webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 03:33:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Make conntrack helpers configurable

Browse Source
This commit is contained in:
Michael Tremer
2015-05-12 13:16:40 +02:00
parent 4071b2d61b
commit d57c6162cb
2 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lfs/configroot
View File

@@ -135,6 +135,11 @@ $(TARGET) :
echo "POLICY=MODE2" >> $(CONFIG_ROOT)/firewall/settings echo "POLICY=MODE2" >> $(CONFIG_ROOT)/firewall/settings
echo "POLICY1=MODE2" >> $(CONFIG_ROOT)/firewall/settings echo "POLICY1=MODE2" >> $(CONFIG_ROOT)/firewall/settings
# Add conntrack helper default settings
for proto in FTP PPTP SIP TFTP; do \
echo "CONNTRACK_$${proto}=on" >> $(CONFIG_ROOT)/optionsfw/settings; \
done
# set converters executable # set converters executable
chmod 755 /usr/sbin/convert-* chmod 755 /usr/sbin/convert-*

36
src/initscripts/init.d/firewall
View File

@@ -97,26 +97,34 @@ iptables_init() {
# Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/) # Conntrack helpers (https://home.regit.org/netfilter-en/secure-use-of-helpers/)
# SIP # SIP
iptables -A CONNTRACK -m conntrack --ctstate RELATED \ if [ "${CONNTRACK_SIP}" = "on" ]; then
-m helper --helper sip -j ACCEPT iptables -A CONNTRACK -m conntrack --ctstate RELATED \
for proto in udp tcp; do -m helper --helper sip -j ACCEPT
iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip for proto in udp tcp; do
done iptables -t raw -A CONNTRACK -p "${proto}" --dport 5060 -j CT --helper sip
done
fi
# FTP # FTP
iptables -A CONNTRACK -m conntrack --ctstate RELATED \ if [ "${CONNTRACK_FTP}" = "on" ]; then
-m helper --helper ftp -p tcp --dport 1024: -j ACCEPT iptables -A CONNTRACK -m conntrack --ctstate RELATED \
iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
iptables -t raw -A CONNTRACK -p tcp --dport 21 -j CT --helper ftp
fi
# PPTP # PPTP
iptables -A CONNTRACK -m conntrack --ctstate RELATED \ if [ "${CONNTRACK_PPTP}" = "on" ]; then
-m helper --helper pptp -j ACCEPT iptables -A CONNTRACK -m conntrack --ctstate RELATED \
iptables -t raw -A CONNTRACK -p udp --dport 1723 -j CT --helper pptp -m helper --helper pptp -j ACCEPT
iptables -t raw -A CONNTRACK -p udp --dport 1723 -j CT --helper pptp
fi
# TFTP # TFTP
iptables -A CONNTRACK -m conntrack --ctstate RELATED \ if [ "${CONNTRACK_TFTP}" = "on" ]; then
-m helper --helper tftp -j ACCEPT iptables -A CONNTRACK -m conntrack --ctstate RELATED \
iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp -m helper --helper tftp -j ACCEPT
iptables -t raw -A CONNTRACK -p udp --dport 69 -j CT --helper tftp
fi
# Fix for braindead ISP's # Fix for braindead ISP's
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu