webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 03:33:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Forward Firewall: fixed firewall hits statistik and extended it to show input,output,forward,newnotsyn and portscan seperately.

Browse Source
This commit is contained in:
Alexander Marx
2013-04-14 15:10:13 +02:00
committed by Michael Tremer
parent 6f348fcb9d
commit 94ea1f0346
4 changed files with 46 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
config/cfgroot/graphs.pl
View File

@@ -216,7 +216,7 @@ sub updatecpugraph {
,"GPRINT:userpct:AVERAGE:%3.2lf%%" ,"GPRINT:userpct:AVERAGE:%3.2lf%%"
,"GPRINT:userpct:MIN:%3.2lf%%" ,"GPRINT:userpct:MIN:%3.2lf%%"
,"GPRINT:userpct:LAST:%3.2lf%%\\j" ,"GPRINT:userpct:LAST:%3.2lf%%\\j"
,"STACK:systempct".$color{"color13"}."A0:".sprintf("%-25s",$Lang::tr{'cpu system usage'}) ,"STACK:systempct".$color{"color13"}."A0:".sprintf("%-26s",$Lang::tr{'cpu system usage'})
,"GPRINT:systempct:MAX:%3.2lf%%" ,"GPRINT:systempct:MAX:%3.2lf%%"
,"GPRINT:systempct:AVERAGE:%3.2lf%%" ,"GPRINT:systempct:AVERAGE:%3.2lf%%"
,"GPRINT:systempct:MIN:%3.2lf%%" ,"GPRINT:systempct:MIN:%3.2lf%%"
@@ -602,26 +602,50 @@ sub updatefwhitsgraph {
"--color=SHADEA".$color{"color19"}, "--color=SHADEA".$color{"color19"},
"--color=SHADEB".$color{"color19"}, "--color=SHADEB".$color{"color19"},
"--color=BACK".$color{"color21"}, "--color=BACK".$color{"color21"},
"DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-FORWARD/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE", "DEF:output=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYOUT/ipt_bytes-DROP_OUTPUT.rrd:value:AVERAGE",
"DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-INPUT/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE", "DEF:input=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYIN/ipt_bytes-DROP_INPUT.rrd:value:AVERAGE",
"DEF:forward=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-POLICYFWD/ipt_bytes-DROP_FORWARD.rrd:value:AVERAGE",
"DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE", "DEF:newnotsyn=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-NEWNOTSYN/ipt_bytes-DROP_NEWNOTSYN.rrd:value:AVERAGE",
"DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE", "DEF:portscan=".$mainsettings{'RRDLOG'}."/collectd/localhost/iptables-filter-PSCAN/ipt_bytes-DROP_PScan.rrd:value:AVERAGE",
"CDEF:amount=output,input,newnotsyn,+,+", #"CDEF:amount=input",
"COMMENT:".sprintf("%-20s",$Lang::tr{'caption'}), "COMMENT:".sprintf("%-26s",$Lang::tr{'caption'}),
"COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}), "COMMENT:".sprintf("%15s",$Lang::tr{'maximal'}),
"COMMENT:".sprintf("%15s",$Lang::tr{'average'}), "COMMENT:".sprintf("%15s",$Lang::tr{'average'}),
"COMMENT:".sprintf("%15s",$Lang::tr{'minimal'}), "COMMENT:".sprintf("%14s",$Lang::tr{'minimal'}),
"COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j", "COMMENT:".sprintf("%15s",$Lang::tr{'current'})."\\j",
"AREA:amount".$color{"color24"}."A0:".sprintf("%-20s",$Lang::tr{'firewallhits'}), "AREA:input".$color{"color24"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}."-INPUT"),
"GPRINT:amount:MAX:%8.1lf %sBps", "GPRINT:input:MAX:%8.1lf %sBps",
"GPRINT:amount:AVERAGE:%8.1lf %sBps", "GPRINT:input:AVERAGE:%8.1lf %sBps",
"GPRINT:amount:MIN:%8.1lf %sBps", "GPRINT:input:MIN:%8.1lf %sBps",
"GPRINT:amount:LAST:%8.1lf %sBps\\j", "GPRINT:input:LAST:%8.1lf %sBps\\j",
"STACK:portscan".$color{"color25"}."A0:".sprintf("%-20s",$Lang::tr{'portscans'}), "AREA:output".$color{"color25"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}."-OUTPUT"),
"GPRINT:output:MAX:%8.1lf %sBps",
"GPRINT:output:AVERAGE:%8.1lf %sBps",
"GPRINT:output:MIN:%8.1lf %sBps",
"GPRINT:output:LAST:%8.1lf %sBps\\j",
"AREA:forward".$color{"color23"}."A0:".sprintf("%-25s",$Lang::tr{'firewallhits'}."-FORWARD"),
"GPRINT:forward:MAX:%8.1lf %sBps",
"GPRINT:forward:AVERAGE:%8.1lf %sBps",
"GPRINT:forward:MIN:%8.1lf %sBps",
"GPRINT:forward:LAST:%8.1lf %sBps\\j",
"AREA:newnotsyn".$color{"color14"}."A0:".sprintf("%-24s","NewNotSyn"),
"GPRINT:newnotsyn:MAX:%8.1lf %sBps",
"GPRINT:newnotsyn:MIN:%8.1lf %sBps",
"GPRINT:newnotsyn:AVERAGE:%8.1lf %sBps",
"GPRINT:newnotsyn:LAST:%8.1lf %sBps\\j",
"AREA:portscan".$color{"color16"}."A0:".sprintf("%-24s",$Lang::tr{'portscans'}),
"GPRINT:portscan:MAX:%8.1lf %sBps", "GPRINT:portscan:MAX:%8.1lf %sBps",
"GPRINT:portscan:MIN:%8.1lf %sBps", "GPRINT:portscan:MIN:%8.1lf %sBps",
"GPRINT:portscan:AVERAGE:%8.1lf %sBps", "GPRINT:portscan:AVERAGE:%8.1lf %sBps",
"GPRINT:portscan:LAST:%8.1lf %sBps\\j", "GPRINT:portscan:LAST:%8.1lf %sBps\\j",
"LINE1:input".$color{"color24"},
"LINE1:output".$color{"color25"},
"LINE1:forward".$color{"color23"},
"LINE1:newnotsyn".$color{"color14"},
"LINE1:portscan".$color{"color16"},
); );
$ERROR = RRDs::error; $ERROR = RRDs::error;
print "Error in RRD::graph for firewallhits: ".$ERROR."\n" if $ERROR; print "Error in RRD::graph for firewallhits: ".$ERROR."\n" if $ERROR;

