardfw/rules.pl
Executable file
@@ -0,0 +1,334 @@
|
|||||||
|
#!/usr/bin/perl
|
||||||
|
###############################################################################
|
||||||
|
# #
|
||||||
|
# IPFire.org - A linux based firewall #
|
||||||
|
# Copyright (C) 2012 #
|
||||||
|
# #
|
||||||
|
# This program is free software: you can redistribute it and/or modify #
|
||||||
|
# it under the terms of the GNU General Public License as published by #
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or #
|
||||||
|
# (at your option) any later version. #
|
||||||
|
# #
|
||||||
|
# This program is distributed in the hope that it will be useful, #
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
||||||
|
# GNU General Public License for more details. #
|
||||||
|
# #
|
||||||
|
# You should have received a copy of the GNU General Public License #
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
||||||
|
# #
|
||||||
|
###############################################################################
|
||||||
|
# #
|
||||||
|
# Hi folks! I hope this code is useful for all. I needed something to handle #
|
||||||
|
# my VPN Connections in a comfortable way. #
|
||||||
|
# This script builds firewallrules from the webinterface #
|
||||||
|
###############################################################################
|
||||||
|
|
||||||
|
|
||||||
|
use strict;
|
||||||
|
no warnings 'uninitialized';
|
||||||
|
|
||||||
|
# enable only the following on debugging purpose
|
||||||
|
#use warnings;
|
||||||
|
#use CGI::Carp 'fatalsToBrowser';
|
||||||
|
|
||||||
|
my %fwdfwsettings=();
|
||||||
|
my %defaultNetworks=();
|
||||||
|
my %configfwdfw=();
|
||||||
|
my %color=();
|
||||||
|
my %icmptypes=();
|
||||||
|
my %ovpnSettings=();
|
||||||
|
my %customgrp=();
|
||||||
|
our %sourcehash=();
|
||||||
|
our %targethash=();
|
||||||
|
my @timeframe=();
|
||||||
|
my %configinputfw=();
|
||||||
|
my %aliases=();
|
||||||
|
my @DPROT=();
|
||||||
|
require '/var/ipfire/general-functions.pl';
|
||||||
|
require "${General::swroot}/lang.pl";
|
||||||
|
require "${General::swroot}/forward/bin/firewall-lib.pl";
|
||||||
|
|
||||||
|
my $configfwdfw = "${General::swroot}/forward/config";
|
||||||
|
my $configinput = "${General::swroot}/forward/input";
|
||||||
|
my $configgrp = "${General::swroot}/fwhosts/customgroups";
|
||||||
|
my $errormessage='';
|
||||||
|
my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT);
|
||||||
|
my $CHAIN="FORWARDFW";
|
||||||
|
|
||||||
|
|
||||||
|
&General::readhash("${General::swroot}/forward/settings", \%fwdfwsettings);
|
||||||
|
&General::readhasharray($configfwdfw, \%configfwdfw);
|
||||||
|
&General::readhasharray($configinput, \%configinputfw);
|
||||||
|
&General::readhasharray($configgrp, \%customgrp);
|
||||||
|
&General::get_aliases(\%aliases);
|
||||||
|
|
||||||
|
################################
|
||||||
|
# DEBUG/TEST #
|
||||||
|
################################
|
||||||
|
my $MODE=0; # 0 - normal operation
|
||||||
|
# 1 - print configline and rules to console
|
||||||
|
#
|
||||||
|
################################
|
||||||
|
my $param=shift;
|
||||||
|
|
||||||
|
if($param eq 'flush'){
|
||||||
|
if ($MODE eq '1'){
|
||||||
|
print " Flushing chains...\n";
|
||||||
|
}
|
||||||
|
&flush;
|
||||||
|
}else{
|
||||||
|
if ($MODE eq '1'){
|
||||||
|
print " Flushing chains...\n";
|
||||||
|
}
|
||||||
|
&flush;
|
||||||
|
if ($MODE eq '1'){
|
||||||
|
print " Preparing rules...\n";
|
||||||
|
}
|
||||||
|
&preparerules;
|
||||||
|
if($MODE eq '0'){
|
||||||
|
if ($fwdfwsettings{'POLICY'} eq 'MODE1'){
|
||||||
|
system ("iptables -A $CHAIN -j DROP");
|
||||||
|
}elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
|
