| | 1 | #!/bin/bash |
| | 2 | ############################################################################### |
| | 3 | # # |
| | 4 | # IPFire.org - A linux based firewall # |
| | 5 | # Copyright (C) 2012 IPFire Network Development Team # |
| | 6 | # # |
| | 7 | # This program is free software: you can redistribute it and/or modify # |
| | 8 | # it under the terms of the GNU General Public License as published by # |
| | 9 | # the Free Software Foundation, either version 3 of the License, or # |
| | 10 | # (at your option) any later version. # |
| | 11 | # # |
| | 12 | # This program is distributed in the hope that it will be useful, # |
| | 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # |
| | 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # |
| | 15 | # GNU General Public License for more details. # |
| | 16 | # # |
| | 17 | # You should have received a copy of the GNU General Public License # |
| | 18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # |
| | 19 | # # |
| | 20 | ############################################################################### |
| | 21 | |
| | 22 | # This function initializes all kernel parameters that need to be adjusted |
| | 23 | # to run this firewall properly. |
| | 24 | firewall_kernel_init() { |
| | 25 | log INFO "Configuring kernel parameters..." |
| | 26 | local option |
| | 27 | |
| | 28 | # Enable conntrack accounting |
| | 29 | conntrack_set_accounting "true" |
| | 30 | |
| | 31 | # Adjust max. amount of simultaneous connections |
| | 32 | conntrack_set_max_connections "${CONNTRACK_MAX_CONNECTIONS}" |
| | 33 | |
| | 34 | # Increase UDP connection timeout (fixes DNS) |
| | 35 | conntrack_set_udp_timeout "${CONNTRACK_UDP_TIMEOUT}" |
| | 36 | |
| | 37 | # Disable sending redirects |
| | 38 | log INFO "Disabling sending redirects" |
| | 39 | sysctl_set_recursively "net.ipv6.conf" "send_redirects" 0 |
| | 40 | sysctl_set_recursively "net.ipv4.conf" "send_redirects" 0 |
| | 41 | |
| | 42 | # Enable source route protection |
| | 43 | log INFO "Enabling source route protection" |
| | 44 | sysctl_set_recursively "net.ipv6.conf" "accept_source_route" 0 |
| | 45 | sysctl_set_recursively "net.ipv4.conf" "accept_source_route" 0 |
| | 46 | |
| | 47 | # ICMP broadcast protection (smurf amplifier protection) |
| | 48 | log INFO "Enabling ICMP broadcast protection (smurf amplifier protection)" |
| | 49 | sysctl_set "net.ipv4.icmp_echo_ignore_broadcasts" 1 |
| | 50 | |
| | 51 | # ICMP Dead Error Message protection |
| | 52 | log INFO "Enabling ICMP dead error message protection" |
| | 53 | sysctl_set "net.ipv4.icmp_ignore_bogus_error_responses" 0 |
| | 54 | |
| | 55 | # Enable packet forwarding |
| | 56 | log INFO "Enabling packet forwarding" |
| | 57 | sysctl_set_recursively "net.ipv6.conf" "forwarding" 1 |
| | 58 | sysctl_set_recursively "net.ipv4.conf" "forwarding" 1 |
| | 59 | |
| | 60 | # Setting some kernel performance options |
| | 61 | log INFO "Setting some kernel performance options" |
| | 62 | for option in window_scaling timestamps sack dsack fack; do |
| | 63 | sysctl_set "net.ipv4.tcp_${option}" 1 |
| | 64 | done |
| | 65 | sysctl_set "net.ipv4.tcp_low_latency" 0 |
| | 66 | |
| | 67 | # Reduce DoS ability by reducing timeouts |
| | 68 | log INFO "Reducing DoS ability" |
| | 69 | sysctl_set "net.ipv4.tcp_fin_timeout" 30 |
| | 70 | sysctl_set "net.ipv4.tcp_keepalive_time" 1800 |
| | 71 | |
| | 72 | # Set number of times to retry SYN in a new connection |
| | 73 | sysctl_set "net.ipv4.tcp_syn_retries" 3 |
| | 74 | |
| | 75 | # Set number of times to retry a SYN-ACK in a half-open new connection |
| | 76 | sysctl_set "net.ipv4.tcp_synack_retries" 2 |
| | 77 | |
| | 78 | # Enable a fix for RFC1337 - time-wait assassination hazards in TCP |
| | 79 | sysctl_set "net.ipv4.tcp_rfc1337" 1 |
| | 80 | |
| | 81 | # SYN-flood protection |
| | 82 | if enabled FIREWALL_SYN_COOKIES; then |