7
config/collectd/collectd.conf
View File

@@ -23,7 +23,7 @@ LoadPlugin memory
LoadPlugin ping LoadPlugin ping
LoadPlugin processes LoadPlugin processes
LoadPlugin rrdtool LoadPlugin rrdtool
LoadPlugin sensors #LoadPlugin sensors
LoadPlugin swap LoadPlugin swap
LoadPlugin syslog LoadPlugin syslog
#LoadPlugin wireless #LoadPlugin wireless
@@ -45,10 +45,11 @@ include "/etc/collectd.precache"
</Plugin> </Plugin>
<Plugin iptables> <Plugin iptables>
Chain filter INPUT DROP_INPUT
Chain filter FORWARD DROP_OUTPUT
Chain filter PSCAN DROP_PScan Chain filter PSCAN DROP_PScan
Chain filter NEWNOTSYN DROP_NEWNOTSYN Chain filter NEWNOTSYN DROP_NEWNOTSYN
Chain filter POLICYFWD DROP_FORWARD
Chain filter POLICYOUT DROP_OUTPUT
Chain filter POLICYIN DROP_INPUT
</Plugin> </Plugin>
#<Plugin logfile> #<Plugin logfile>

6
config/forwardfw/firewall-policy
View File

@@ -23,8 +23,8 @@ if [ "$POLICY" == "MODE1" ]; then
/sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD" /sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
fi fi
else else
/sbin/iptables -A POLICYFWD -i blue0 ! -o $IFACE -j DROP -m comment --comment "DROP_FORWARD_BLUE" /sbin/iptables -A POLICYFWD -i blue0 ! -o $IFACE -j DROP
/sbin/iptables -A POLICYFWD -j ACCEPT -m comment --comment "DROP_FORWARD" /sbin/iptables -A POLICYFWD -j ACCEPT
fi fi
#OUTGOINGFW #OUTGOINGFW
@@ -42,7 +42,7 @@ if [ "$POLICY1" == "MODE1" ]; then
/sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT" /sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
fi fi
else else
/sbin/iptables -A POLICYOUT -j ACCEPT -m comment --comment "DROP_OUTPUT" /sbin/iptables -A POLICYOUT -j ACCEPT
fi fi
#INPUT #INPUT
if [ "$FWPOLICY2" == "REJECT" ]; then if [ "$FWPOLICY2" == "REJECT" ]; then

3
src/initscripts/init.d/firewall
View File

@@ -277,6 +277,9 @@ case "$1" in
/usr/sbin/firewall-policy /usr/sbin/firewall-policy
#Only for firewall Hits statistik
/sbin/iptables -A POLICYFWD -j DROP -m comment --comment "DROP_FORWARD"
/sbin/iptables -A POLICYOUT -j DROP -m comment --comment "DROP_OUTPUT"
;; ;;
startovpn) startovpn)
# run openvpn # run openvpn