||||||
|
system ("iptables -A $CHAIN -j ACCEPT");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
sub flush
|
||||||
|
{
|
||||||
|
system ("iptables -F FORWARDFW");
|
||||||
|
system ("iptables -F INPUTFW");
|
||||||
|
}
|
||||||
|
sub preparerules
|
||||||
|
{
|
||||||
|
if (! -z "${General::swroot}/forward/config"){
|
||||||
|
&buildrules(\%configfwdfw);
|
||||||
|
}
|
||||||
|
if (! -z "${General::swroot}/forward/input"){
|
||||||
|
&buildrules(\%configinputfw);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub buildrules
|
||||||
|
{
|
||||||
|
my $hash=shift;
|
||||||
|
foreach my $key (sort keys %$hash){
|
||||||
|
if($$hash{$key}[2] eq 'ON'){
|
||||||
|
#get source ip's
|
||||||
|
if ($$hash{$key}[3] eq 'cust_grp_src'){
|
||||||
|
foreach my $grp (sort keys %customgrp){
|
||||||
|
if($customgrp{$grp}[0] eq $$hash{$key}[4]){
|
||||||
|
&get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"src");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}else{
|
||||||
|
&get_address($$hash{$key}[3],$$hash{$key}[4],"src");
|
||||||
|
}
|
||||||
|
#get target ip's
|
||||||
|
if ($$hash{$key}[5] eq 'cust_grp_tgt'){
|
||||||
|
foreach my $grp (sort keys %customgrp){
|
||||||
|
if($customgrp{$grp}[0] eq $$hash{$key}[6]){
|
||||||
|
&get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"tgt");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}elsif($$hash{$key}[5] eq 'ipfire'){
|
||||||
|
|
||||||
|
if($$hash{$key}[6] eq 'Default IP'){
|
||||||
|
open(FILE, "/var/ipfire/red/local-ipaddress") or die 'Unable to open config file.';
|
||||||
|
$targethash{$key}[0]= <FILE>;
|
||||||
|
close(FILE);
|
||||||
|
}else{
|
||||||
|
foreach my $alias (sort keys %aliases){
|
||||||
|
if ($$hash{$key}[6] eq $alias){
|
||||||
|
$targethash{$key}[0]=$aliases{$alias}{'IPT'};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}else{
|
||||||
|
&get_address($$hash{$key}[5],$$hash{$key}[6],"tgt");
|
||||||
|
}
|
||||||
|
|
||||||
|
##get source prot and port
|
||||||
|
$SRC_TGT='SRC';
|
||||||
|
$SPROT = &get_prot($hash,$key);
|
||||||
|
$SPORT = &get_port($hash,$key);
|
||||||
|
$SRC_TGT='';
|
||||||
|
|
||||||
|
##get target prot and port
|
||||||
|
$DPROT=&get_prot($hash,$key);
|
||||||
|
|
||||||
|
if ($DPROT eq ''){$DPROT=' ';}
|
||||||
|
@DPROT=split(",",$DPROT);
|
||||||
|
|
||||||
|
|
||||||
|
#get time if defined
|
||||||
|
if($$hash{$key}[18] eq 'ON'){
|
||||||
|
if($$hash{$key}[19] ne ''){push (@timeframe,"Mon");}
|
||||||
|
if($$hash{$key}[20] ne ''){push (@timeframe,"Tue");}
|
||||||
|
if($$hash{$key}[21] ne ''){push (@timeframe,"Wed");}
|
||||||
|
if($$hash{$key}[22] ne ''){push (@timeframe,"Thu");}
|
||||||
|
if($$hash{$key}[23] ne ''){push (@timeframe,"Fri");}
|
||||||
|
if($$hash{$key}[24] ne ''){push (@timeframe,"Sat");}
|
||||||
|
if($$hash{$key}[25] ne ''){push (@timeframe,"Sun");}
|
||||||
|
$TIME=join(",",@timeframe);
|
||||||
|
$TIMEFROM="--timestart $$hash{$key}[26] ";
|
||||||
|
$TIMETILL="--timestop $$hash{$key}[27] ";
|
||||||
|
$TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL";
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($MODE eq '1'){
|
||||||
|
print "NR:$key ";
|
||||||
|
foreach my $i (0 .. $#{$$hash{$key}}){
|
||||||
|
print "$i: $$hash{$key}[$i] ";
|
||||||
|
}
|
||||||
|
print "\n";
|
||||||
|
print"##################################\n";
|
||||||
|
#print rules to console
|
||||||
|
|
||||||
|
foreach my $DPROT (@DPROT){
|
||||||
|
$DPORT = &get_port($hash,$key,$DPROT);
|
||||||
|
if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;}
|
||||||
|
$PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
|
||||||
|
foreach my $a (sort keys %sourcehash){
|
||||||
|
foreach my $b (sort keys %targethash){
|
||||||
|