| | 83 | log INFO "Enabling SYN-flood protection via SYN-cookies" |
| | 84 | sysctl_set_bool "net.ipv4.tcp_syncookies" 1 |
| | 85 | else |
| | 86 | log INFO "Disabling SYN-flood protection via SYN-cookies" |
| | 87 | sysctl_set_bool "net.ipv4.tcp_syncookies" 0 |
| | 88 | fi |
| | 89 | |
| | 90 | # rp_filter |
| | 91 | if enabled FIREWALL_RP_FILTER; then |
| | 92 | log INFO "Enabling anti-spoof from non-routable IP addresses" |
| | 93 | sysctl_set_recursively "net.ipv4.conf" "rp_filter" 1 |
| | 94 | else |
| | 95 | log INFO "Disabling anti-spoof from non-routable IP addresses" |
| | 96 | sysctl_set_recursively "net.ipv4.conf" "rp_filter" 0 |
| | 97 | fi |
| | 98 | |
| | 99 | # Log martians |
| | 100 | if enabled FIREWALL_LOG_MARTIANS; then |
| | 101 | log INFO "Enabling the logging of martians" |
| | 102 | sysctl_set_recursively "net.ipv4.conf" "log_martians" 1 |
| | 103 | else |
| | 104 | log INFO "Disabling the logging of martians" |
| | 105 | sysctl_set_recursively "net.ipv4.conf" "log_martians" 0 |
| | 106 | fi |
| | 107 | |
| | 108 | # ICMP redirect messages |
| | 109 | if enabled FIREWALL_ACCEPT_ICMP_REDIRECTS; then |
| | 110 | log INFO "Enabling accepting ICMP-redirect messages" |
| | 111 | sysctl_set_recursively "net.ipv6.conf" "accept_redirects" 1 |
| | 112 | sysctl_set_recursively "net.ipv4.conf" "accept_redirects" 1 |
| | 113 | else |
| | 114 | log INFO "Disabling accepting ICMP-redirect messages" |
| | 115 | sysctl_set_recursively "net.ipv6.conf" "accept_redirects" 0 |
| | 116 | sysctl_set_recursively "net.ipv4.conf" "accept_redirects" 0 |
| | 117 | fi |
| | 118 | |
| | 119 | # Explicit Congestion Notification |
| | 120 | if enabled FIREWALL_USE_ECN; then |
| | 121 | log INFO "Enabling ECN (Explicit Congestion Notification)" |
| | 122 | sysctl_set "net.ipv4.tcp_ecn" 1 |
| | 123 | sysctl_set "net.ipv4.tcp_ecn_fallback" 1 |
| | 124 | else |
| | 125 | log INFO "Disabling ECN (Explicit Congestion Notification)" |
| | 126 | sysctl_set "net.ipv4.tcp_ecn" 2 |
| | 127 | fi |
| | 128 | |
| | 129 | # Dynamic IP address hacking |
| | 130 | log INFO "Enabling kernel support for dynamic IP addresses" |
| | 131 | sysctl_set "net.ipv4.ip_dynaddr" 1 |
| | 132 | |
| | 133 | if enabled FIREWALL_PMTU_DISCOVERY; then |
| | 134 | log INFO "Enabling PMTU discovery" |
| | 135 | sysctl_set "net.ipv4.ip_no_pmtu_disc" 0 |
| | 136 | else |
| | 137 | log INFO "Disabling PMTU discovery" |
| | 138 | sysctl_set "net.ipv4.ip_no_pmtu_disc" 1 |
| | 139 | fi |
| | 140 | |
| | 141 | # TTL |
| | 142 | if ipv4_ttl_valid "${FIREWALL_DEFAULT_TTL}"; then |
| | 143 | log INFO "Setting default TTL to ${FIREWALL_DEFAULT_TTL}" |
| | 144 | sysctl_set "net.ipv4.ip_default_ttl" "${FIREWALL_DEFAULT_TTL}" |
| | 145 | else |
| | 146 | log ERROR "Invalid value for default TTL '${FIREWALL_DEFAULT_TTL}'" |
| | 147 | log ERROR " Must be between 10 and 255!" |
| | 148 | fi |
| | 149 | |
| | 150 | return ${EXIT_OK} |
| | 151 | } |
| | 152 | |
| | 153 | # High-level function which will create a ruleset for the current firewall |
| | 154 | # configuration and load it into the kernel. |
| | 155 | firewall_start() { |
| | 156 | local protocol="${1}" |
| | 157 | assert isset protocol |
| | 158 | shift |
| | 159 | |
| | 160 | # Test mode. |
| | 161 | local test="false" |
| | 162 | |
| | 163 | while [ $# -gt 0 ]; do |
| | 164 | case "${1}" in |
| | 165 | --test) |
| | 166 | test="true" |
| | 167 | ;; |
| | 168 | *) |
| | 169 | error "Unrecognized argument: ${1}" |
| | 170 | return ${EXIT_ERROR} |
| | 171 | ;; |
| | 172 | esac |
| | 173 | shift |
| | 174 | done |
| | 175 | |
| | 176 | if enabled test; then |
| | 177 | log INFO "Test mode enabled." |
| | 178 | log INFO "The firewall ruleset will not be loaded." |
| | 179 | fi |
| | 180 | |
| | 181 | firewall_lock_acquire |
| | 182 | |
| | 183 | # Initialize an empty iptables ruleset. |
