mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-11 11:35:54 +02:00
bb3834231e
This has been some real trouble because multiple rules could not be properly inserted into the rule chains in the kernel because the chains did not exist, yet.
342 lines
9.7 KiB
Bash
342 lines
9.7 KiB
Bash
#!/bin/sh
|
|
|
|
. /etc/sysconfig/rc
|
|
. ${rc_functions}
|
|
|
|
eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings)
|
|
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
|
|
eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings)
|
|
IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'`
|
|
|
|
if [ -f /var/ipfire/red/device ]; then
|
|
DEVICE=`/bin/cat /var/ipfire/red/device 2> /dev/null | /usr/bin/tr -d '\012'`
|
|
fi
|
|
|
|
function iptables() {
|
|
/sbin/iptables --wait "$@"
|
|
}
|
|
|
|
iptables_init() {
|
|
# Flush all rules and delete all custom chains
|
|
iptables -F
|
|
iptables -t nat -F
|
|
iptables -t mangle -F
|
|
iptables -X
|
|
iptables -t nat -X
|
|
iptables -t mangle -X
|
|
|
|
# Set up policies
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
# Empty LOG_DROP and LOG_REJECT chains
|
|
iptables -N LOG_DROP
|
|
iptables -A LOG_DROP -m limit --limit 10/minute -j LOG
|
|
iptables -A LOG_DROP -j DROP
|
|
iptables -N LOG_REJECT
|
|
iptables -A LOG_REJECT -m limit --limit 10/minute -j LOG
|
|
iptables -A LOG_REJECT -j REJECT
|
|
|
|
# This chain will log, then DROPs packets with certain bad combinations
|
|
# of flags might indicate a port-scan attempt (xmas, null, etc)
|
|
iptables -N PSCAN
|
|
if [ "$DROPPORTSCAN" == "on" ]; then
|
|
iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan"
|
|
iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UDP PScan"
|
|
iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan"
|
|
iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan"
|
|
fi
|
|
iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan"
|
|
|
|
# New tcp packets without SYN set - could well be an obscure type of port scan
|
|
# that's not covered above, may just be a broken windows machine
|
|
iptables -N NEWNOTSYN
|
|
if [ "$DROPNEWNOTSYN" == "on" ]; then
|
|
iptables -A NEWNOTSYN -m limit --limit 10/minute -j LOG --log-prefix "DROP_NEWNOTSYN "
|
|
fi
|
|
iptables -A NEWNOTSYN -j DROP -m comment --comment "DROP_NEWNOTSYN"
|
|
|
|
# Chain to contain all the rules relating to bad TCP flags
|
|
iptables -N BADTCP
|
|
|
|
# Don't check loopback
|
|
iptables -A BADTCP -i lo -j RETURN
|
|
|
|
# Disallow packets frequently used by port-scanners
|
|
# nmap xmas
|
|
iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN
|
|
# Null
|
|
iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
|
|
# FIN
|
|
iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
|
|
# SYN/RST (also catches xmas variants that set SYN+RST+...)
|
|
iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
|
|
# SYN/FIN (QueSO or nmap OS probe)
|
|
iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
|
|
# NEW TCP without SYN
|
|
iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
|
|
|
|
iptables -A INPUT -p tcp -j BADTCP
|
|
iptables -A FORWARD -p tcp -j BADTCP
|
|
|
|
# Connection tracking chain
|
|
iptables -N CONNTRACK
|
|
iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Fix for braindead ISP's
|
|
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
|
|
|
|
# CUSTOM chains, can be used by the users themselves
|
|
iptables -N CUSTOMINPUT
|
|
iptables -A INPUT -j CUSTOMINPUT
|
|
iptables -N CUSTOMFORWARD
|
|
iptables -A FORWARD -j CUSTOMFORWARD
|
|
iptables -N CUSTOMOUTPUT
|
|
iptables -A OUTPUT -j CUSTOMOUTPUT
|
|
iptables -t nat -N CUSTOMPREROUTING
|
|
iptables -t nat -A PREROUTING -j CUSTOMPREROUTING
|
|
iptables -t nat -N CUSTOMPOSTROUTING
|
|
iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING
|
|
|
|
# Guardian (IPS) chains
|
|
iptables -N GUARDIAN
|
|
iptables -A INPUT -j GUARDIAN
|
|
iptables -A FORWARD -j GUARDIAN
|
|
|
|
# Block OpenVPN transfer networks
|
|
iptables -N OVPNBLOCK
|
|
for i in INPUT FORWARD; do
|
|
iptables -A ${i} -j OVPNBLOCK
|
|
done
|
|
|
|
# OpenVPN transfer network translation
|
|
iptables -t nat -N OVPNNAT
|
|
iptables -t nat -A POSTROUTING -j OVPNNAT
|
|
|
|
# IPTV chains for IGMPPROXY
|
|
iptables -N IPTVINPUT
|
|
iptables -A INPUT -j IPTVINPUT
|
|
iptables -N IPTVFORWARD
|
|
iptables -A FORWARD -j IPTVFORWARD
|
|
|
|
# filtering from GUI
|
|
iptables -N GUIINPUT
|
|
iptables -A INPUT -j GUIINPUT
|
|
iptables -A GUIINPUT -p icmp --icmp-type 8 -j ACCEPT
|
|
|
|
# Accept everything on loopback
|
|
iptables -N LOOPBACK
|
|
iptables -A LOOPBACK -i lo -j ACCEPT
|
|
iptables -A LOOPBACK -o lo -j ACCEPT
|
|
|
|
# Filter all packets with loopback addresses on non-loopback interfaces.
|
|
iptables -A LOOPBACK -s 127.0.0.0/8 -j DROP
|
|
iptables -A LOOPBACK -d 127.0.0.0/8 -j DROP
|
|
|
|
for i in INPUT FORWARD OUTPUT; do
|
|
iptables -A ${i} -j LOOPBACK
|
|
done
|
|
|
|
# Accept everything connected
|
|
for i in INPUT FORWARD OUTPUT; do
|
|
iptables -A ${i} -j CONNTRACK
|
|
done
|
|
|
|
# trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
|
|
iptables -N IPSECINPUT
|
|
iptables -N IPSECFORWARD
|
|
iptables -N IPSECOUTPUT
|
|
iptables -A INPUT -j IPSECINPUT
|
|
iptables -A FORWARD -j IPSECFORWARD
|
|
iptables -A OUTPUT -j IPSECOUTPUT
|
|
iptables -t nat -N IPSECNAT
|
|
iptables -t nat -A POSTROUTING -j IPSECNAT
|
|
|
|
# localhost and ethernet.
|
|
iptables -A INPUT -i $GREEN_DEV -m conntrack --ctstate NEW -j ACCEPT ! -p icmp
|
|
|
|
# allow DHCP on BLUE to be turned on/off
|
|
iptables -N DHCPBLUEINPUT
|
|
iptables -A INPUT -j DHCPBLUEINPUT
|
|
|
|
# WIRELESS chains
|
|
iptables -N WIRELESSINPUT
|
|
iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT
|
|
iptables -N WIRELESSFORWARD
|
|
iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
|
|
|
|
# OpenVPN
|
|
iptables -N OVPNINPUT
|
|
iptables -A INPUT -j OVPNINPUT
|
|
|
|
# TOR
|
|
iptables -N TOR_INPUT
|
|
iptables -A INPUT -j TOR_INPUT
|
|
|
|
# Jump into the actual firewall ruleset.
|
|
iptables -N INPUTFW
|
|
iptables -A INPUT -j INPUTFW
|
|
|
|
iptables -N OUTGOINGFW
|
|
iptables -A OUTPUT -j OUTGOINGFW
|
|
|
|
iptables -N FORWARDFW
|
|
iptables -A FORWARD -j FORWARDFW
|
|
|
|
# SNAT rules
|
|
iptables -t nat -N NAT_SOURCE
|
|
iptables -t nat -A POSTROUTING -j NAT_SOURCE
|
|
|
|
# RED chain, used for the red interface
|
|
iptables -N REDINPUT
|
|
iptables -A INPUT -j REDINPUT
|
|
iptables -N REDFORWARD
|
|
iptables -A FORWARD -j REDFORWARD