if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none'){
|
||||||
|
if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){
|
||||||
|
if ($$hash{$key}[17] eq 'ON'){
|
||||||
|
print "iptables -A $$hash{$key}[1] $PROT -s $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
|
||||||
|
}
|
||||||
|
print "iptables -A $$hash{$key}[1] $PROT -s $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
print"\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
}elsif($MODE eq '0'){
|
||||||
|
foreach my $DPROT (@DPROT){
|
||||||
|
$DPORT = &get_port($hash,$key,$DPROT);
|
||||||
|
if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;}
|
||||||
|
$PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
|
||||||
|
foreach my $a (sort keys %sourcehash){
|
||||||
|
foreach my $b (sort keys %targethash){
|
||||||
|
if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none'){
|
||||||
|
if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){
|
||||||
|
if ($$hash{$key}[17] eq 'ON'){
|
||||||
|
system ("iptables -A $$hash{$key}[1] $PROT -s $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG");
|
||||||
|
}
|
||||||
|
system ("iptables -A $$hash{$key}[1] $PROT -s $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
print"\n";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
%sourcehash=();
|
||||||
|
%targethash=();
|
||||||
|
undef $TIME;
|
||||||
|
undef $TIMEFROM;
|
||||||
|
undef $TIMETILL;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_address
|
||||||
|
{
|
||||||
|
my $base=shift; #source of checking ($configfwdfw{$key}[x] or groupkey
|
||||||
|
my $base2=shift;
|
||||||
|
my $type=shift; #src or tgt
|
||||||
|
my $hash;
|
||||||
|
if ($type eq 'src'){
|
||||||
|
$hash=\%sourcehash;
|
||||||
|
}else{
|
||||||
|
$hash=\%targethash;
|
||||||
|
}
|
||||||
|
my $key = &General::findhasharraykey($hash);
|
||||||
|
if($base eq 'src_addr' || $base eq 'tgt_addr' ){
|
||||||
|
$$hash{$key}[0] = $configfwdfw{$key}[4];
|
||||||
|
}elsif($base eq 'std_net_src' || $base eq 'std_net_tgt' || $base eq 'Standard Network'){
|
||||||
|
$$hash{$key}[0]=&fwlib::get_std_net_ip($base2);
|
||||||
|
}elsif($base eq 'cust_net_src' || $base eq 'cust_net_tgt' || $base eq 'Custom Network'){
|
||||||
|
$$hash{$key}[0]=&fwlib::get_net_ip($base2);
|
||||||
|
}elsif($base eq 'cust_host_src' || $base eq 'cust_host_tgt' || $base eq 'Custom Host'){
|
||||||
|
$$hash{$key}[0]=&fwlib::get_host_ip($base2,$type);
|
||||||
|
}elsif($base eq 'ovpn_net_src' || $base eq 'ovpn_net_tgt' || $base eq 'OpenVPN static network'){
|
||||||
|
$$hash{$key}[0]=&fwlib::get_ovpn_net_ip($base2,1);
|
||||||
|
}elsif($base eq 'ovpn_host_src' ||$base eq 'ovpn_host_tgt' || $base eq 'OpenVPN static host'){
|
||||||
|
$$hash{$key}[0]=&fwlib::get_ovpn_host_ip($base2,33);
|
||||||
|
}elsif($base eq 'ovpn_n2n_src' ||$base eq 'ovpn_n2n_tgt' || $base eq 'OpenVPN N-2-N'){
|
||||||
|
$$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,27);
|
||||||
|
}elsif($base eq 'ipsec_net_src' || $base eq 'ipsec_net_tgt' || $base eq 'IpSec Network'){
|
||||||
|
$$hash{$key}[0]=&fwlib::get_ipsec_net_ip($base2,11);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_prot
|
||||||
|
{
|
||||||
|
my $hash=shift;
|
||||||
|
my $key=shift;
|
||||||
|
if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){
|
||||||
|
if ($$hash{$key}[10] ne ''){
|
||||||
|
return"$$hash{$key}[8]";
|
||||||
|
}elsif($$hash{$key}[9] ne ''){
|
||||||
|
return"$$hash{$key}[8]";
|
||||||
|
}else{
|
||||||
|
return "$$hash{$key}[8]";
|
||||||
|
}
|
||||||
|
}elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
|
||||||
|
if ($$hash{$key}[14] eq 'TGT_PORT'){
|
||||||
|
if ($$hash{$key}[15] ne ''){
|
||||||
|
return "$$hash{$key}[12]";
|
||||||
|