| | 184 | iptables_init "${protocol}" "DROP" |
| | 185 | |
| | 186 | # Add default chains. |
| | 187 | firewall_filter_rh0_headers "${protocol}" |
| | 188 | firewall_filter_icmp "${protocol}" |
| | 189 | firewall_filter_invalid_packets "${protocol}" |
| | 190 | firewall_custom_chains "${protocol}" |
| | 191 | firewall_connection_tracking "${protocol}" |
| | 192 | firewall_tcp_clamp_mss "${protocol}" |
| | 193 | |
| | 194 | # Add policies for every zone. |
| | 195 | firewall_localhost_create_chains "${protocol}" |
| | 196 | |
| | 197 | local zone |
| | 198 | for zone in $(zones_get_all); do |
| | 199 | # Create all needed chains for the zone. |
| | 200 | firewall_zone_create_chains "${protocol}" "${zone}" |
| | 201 | |
| | 202 | # After the chains that are always available have been |
| | 203 | # created, we will add a custom policy to every single |
| | 204 | # zone. |
| | 205 | |
| | 206 | policy_zone_add "${protocol}" "${zone}" |
| | 207 | done |
| | 208 | |
| | 209 | # Load the new ruleset. |
| | 210 | local args |
| | 211 | if enabled testmode; then |
| | 212 | list_append args "--test" |
| | 213 | fi |
| | 214 | iptables_commit "${protocol}" ${args} |
| | 215 | |
| | 216 | firewall_lock_release |
| | 217 | } |
| | 218 | |
| | 219 | firewall_stop() { |
| | 220 | local protocol="${1}" |
| | 221 | assert isset protocol |
| | 222 | |
| | 223 | firewall_lock_acquire |
| | 224 | |
| | 225 | # Initialize an empty firewall ruleset |
| | 226 | # with default policy ACCEPT. |
| | 227 | iptables_init "${protocol}" ACCEPT |
| | 228 | |
| | 229 | # Load it. |
| | 230 | ipables_load "${protocol}" |
| | 231 | |
| | 232 | firewall_lock_release |
| | 233 | } |
| | 234 | |
| | 235 | firewall_show() { |
| | 236 | local protocol="${1}" |
| | 237 | assert isset protocol |
| | 238 | |
| | 239 | # Shows the ruleset that is currently loaded. |
| | 240 | iptables_status "${protocol}" |
| | 241 | |
| | 242 | return ${EXIT_OK} |
| | 243 | } |
| | 244 | |
| | 245 | firewall_panic() { |
| | 246 | local protocol="${1}" |
| | 247 | assert isset protocol |
| | 248 | shift |
| | 249 | |
| | 250 | local admin_hosts="$@" |
| | 251 | |
| | 252 | firewall_lock_acquire "${protocol}" |
| | 253 | |
| | 254 | # Drop all communications. |
| | 255 | iptables_init "${protocol}" DROP |
| | 256 | |
| | 257 | # If an admin host is provided, some administrative |
| | 258 | # things will be allowed from there. |
| | 259 | local admin_host |
| | 260 | for admin_host in ${admin_hosts}; do |
| | 261 | iptables "${protocol}" -A INPUT -s "${admin_host}" -j ACCEPT |
| | 262 | iptables "${protocol}" -A OUTPUT -d "${admin_host}" -j ACCEPT |
| | 263 | done |
| | 264 | |
| | 265 | # Load it. |
| | 266 | iptables_commit "${protocol}" |
| | 267 | |
| | 268 | firewall_lock_release |
| | 269 | } |
| | 270 | |
| | 271 | firewall_lock_acquire() { |
| | 272 | # XXX DEPRECATED |
| | 273 | #lock_acquire ${RUN_DIR}/.firewall_lock |
| | 274 | |
| | 275 | # Make sure the lock is released after the firewall |
| | 276 | # script has crashed or exited early. |
| | 277 | trap firewall_lock_release EXIT TERM KILL |
| | 278 | |
| | 279 | # Create a directory where we can put our |
| | 280 | # temporary data in the most secure way as possible. |
| | 281 | IPTABLES_TMPDIR=$(mktemp -d) |
| | 282 | } |
| | 283 | |
| | 284 | firewall_lock_release() { |
| | 285 | if isset IPTABLES_TMPDIR; then |
| | 286 | # Remove all temporary data. |
| | 287 | rm -rf ${IPTABLES_TMPDIR} |
| | 288 | |
| | 289 | # Reset the tempdir variable. |
| | 290 | IPTABLES_TMPDIR= |
| | 291 | fi |
| | 292 | |
| | 293 | # Reset the trap. |
| | 294 | trap true EXIT TERM KILL |
| | 295 | |
| | 296 | lock_release ${RUN_DIR}/.firewall_lock |
| | 297 | } |
| | 298 | |
| | 299 | firewall_custom_chains() { |
| | 300 | local protocol="${1}" |
| | 301 | assert isset protocol |
| | 302 | |
| | 303 | log INFO "Creating CUSTOM* chains..." |
| | 304 | |