|
|
iptables -t nat -N REDNAT
|
|
iptables -t nat -A POSTROUTING -j REDNAT
|
|
|
|
# Custom prerouting chains (for transparent proxy)
|
|
iptables -t nat -N SQUID
|
|
iptables -t nat -A PREROUTING -j SQUID
|
|
|
|
# DNAT rules
|
|
iptables -t nat -N NAT_DESTINATION
|
|
iptables -t nat -A PREROUTING -j NAT_DESTINATION
|
|
|
|
# upnp chain for our upnp daemon
|
|
iptables -t nat -N UPNPFW
|
|
iptables -t nat -A PREROUTING -j UPNPFW
|
|
iptables -N UPNPFW
|
|
iptables -A FORWARD -m conntrack --ctstate NEW -j UPNPFW
|
|
|
|
# Apply OpenVPN firewall rules
|
|
/usr/local/bin/openvpnctrl --firewall-rules
|
|
|
|
# run wirelessctrl
|
|
/usr/local/bin/wirelessctrl
|
|
|
|
# POLICY CHAIN
|
|
iptables -N POLICYIN
|
|
iptables -A INPUT -j POLICYIN
|
|
iptables -N POLICYFWD
|
|
iptables -A FORWARD -j POLICYFWD
|
|
iptables -N POLICYOUT
|
|
iptables -A OUTPUT -j POLICYOUT
|
|
|
|
# Initialize firewall policies.
|
|
/usr/sbin/firewall-policy
|
|
|
|
# Install firewall rules for the red interface.
|
|
iptables_red
|
|
}
|
|
|
|
iptables_red() {
|
|
iptables -F REDINPUT
|
|
iptables -F REDFORWARD
|
|
iptables -t nat -F REDNAT
|
|
|
|
# PPPoE / PPTP Device
|
|
if [ "$IFACE" != "" ]; then
|
|
# PPPoE / PPTP
|
|
if [ "$DEVICE" != "" ]; then
|
|
iptables -A REDINPUT -i $DEVICE -j ACCEPT
|
|
fi
|
|
if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == "PPPOE" ]; then
|
|
if [ "$RED_DEV" != "" ]; then
|
|
iptables -A REDINPUT -i $RED_DEV -j ACCEPT
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# PPTP over DHCP
|
|
if [ "$DEVICE" != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" ]; then
|
|
iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
|
|
iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT
|
|
fi
|
|
|
|
# Orange pinholes
|
|
if [ "$ORANGE_DEV" != "" ]; then
|
|
# This rule enables a host on ORANGE network to connect to the outside
|
|
# (only if we have a red connection)
|
|
if [ "$IFACE" != "" ]; then
|
|
iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT
|
|
fi
|
|
fi
|
|
|
|
if [ "$IFACE" != "" -a -f /var/ipfire/red/active ]; then
|
|
# DHCP
|
|
if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then
|
|
iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
|
|
iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
|
|
fi
|
|
if [ "$METHOD" == "DHCP" -a "$PROTOCOL" == "RFC1483" ]; then
|
|
iptables -A REDINPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
|
|
iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT
|
|
fi
|
|
|
|
# Outgoing masquerading (don't masqerade IPSEC (mark 50))
|
|
iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN
|
|
iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE
|
|
|
|
fi
|
|
|
|
# Reload all rules.
|
|
/usr/local/bin/firewallctrl
|
|
}
|
|
|
|
# See how we were called.
|
|
case "$1" in
|
|
start)
|
|
boot_mesg "Loading firewall modules into the kernel"
|
|
modprobe iptable_nat || failed=1
|
|
for i in $(find /lib/modules/$(uname -r) -name nf_conntrack*); do
|
|
modprobe $(basename $i | cut -d. -f1) || failed=1
|
|
done
|
|
for i in $(find /lib/modules/$(uname -r) -name nf_nat*); do
|
|
modprobe $(basename $i | cut -d. -f1) || failed=1
|
|
done
|
|
(exit ${failed})
|
|
evaluate_retval
|
|
|
|
if [ -e /var/ipfire/main/disable_nf_sip ]; then
|
|
rmmod nf_nat_sip
|
|
rmmod nf_conntrack_sip
|
|
rmmod nf_nat_h323
|
|
rmmod nf_conntrack_h323
|
|
fi
|
|
|
|
boot_mesg "Setting up firewall"
|
|
iptables_init
|
|
evaluate_retval
|
|
|
|
# run local firewall configuration, if present
|
|
if [ -x /etc/sysconfig/firewall.local ]; then
|
|
/etc/sysconfig/firewall.local start
|
|
fi
|
|
;;
|
|
reload)
|
|
boot_mesg "Reloading firewall"
|
|
iptables_red
|
|
evaluate_retval
|
|
|
|
# run local firewall configuration, if present
|
|
if [ -x /etc/sysconfig/firewall.local ]; then
|
|
/etc/sysconfig/firewall.local reload
|
|
fi
|
|
;;
|
|
restart)
|
|
# run local firewall configuration, if present
|
|
if [ -x /etc/sysconfig/firewall.local ]; then
|
|
/etc/sysconfig/firewall.local stop
|
|
fi
|
|
$0 start
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {start|reload|restart}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
exit 0
|