}elsif($$hash{$key}[13] ne ''){
|
||||||
|
return "$$hash{$key}[12]";
|
||||||
|
}else{
|
||||||
|
return "$$hash{$key}[12]";
|
||||||
|
}
|
||||||
|
}elsif($$hash{$key}[14] eq 'cust_srv'){
|
||||||
|
return &fwlib::get_srv_prot($$hash{$key}[15]);
|
||||||
|
|
||||||
|
}elsif($$hash{$key}[14] eq 'cust_srvgrp'){
|
||||||
|
return &fwlib::get_srvgrp_prot($$hash{$key}[15]);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
sub get_port
|
||||||
|
{
|
||||||
|
my $hash=shift;
|
||||||
|
my $key=shift;
|
||||||
|
my $prot=shift;
|
||||||
|
if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){
|
||||||
|
if ($$hash{$key}[10] ne ''){
|
||||||
|
return "--sport $$hash{$key}[10] ";
|
||||||
|
}elsif($$hash{$key}[9] ne ''){
|
||||||
|
return "--icmp-type $$hash{$key}[9] ";
|
||||||
|
}
|
||||||
|
}elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
|
||||||
|
|
||||||
|
if($$hash{$key}[14] eq 'TGT_PORT'){
|
||||||
|
if ($$hash{$key}[15] ne ''){
|
||||||
|
return "--dport $$hash{$key}[15] ";
|
||||||
|
}elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] ne 'All ICMP-Types'){
|
||||||
|
return "--icmp-type $$hash{$key}[13] ";
|
||||||
|
}elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] eq 'All ICMP-Types'){
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}elsif($$hash{$key}[14] eq 'cust_srv'){
|
||||||
|
if ($prot ne 'ICMP'){
|
||||||
|
return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
|
||||||
|
}elsif($prot eq 'ICMP' && $$hash{$key}[15] ne 'All ICMP-Types'){
|
||||||
|
return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot);
|
||||||
|
}elsif($prot eq 'ICMP' && $$hash{$key}[15] eq 'All ICMP-Types'){
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}elsif($$hash{$key}[14] eq 'cust_srvgrp'){
|
||||||
|
if ($prot ne 'ICMP'){
|
||||||
|
return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot);
|
||||||
|
}
|
||||||
|
elsif($prot eq 'ICMP'){
|
||||||
|
return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
36
config/fwhosts/icmp-types
Normal file
36
config/fwhosts/icmp-types
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
0,echo-reply (pong),0
|
||||||
|
1,destination-unreachable,3
|
||||||
|
2,network-unreachable,3/0
|
||||||
|
3,host-unreachable,3/1
|
||||||
|
4,protocol-unreachable,3/2
|
||||||
|
5,port-unreachable,3/3
|
||||||
|
6,fragmentation-needed,3/4
|
||||||
|
7,source-route-failed,3/5
|
||||||
|
8,network-unknown,3/6
|
||||||
|
9,host-unknown,3/7
|
||||||
|
10,network-prohibited,3/9
|
||||||
|
11,host-prohibited,3/10
|
||||||
|
12,TOS-network-unreachable,3/11
|
||||||
|
13,TOS-host-unreachable,3/12
|
||||||
|
14,communication-prohibited,3/13
|
||||||
|
15,host-precedence-violation,3/14
|
||||||
|
16,precedence-cutoff,3/15
|
||||||
|
17,source-quench,4
|
||||||
|
18,redirect,5
|
||||||
|
19,network-redirect,5/0
|
||||||
|
20,host-redirect,5/1
|
||||||
|
21,TOS-network-redirect,5/2
|
||||||
|
22,TOS-host-redirect,5/3
|
||||||
|
23,echo-request (ping),8
|
||||||
|
24,router-advertisement,9
|
||||||
|
25,router-solicitation,10
|
||||||
|
26,time-exceeded (ttl-exceeded),11
|
||||||
|
27,ttl-zero-during-transit,11/0
|
||||||
|
28,ttl-zero-during-reassembly,11/1
|
||||||
|
29,parameter-problem,12
|
||||||
|
30,ip-header-bad,12/0
|
||||||
|
31,required-option-missing,12/1
|
||||||
|
32,timestamp-request,13
|
||||||
|
33,timestamp-reply,14
|
||||||
|
34,address-mask-request,17
|
||||||
|
35,address-mask-reply,18
|
||||||
1772
html/cgi-bin/forwardfw.cgi
Executable file
1772
html/cgi-bin/forwardfw.cgi
Executable file
File diff suppressed because it is too large
Load Diff
1970
html/cgi-bin/fwhosts.cgi
Executable file
1970
html/cgi-bin/fwhosts.cgi
Executable file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user