From 97fe1741a3fc54a52338f8a2254a95992d61ab4b Mon Sep 17 00:00:00 2001 From: maniacikarus Date: Sun, 30 Dec 2007 11:02:40 +0000 Subject: [PATCH] Some smaller enhancements for the firewall script git-svn-id: http://svn.ipfire.org/svn/ipfire/branches/2.1/trunk@1135 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8 --- config/rootfiles/core/4/files | 1 + html/cgi-bin/logs.cgi/log.dat | 4 ++-- src/initscripts/init.d/firewall | 27 +++++++++++++++------------ src/scripts/makegraphs | 2 +- 4 files changed, 19 insertions(+), 15 deletions(-) diff --git a/config/rootfiles/core/4/files b/config/rootfiles/core/4/files index c4f79caf42..47703c9598 100644 --- a/config/rootfiles/core/4/files +++ b/config/rootfiles/core/4/files @@ -1,4 +1,5 @@ etc/inid.d/firewall +usr/local/bin/makegraphs var/ipfire/langs var/ipfire/optionsfw/settings var/ipfire/menu.d/50-firewall.menu diff --git a/html/cgi-bin/logs.cgi/log.dat b/html/cgi-bin/logs.cgi/log.dat index 3c408a78fa..f443a05764 100644 --- a/html/cgi-bin/logs.cgi/log.dat +++ b/html/cgi-bin/logs.cgi/log.dat @@ -50,7 +50,7 @@ my $year = $now[5]+1900; $cgiparams{'DAY'} = $now[3]; $cgiparams{'MONTH'} = $now[4]; $cgiparams{'ACTION'} = ''; -$cgiparams{'SECTION'} = 'kernel'; +$cgiparams{'SECTION'} = 'ipfire'; my %sections = ( 'ipfire' => '(ipfire: )', @@ -61,7 +61,7 @@ my %sections = ( 'ntp' => '(ntpd(?:ate)?\[.*\]: )', 'ssh' => '(sshd(?:\(.*\))?\[.*\]: )', 'auth' => '(\w+\(pam_unix\)\[.*\]: )', - 'kernel' => '(kernel: (?!DROP-))', + 'kernel' => '(kernel: (?!DROP_))', 'ipsec' => '(ipsec_[\w_]+: |pluto\[.*\]: |vpnwatch: )', 'openvpn' => '(openvpnserver)\[.*\]: ' ); diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index a5ffdc03e7..d7b0ea6d83 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -2,7 +2,6 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) -eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -f /var/ipfire/red/device ]; then @@ -35,20 +34,20 @@ iptables_init() { # of flags might indicate a port-scan attempt (xmas, null, etc) /sbin/iptables -N PSCAN if [ "$DROPPORTSCAN" == "on" ]; then - /sbin/iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "DROP-TCP Scan " -m comment --comment "DROP-TCP PScan" - /sbin/iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "DROP-UDP Scan " -m comment --comment "DROP-UPD PScan" - /sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP-ICMP Scan " -m comment --comment "DROP-ICMP PScan" - /sbin/iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "DROP-FRAG Scan " -m comment --comment "DROP-FRAG PScan" + /sbin/iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan" + /sbin/iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UPD PScan" + /sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan" + /sbin/iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan" fi - /sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP PScan" + /sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan" # New tcp packets without SYN set - could well be an obscure type of port scan # that's not covered above, may just be a broken windows machine /sbin/iptables -N NEWNOTSYN if [ "$DROPNEWNOTSYN" == "on" ]; then - /sbin/iptables -A NEWNOTSYN -m limit --limit 10/minute -j LOG --log-prefix "DROP-NEW not SYN " -m comment --comment "DROP-NEW not SYN" + /sbin/iptables -A NEWNOTSYN -m limit --limit 10/minute -j LOG --log-prefix "DROP_NEWNOTSYN " fi - /sbin/iptables -A NEWNOTSYN -j DROP + /sbin/iptables -A NEWNOTSYN -j DROP -m comment --comment "DROP_NEWNOTSYN" # Chain to contain all the rules relating to bad TCP flags /sbin/iptables -N BADTCP @@ -262,11 +261,13 @@ case "$1" in # last rule in input and forward chain is for logging. if [ "$DROPINPUT" == "on" ]; then - /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP-INPUT " -m comment --comment "DROP-INPUT" + /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT " fi + /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT" if [ "$DROPOUTPUT" == "on" ]; then - /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP-OUTPUT " -m comment --comment "DROP-OUTPUT" + /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT " fi + /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT" ;; startovpn) # run openvpn @@ -296,11 +297,13 @@ case "$1" in fi if [ "$DROPINPUT" == "on" ]; then - /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP-INPUT " -m comment --comment "DROP-INPUT" + /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT " fi + /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT" if [ "$DROPOUTPUT" == "on" ]; then - /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP-OUTPUT " -m comment --comment "DROP-OUTPUT" + /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT " fi + /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT" ;; stopovpn) # stop openvpn diff --git a/src/scripts/makegraphs b/src/scripts/makegraphs index 9cce21a931..53daccc888 100644 --- a/src/scripts/makegraphs +++ b/src/scripts/makegraphs @@ -277,7 +277,7 @@ sub updatefwhitsdata { $aktuell = 0; if (!$skip) { while () { - if (/kernel:.*(IN=.*)$/) {$aktuell++;} + if (/kernel: DROP_INPUT.*$/) {$aktuell++;} } close (FILE); } -- 2.39.2