| | 305 | # These chains are intened to be filled with |
| | 306 | # rules by the user. They are processed at the very |
| | 307 | # beginning so it is possible to overwrite everything. |
| | 308 | |
| | 309 | iptables_chain_create "${protocol}" CUSTOMINPUT |
| | 310 | iptables "${protocol}" -A INPUT -j CUSTOMINPUT |
| | 311 | |
| | 312 | iptables_chain_create "${protocol}" CUSTOMFORWARD |
| | 313 | iptables "${protocol}" -A FORWARD -j CUSTOMFORWARD |
| | 314 | |
| | 315 | iptables_chain_create "${protocol}" CUSTOMOUTPUT |
| | 316 | iptables "${protocol}" -A OUTPUT -j CUSTOMOUTPUT |
| | 317 | |
| | 318 | iptables_chain_create "${protocol}" -t nat CUSTOMPREROUTING |
| | 319 | iptables "${protocol}" -t nat -A PREROUTING -j CUSTOMPREROUTING |
| | 320 | |
| | 321 | iptables_chain_create "${protocol}" -t nat CUSTOMPOSTROUTING |
| | 322 | iptables "${protocol}" -t nat -A POSTROUTING -j CUSTOMPOSTROUTING |
| | 323 | |
| | 324 | iptables_chain_create "${protocol}" -t nat CUSTOMOUTPUT |
| | 325 | iptables "${protocol}" -t nat -A OUTPUT -j CUSTOMOUTPUT |
| | 326 | } |
| | 327 | |
| | 328 | firewall_filter_invalid_packets() { |
| | 329 | local protocol="${1}" |
| | 330 | assert isset protocol |
| | 331 | |
| | 332 | local log_limit="-m limit --limit 5/m --limit-burst 10" |
| | 333 | |
| | 334 | # Create a chain |
| | 335 | iptables_chain_create "${protocol}" FILTER_INVALID |
| | 336 | iptables "${protocol}" -A INPUT -j FILTER_INVALID |
| | 337 | iptables "${protocol}" -A OUTPUT -j FILTER_INVALID |
| | 338 | iptables "${protocol}" -A FORWARD -j FILTER_INVALID |
| | 339 | |
| | 340 | # Create a chain where only TCP packets go |
| | 341 | iptables_chain_create "${protocol}" FILTER_INVALID_TCP |
| | 342 | iptables "${protocol}" -A FILTER_INVALID -p tcp -j FILTER_INVALID_TCP |
| | 343 | |
| | 344 | # Create a chain where only UDP packets go |
| | 345 | iptables_chain_create "${protocol}" FILTER_INVALID_UDP |
| | 346 | iptables "${protocol}" -A FILTER_INVALID -p udp -j FILTER_INVALID_UDP |
| | 347 | |
| | 348 | # Create a chain where only ICMP packets go |
| | 349 | iptables_chain_create "${protocol}" FILTER_INVALID_ICMP |
| | 350 | iptables "${protocol}" -A FILTER_INVALID -p icmp -j FILTER_INVALID_ICMP |
| | 351 | |
| | 352 | |
| | 353 | # Optionally log all port scans |
| | 354 | |
| | 355 | if enabled FIREWALL_LOG_STEALTH_SCANS; then |
| | 356 | log INFO "Logging of stealth scans enabled" |
| | 357 | |
| | 358 | # NMAP FIN/URG/PSH - XMAS scan |
| | 359 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL FIN,URG,PSH \ |
| | 360 | "${log_limit}" -j "$(iptables_LOG "Stealth XMAS scan")" |
| | 361 | |
| | 362 | # SYN/RST/ACK/FIN/URG |
| | 363 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \ |
| | 364 | "${log_limit}" -j "$(iptables_LOG "Stealth XMAS-PSH scan")" |
| | 365 | |
| | 366 | # ALL/ALL |
| | 367 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL ALL \ |
| | 368 | "${log_limit}" -j "$(iptables_LOG "Stealth XMAS-ALL scan")" |
| | 369 | |
| | 370 | # NMAP FIN Stealth |
| | 371 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL FIN \ |
| | 372 | "${log_limit}" -j "$(iptables_LOG "Stealth FIN scan")" |
| | 373 | |
| | 374 | # SYN/RST |
| | 375 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags SYN,RST SYN,RST \ |
| | 376 | "${log_limit}" -j "$(iptables_LOG "Stealth SYN/RST scan")" |
| | 377 | |
| | 378 | # SYN/FIN |
| | 379 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags SYN,FIN SYN,FIN \ |
| | 380 | "${log_limit}" -j "$(iptables_LOG "Stealth SYN/FIN scan")" |
| | 381 | |
| | 382 | # Null scan |
| | 383 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL NONE \ |
| | 384 | "${log_limit}" -j "$(iptables_LOG "Stealth NULL scan")" |
| | 385 | else |
| | 386 | log INFO "Logging of stealth scans disabled" |
| | 387 | fi |
| | 388 | |
| | 389 | |
| | 390 | # Drop scan packets |
| | 391 | |
