webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Some smaller enhancements for the firewall script

Browse Source 
git-svn-id: http://svn.ipfire.org/svn/ipfire/branches/2.1/trunk@1135 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8
This commit is contained in:
maniacikarus
2007-12-30 11:02:40 +00:00
parent 615788e80d
commit 97fe1741a3
4 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/rootfiles/core/4/files
View File

@@ -1,4 +1,5 @@
etc/inid.d/firewall
usr/local/bin/makegraphs
var/ipfire/langs
var/ipfire/optionsfw/settings
var/ipfire/menu.d/50-firewall.menu

4
html/cgi-bin/logs.cgi/log.dat
View File

@@ -50,7 +50,7 @@ my $year = $now[5]+1900;
$cgiparams{'DAY'} = $now[3];
$cgiparams{'MONTH'} = $now[4];
$cgiparams{'ACTION'} = '';
$cgiparams{'SECTION'} = 'kernel';
$cgiparams{'SECTION'} = 'ipfire';
my %sections = (
'ipfire' => '(ipfire: )',
@@ -61,7 +61,7 @@ my %sections = (
'ntp' => '(ntpd(?:ate)?\[.*\]: )',
'ssh' => '(sshd(?:\(.*\))?\[.*\]: )',
'auth' => '(\w+\(pam_unix\)\[.*\]: )',
'kernel' => '(kernel: (?!DROP-))',
'kernel' => '(kernel: (?!DROP_))',
'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |vpnwatch: )',
'openvpn' => '(openvpnserver)\[.*\]: '
);

27
src/initscripts/init.d/firewall
View File

@@ -2,7 +2,6 @@
eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
if [ -f /var/ipfire/red/device ]; then
@@ -35,20 +34,20 @@ iptables_init() {
# of flags might indicate a port-scan attempt (xmas, null, etc)
/sbin/iptables -N PSCAN
if [ "$DROPPORTSCAN" == "on" ]; then
/sbin/iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "DROP-TCP Scan " -m comment --comment "DROP-TCP PScan"
/sbin/iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "DROP-UDP Scan " -m comment --comment "DROP-UPD PScan"
/sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP-ICMP Scan " -m comment --comment "DROP-ICMP PScan"
/sbin/iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "DROP-FRAG Scan " -m comment --comment "DROP-FRAG PScan"
/sbin/iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan"
/sbin/iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UPD PScan"
/sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
/sbin/iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
fi
/sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP PScan"
/sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
# New tcp packets without SYN set - could well be an obscure type of port scan
# that's not covered above, may just be a broken windows machine
/sbin/iptables -N NEWNOTSYN
if [ "$DROPNEWNOTSYN" == "on" ]; then
/sbin/iptables -A NEWNOTSYN -m limit --limit 10/minute -j LOG --log-prefix "DROP-NEW not SYN " -m comment --comment "DROP-NEW not SYN"
/sbin/iptables -A NEWNOTSYN -m limit --limit 10/minute -j LOG --log-prefix "DROP_NEWNOTSYN "
fi
/sbin/iptables -A NEWNOTSYN -j DROP
/sbin/iptables -A NEWNOTSYN -j DROP -m comment --comment "DROP_NEWNOTSYN"
# Chain to contain all the rules relating to bad TCP flags
/sbin/iptables -N BADTCP
@@ -262,11 +261,13 @@ case "$1" in
# last rule in input and forward chain is for logging.
if [ "$DROPINPUT" == "on" ]; then
/sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP-INPUT " -m comment --comment "DROP-INPUT"
/sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
fi
/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
if [ "$DROPOUTPUT" == "on" ]; then
/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP-OUTPUT " -m comment --comment "DROP-OUTPUT"
/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT "
fi
/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT"
;;
startovpn)
# run openvpn
@@ -296,11 +297,13 @@ case "$1" in
fi
if [ "$DROPINPUT" == "on" ]; then
/sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP-INPUT " -m comment --comment "DROP-INPUT"
/sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT "
fi
/sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT"
if [ "$DROPOUTPUT" == "on" ]; then
/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP-OUTPUT " -m comment --comment "DROP-OUTPUT"
/sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT "
fi
/sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT"
;;
stopovpn)
# stop openvpn

2
src/scripts/makegraphs
View File

@@ -277,7 +277,7 @@ sub updatefwhitsdata {
$aktuell = 0;
if (!$skip) {
while (<FILE>) {
if (/kernel:.*(IN=.*)$/) {$aktuell++;}
if (/kernel: DROP_INPUT.*$/) {$aktuell++;}
}
close (FILE);
}