config/firewall/ipsec-block

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2015 IPFire Team                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 VPN_CONFIG="/var/ipfire/vpn/config"
  23
  24 block_subnet() {
  25         local subnet="${1}"
  26         local action="${2}"
  27
  28         # Don't block a wildcard subnet
  29         if [ "${subnet}" = "0.0.0.0/0" ] || [ "${subnet}" = "0.0.0.0/0.0.0.0" ]; then
  30                 return 0
  31         fi
  32
  33         case "${action}" in
  34                 reject)
  35                         iptables -A IPSECBLOCK -d "${subnet}" -j REJECT --reject-with icmp-net-unreachable
  36                         ;;
  37                 drop)
  38                         iptables -A IPSECBLOCK -d "${subnet}" -j DROP
  39                         ;;
  40                 *)
  41                         return 1
  42                         ;;
  43         esac
  44
  45         return 0
  46 }
  47
  48 block_ipsec() {
  49         # Flush all exists rules
  50         iptables -F IPSECBLOCK
  51
  52         local action
  53
  54         local vars="id status name lefthost type ctype x1 x2 x3 leftsubnets"
  55         vars="${vars} x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12"
  56         vars="${vars} x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24"
  57         vars="${vars} route rest"
  58
  59         # Register local variables
  60         local ${vars}
  61
  62         while IFS="," read -r ${vars}; do
  63                 # Check if the connection is enabled
  64                 [ "${status}" = "on" ] || continue
  65
  66                 # Check if this a net-to-net connection
  67                 [ "${type}" = "net" ] || continue
  68
  69                 # Split multiple subnets
  70                 rightsubnets="${rightsubnets//\|/ }"
  71
  72                 case "${route}" in
  73                         route)
  74                                 action="drop"
  75                                 ;;
  76                         *)
  77                                 action="reject"
  78                                 ;;
  79                 esac
  80
  81                 local rightsubnet
  82                 for rightsubnet in ${rightsubnets}; do
  83                         block_subnet "${rightsubnet}" "${action}"
  84                 done
  85         done < "${VPN_CONFIG}"
  86 }
  87
  88 block_ipsec || exit $?