| | 392 | # NMAP FIN/URG/PSH |
| | 393 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP |
| | 394 | |
| | 395 | # SYN/RST/ACK/FIN/URG |
| | 396 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP |
| | 397 | |
| | 398 | # ALL/ALL |
| | 399 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL ALL -j DROP |
| | 400 | |
| | 401 | # NMAP FIN Stealth |
| | 402 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL FIN -j DROP |
| | 403 | |
| | 404 | # SYN/RST |
| | 405 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags SYN,RST SYN,RST -j DROP |
| | 406 | |
| | 407 | # SYN/FIN |
| | 408 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP |
| | 409 | |
| | 410 | # Null scan |
| | 411 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-flags ALL NONE -j DROP |
| | 412 | |
| | 413 | |
| | 414 | # Log packets with bad flags |
| | 415 | |
| | 416 | if enabled FIREWALL_LOG_BAD_TCP_FLAGS; then |
| | 417 | log INFO "Logging of packets with bad TCP flags enabled" |
| | 418 | |
| | 419 | # Option 64 |
| | 420 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-option 64 \ |
| | 421 | "${log_limit}" -j "$(iptables_LOG "Bad TCP flag(64)")" |
| | 422 | |
| | 423 | # Option 128 |
| | 424 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-option 128 \ |
| | 425 | "${log_limit}" -j "$(iptables_LOG "Bad TCP flag(128)")" |
| | 426 | else |
| | 427 | log INFO "Logging of packets with bad TCP flags disabled" |
| | 428 | fi |
| | 429 | |
| | 430 | # Drop packets with bad flags |
| | 431 | |
| | 432 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-option 64 -j DROP |
| | 433 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp --tcp-option 128 -j DROP |
| | 434 | |
| | 435 | |
| | 436 | # Log invalid packets |
| | 437 | |
| | 438 | if enabled FIREWALL_LOG_INVALID_TCP; then |
| | 439 | log INFO "Logging of INVALID TCP packets enabled" |
| | 440 | |
| | 441 | iptables "${protocol}" -A FILTER_INVALID_TCP -p tcp -m conntrack --ctstate INVALID \ |
| | 442 | "${log_limit}" -j "$(iptables_LOG "INVALID TCP")" |
| | 443 | else |
| | 444 | log INFO "Logging of INVALID TCP packets disabled" |
| | 445 | fi |
| | 446 | |
| | 447 | if enabled FIREWALL_LOG_INVALID_UDP; then |
| | 448 | log INFO "Logging of INVALID UDP packets enabled" |
| | 449 | |
| | 450 | iptables "${protocol}" -A FILTER_INVALID_UDP -p udp -m conntrack --ctstate INVALID \ |
| | 451 | "${log_limit}" -j "$(iptables_LOG "INVALID UDP")" |
| | 452 | else |
| | 453 | log INFO "Logging of INVALID UDP packets disabled" |
| | 454 | fi |
| | 455 | |
| | 456 | if enabled FIREWALL_LOG_INVALID_ICMP; then |
| | 457 | log INFO "Logging of INVALID ICMP packets enabled" |
| | 458 | |
| | 459 | iptables "${protocol}" -A FILTER_INVALID_ICMP -p icmp -m conntrack --ctstate INVALID \ |
| | 460 | "${log_limit}" -j "$(iptables_LOG "INVALID ICMP")" |
| | 461 | else |
| | 462 | log INFO "Logging of INVALID ICMP packets disabled" |
| | 463 | fi |
| | 464 | |
| | 465 | # Drop all INVALID packets |
| | 466 | iptables "${protocol}" -A FILTER_INVALID -m conntrack --ctstate INVALID -j DROP |
| | 467 | } |
| | 468 | |
| | 469 | firewall_tcp_clamp_mss() { |
| | 470 | # Do nothing if this has been disabled. |
| | 471 | enabled FIREWALL_CLAMP_PATH_MTU || return ${EXIT_OK} |
| | 472 | |
| | 473 | local protocol="${1}" |
| | 474 | assert isset protocol |
| | 475 | |
| | 476 | log DEBUG "Adding rules to clamp MSS to path MTU..." |
| | 477 | |
| | 478 | iptables "${protocol}" -t mangle -A FORWARD \ |
| | 479 | -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu |
| | 480 | } |
| | 481 | |
| | 482 | firewall_connection_tracking() { |
| | 483 | local protocol="${1}" |
| | 484 | assert isset protocol |
| | 485 | |
| | 486 | log INFO "Creating Connection Tracking chain..." |
| | 487 | |
| | 488 | iptables_chain_create "${protocol}" CONNTRACK |
| | 489 | iptables "${protocol}" -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT |
| | 490 | iptables "${protocol}" -A CONNTRACK -m conntrack --ctstate INVALID -j "$(iptables_LOG "INVALID packet: ")" |
| | 491 | iptables "${protocol}" -A CONNTRACK -m conntrack --ctstate INVALID -j DROP |
| | 492 | |
| | 493 | iptables "${protocol}" -A INPUT -j CONNTRACK |
| | 494 | iptables "${protocol}" -A OUTPUT -j CONNTRACK |
| | 495 | iptables "${protocol}" -A FORWARD -j CONNTRACK |
| | 496 | } |
| | 497 | |
| | 498 | firewall_localhost_create_chains() { |
| | 499 | local protocol="${1}" |
| | 500 | assert isset protocol |
| | 501 | |
| | 502 | log DEBUG "Creating firewall chains for localhost..." |
| | 503 | |
| | 504 | # Accept everything on lo |
| | 505 | iptables "${protocol}" -A INPUT -i lo -j ACCEPT |
| | 506 | iptables "${protocol}" -A OUTPUT -o lo -j ACCEPT |
| | 507 | } |
| | 508 | |
| | 509 | firewall_filter_rh0_headers() { |
| | 510 | local protocol="${1}" |
| | 511 | assert isset protocol |
| | 512 | |
| | 513 | # Only IPv6. |
| | 514 | [ "${protocol}" = "ipv6" ] || return ${EXIT_OK} |
| | 515 | |
| | 516 | # Filter all packets that have RH0 headers |
| | 517 | # http://www.ietf.org/rfc/rfc5095.txt |
| | 518 | iptables_chain_create "${protocol}" FILTER_RH0 |
| | 519 | iptables "${protocol}" -A FILTER_RH0 -m rt --rt-type 0 -j DROP |
| | 520 | |
| | 521 | iptables "${protocol}" -A INPUT -j FILTER_RH0 |
| | 522 | iptables "${protocol}" -A FORWARD -j FILTER_RH0 |
| | 523 | iptables "${protocol}" -A OUTPUT -j FILTER_RH0 |
| | 524 | } |
| | 525 | |
| | 526 | firewall_filter_icmp() { |
| | 527 | local protocol="${1}" |
| | 528 | assert isset protocol |
| | 529 | |
| | 530 | # Only IPv6. |
| | 531 | [ "${protocol}" = "ipv6" ] || return ${EXIT_OK} |
| | 532 | |
| | 533 | local chain="FILTER_ICMPV6" |
| | 534 | |
| | 535 | # Create an extra chain for handling ICMP packets. |
| | 536 | iptables_chain_create "${protocol}" "${chain}_COMMON" |
| | 537 | |
| | 538 | local suffix |
| | 539 | for suffix in INC FWD OUT; do |
| | 540 | iptables_chain_create "${protocol}" "${chain}_${suffix}" |
| | 541 | iptables "${protocol}" -A "${chain}_${suffix}" -j "${chain}_COMMON" |
| | 542 | done |
| | 543 | iptables "${protocol}" -A INPUT -p icmpv6 -j "${chain}_INC" |
| | 544 | iptables "${protocol}" -A FORWARD -p icmpv6 -j "${chain}_FWD" |
| | 545 | iptables "${protocol}" -A OUTPUT -p icmpv6 -j "${chain}_OUT" |
| | 546 | |
| | 547 | # Packets that must always pass the firewall. |
| | 548 | # Type 4: Parameter Problem |
| | 549 | local type |
| | 550 | for type in ttl-zero-during-reassembly bad-header; do |
| | 551 | iptables "${protocol}" -A "${chain}_COMMON" \ |
| | 552 | -p icmpv6 --icmpv6-type "${type}" -j ACCEPT |
| | 553 | done |
| | 554 | |
| | 555 | # Packets that are accepted if they belong to an existing connection. |
| | 556 | for type in echo-reply destination-unreachable packet-too-big \ |
| | 557 | unknown-header-type unknown-option; do |
| | 558 | iptables "${protocol}" -A "${chain}_COMMON" \ |
| | 559 | -m conntrack --ctstate ESTABLISHED,RELATED \ |
| | 560 | -p icmpv6 --icmpv6-type "${type}" -j ACCEPT |
| | 561 | done |
| | 562 | |
| | 563 | # Packets that are always discarded. |
| | 564 | # Type 100, 101, 200, 201: Private Experimentation |
| | 565 | for type in 100 101 200 201; do |
| | 566 | iptables "${protocol}" -A "${chain}_COMMON" \ |
| | 567 | -p icmpv6 --icmpv6-type "${type}" -j DROP |
| | 568 | done |
| | 569 | |
| | 570 | # Discard packets from local networks with hop limit smaller than $hoplimit. |
| | 571 | # Type 148: Path solicitation |
| | 572 | # Type 149: Path advertisement |
| | 573 | local hoplimit=255 |
| | 574 | for type in {router,neighbour}-{advertisement,solicitation} 148 149; do |
| | 575 | iptables "${protocol}" -A "${chain}_INC" \ |
| | 576 | -p icmpv6 --icmpv6-type "${type}" \ |
| | 577 | -m hl --hl-lt "${hoplimit}" -j DROP |
| | 578 | done |
| | 579 | |
| | 580 | # The firewall is always allowed to send ICMP echo requests. |
| | 581 | iptables "${protocol}" -A "${chain}_OUT" \ |
| | 582 | -p icmpv6 --icmpv6-type echo-request -j ACCEPT |
| | 583 | |
| | 584 | return ${EXIT_OK} |
| | 585 | } |
| | 586 | |
| | 587 | firewall_zone_create_chains() { |
| | 588 | local protocol="${1}" |
| | 589 | assert isset protocol |
| | 590 | |
| | 591 | local zone="${2}" |
| | 592 | assert isset zone |
| | 593 | |
| | 594 | log DEBUG "Creating firewall chains for zone '${zone}'." |
| | 595 | |
| | 596 | local chain_prefix="ZONE_${zone^^}" |
| | 597 | |
| | 598 | # Create filter chains. |
| | 599 | iptables_chain_create "${protocol}" "${chain_prefix}_INPUT" |
| | 600 | iptables "${protocol}" -A INPUT -i ${zone} -j "${chain_prefix}_INPUT" |
| | 601 | |
| | 602 | iptables_chain_create "${protocol}" "${chain_prefix}_OUTPUT" |
| | 603 | iptables "${protocol}" -A OUTPUT -o ${zone} -j "${chain_prefix}_OUTPUT" |
| | 604 | |
| | 605 | # Custom rules. |
| | 606 | iptables_chain_create "${protocol}" "${chain_prefix}_CUSTOM" |
| | 607 | |
| | 608 | # Intrusion Prevention System. |
| | 609 | iptables_chain_create "${protocol}" "${chain_prefix}_IPS" |
| | 610 | |
| | 611 | # Create a chain for each other zone. |
| | 612 | # This leaves us with n^2 chains. Duh. |
| | 613 | |
| | 614 | local other_zone other_chain_prefix |
| | 615 | for other_zone in $(zones_get_all); do |
| | 616 | other_chain_prefix="${chain_prefix}_${other_zone^^}" |
| | 617 | iptables_chain_create "${protocol}" "${other_chain_prefix}" |
| | 618 | |
| | 619 | # Connect the chain with the FORWARD chain. |
| | 620 | iptables "${protocol}" -A FORWARD -i "${zone}" -o "${other_zone}" \ |
| | 621 | -j "${other_chain_prefix}" |
| | 622 | |
| | 623 | # Handle custom rules. |
| | 624 | iptables "${protocol}" -A "${other_chain_prefix}" -j "${chain_prefix}_CUSTOM" |
| | 625 | |
| | 626 | # Link IPS. |
| | 627 | iptables "${protocol}" -A "${other_chain_prefix}" -j "${chain_prefix}_IPS" |
| | 628 | |
| | 629 | # Rules. |
| | 630 | iptables_chain_create "${protocol}" "${other_chain_prefix}_RULES" |
| | 631 | iptables "${protocol}" -A "${other_chain_prefix}" -j "${other_chain_prefix}_RULES" |
| | 632 | |
| | 633 | # Policy. |
| | 634 | iptables_chain_create "${protocol}" "${other_chain_prefix}_POLICY" |
| | 635 | iptables "${protocol}" -A "${other_chain_prefix}" -j "${other_chain_prefix}_POLICY" |
| | 636 | done |
| | 637 | |
| | 638 | ## Create mangle chain. |
| | 639 | #iptables_chain_create "${protocol}" -t mangle "${chain_prefix}" |
| | 640 | #iptables "${protocol}" -t mangle -A PREROUTING -i "${zone}" -j "${chain_prefix}" |
| | 641 | #iptables "${protocol}" -t mangle -A POSTROUTING -o "${zone}" -j "${chain_prefix}" |
| | 642 | |
| | 643 | ## Quality of Service |
| | 644 | #iptables_chain_create "${protocol}" -t mangle "${chain_prefix}_QOS_INC" |
| | 645 | #iptables "${protocol}" -t mangle -A "${chain_prefix}" -i "${zone}" -j "${chain_prefix}_QOS_INC" |
| | 646 | #iptables_chain_create "${protocol}" -t mangle "${chain_prefix}_QOS_OUT" |
| | 647 | #iptables "${protocol}" -t mangle -A "${chain_prefix}" -o "${zone}" -j "${chain_prefix}_QOS_OUT" |
| | 648 | |
| | 649 | # Create NAT chain. |
| | 650 | iptables_chain_create "${protocol}" -t nat "${chain_prefix}" |
| | 651 | iptables "${protocol}" -t nat -A PREROUTING -i "${zone}" -j "${chain_prefix}" |
| | 652 | iptables "${protocol}" -t nat -A POSTROUTING -o "${zone}" -j "${chain_prefix}" |
| | 653 | |
| | 654 | # Network Address Translation |
| | 655 | iptables_chain_create "${protocol}" -t nat "${chain_prefix}_DNAT" |
| | 656 | iptables "${protocol}" -t nat -A PREROUTING -i "${zone}" -j "${chain_prefix}_DNAT" |
| | 657 | iptables_chain_create "${protocol}" -t nat "${chain_prefix}_SNAT" |
| | 658 | iptables "${protocol}" -t nat -A POSTROUTING -o "${zone}" -j "${chain_prefix}_SNAT" |
| | 659 | |
| | 660 | # UPnP |
| | 661 | iptables_chain_create "${protocol}" -t nat "${chain_prefix}_UPNP" |
| | 662 | iptables "${protocol}" -t nat -A "${chain_prefix}" -j "${chain_prefix}_UPNP" |
| | 663 | |
| | 664 | return ${EXIT_OK} |
| | 665 | } |
| | 666 | |
| | 667 | firewall_parse_rules() { |
| | 668 | local file=${1} |
| | 669 | assert isset file |
| | 670 | shift |
| | 671 | |
| | 672 | # End if no rule file exists. |
| | 673 | [ -r "${file}" ] || return ${EXIT_OK} |
| | 674 | |
| | 675 | local cmd |
| | 676 | |
| | 677 | local ${FIREWALL_RULES_CONFIG_PARAMS} |
| | 678 | local line |
| | 679 | while read -r line; do |
| | 680 | # Skip empty lines. |
| | 681 | [ -n "${line}" ] || continue |
| | 682 | |
| | 683 | # Skip commented lines. |
| | 684 | [ "${line:0:1}" = "#" ] && continue |
| | 685 | |
| | 686 | # Parse the rule. |
| | 687 | _firewall_parse_rule_line ${line} |
| | 688 | if [ $? -ne ${EXIT_OK} ]; then |
| | 689 | log WARNING "Skipping invalid line: ${line}" |
| | 690 | continue |
| | 691 | fi |
| | 692 | |
| | 693 | cmd="iptables $@" |
| | 694 | |
| | 695 | # Source IP address/net. |
| | 696 | if isset src; then |
| | 697 | list_append cmd "-s ${src}" |
| | 698 | fi |
| | 699 | |
| | 700 | # Destination IP address/net. |
| | 701 | if isset dst; then |
| | 702 | list_append cmd "-d ${dst}" |
| | 703 | fi |
| | 704 | |
| | 705 | # Protocol. |
| | 706 | if isset proto; then |
| | 707 | list_append cmd "-p ${proto}" |
| | 708 | |
| | 709 | if list_match ${proto} ${FIREWALL_PROTOCOLS_SUPPORTING_PORTS}; then |
| | 710 | if isset sport; then |
| | 711 | list_append cmd "--sport ${sport}" |
| | 712 | fi |
| | 713 | |
| | 714 | if isset dport; then |
| | 715 | list_append cmd "--dport ${dport}" |
| | 716 | fi |
| | 717 | fi |
| | 718 | fi |
| | 719 | |
| | 720 | # Always append the action. |
| | 721 | list_append cmd "-j ${action}" |
| | 722 | |
| | 723 | # Execute command. |
| | 724 | ${cmd} |
| | 725 | done < ${file} |
| | 726 | } |
| | 727 | |
| | 728 | _firewall_parse_rule_line() { |
| | 729 | local arg |
| | 730 | |
| | 731 | # Clear all values. |
| | 732 | for arg in ${FIREWALL_RULES_CONFIG_PARAMS}; do |
| | 733 | assign "${arg}" "" |
| | 734 | done |
| | 735 | |
| | 736 | local key val |
| | 737 | while read -r arg; do |
| | 738 | key=$(cli_get_key ${arg}) |
| | 739 | |
| | 740 | if ! list_match "${key}" ${FIREWALL_RULES_CONFIG_PARAMS}; then |
| | 741 | log WARNING "Unrecognized argument: ${arg}" |
| | 742 | return ${EXIT_ERROR} |
| | 743 | fi |
| | 744 | |
| | 745 | val=$(cli_get_val "${arg}") |
| | 746 | assign "${key}" "${val}" |
| | 747 | done <<< "$(args "$@")" |
| | 748 | |
| | 749 | # action must always be set. |
| | 750 | if ! isset action; then |
| | 751 | log WARNING "'action' is not set: $@" |
| | 752 | return ${EXIT_ERROR} |
| | 753 | fi |
| | 754 | |
| | 755 | for arg in src dst; do |
| | 756 | isset ${arg} || continue |
| | 757 | |
| | 758 | # Check for valid IP addresses. |
| | 759 | if ! ip_is_valid ${!arg}; then |
| | 760 | log WARNING "Invalid IP address for '${arg}=${!arg}': $@" |
| | 761 | return ${EXIT_ERROR} |
| | 762 | fi |
| | 763 | done |
| | 764 | |
| | 765 | if isset proto; then |
| | 766 | # Make lowercase. |
| | 767 | proto=${proto,,} |
| | 768 | |
| | 769 | if ! list_match "${proto}" ${FIREWALL_SUPPORTED_PROTOCOLS}; then |
| | 770 | log WARNING "Unsupported protocol type 'proto=${proto}': $@" |
| | 771 | return ${EXIT_ERROR} |
| | 772 | fi |
| | 773 | fi |
| | 774 | |
| | 775 | for arg in sport dport; do |
| | 776 | isset ${arg} || continue |
| | 777 | |
| | 778 | # Check if port is valid. |
| | 779 | if ! isinteger ${arg}; then |
| | 780 | log WARNING "Invalid port '${arg}=${!arg}': $@" |
| | 781 | return ${EXIT_ERROR} |
| | 782 | fi |
| | 783 | done |
| | 784 | |
| | 785 | return ${EXIT_OK} |
| | 786 | } |
projects / people / stevee / network.git / blame_incremental