X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=src%2Finitscripts%2Finit.d%2Ffirewall;h=cc6b6190eb8ecb7c376934b1aa74968915c46c6c;hp=f32f7a7e84d57333476b84f88c3f785e349cd6e5;hb=31901da1edb401590960558b61e31ddd9fda89c1;hpb=4cb74dce6f60712a7f85ad9ca0484e0258322fa8 diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index f32f7a7e8..cc6b6190e 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -2,6 +2,7 @@ eval $(/usr/local/bin/readhash /var/ipfire/ppp/settings) eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings) +eval $(/usr/local/bin/readhash /var/ipfire/optionsfw/settings) IFACE=`/bin/cat /var/ipfire/red/iface 2> /dev/null | /usr/bin/tr -d '\012'` if [ -f /var/ipfire/red/device ]; then @@ -33,21 +34,28 @@ iptables_init() { # This chain will log, then DROPs packets with certain bad combinations # of flags might indicate a port-scan attempt (xmas, null, etc) /sbin/iptables -N PSCAN - /sbin/iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "TCP Scan? " - /sbin/iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "UDP Scan? " - /sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "ICMP Scan? " - /sbin/iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "FRAG Scan? " - /sbin/iptables -A PSCAN -j DROP + if [ "$DROPPORTSCAN" == "on" ]; then + /sbin/iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "DROP_TCP Scan " -m comment --comment "DROP_TCP PScan" + /sbin/iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "DROP_UDP Scan " -m comment --comment "DROP_UDP PScan" + /sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "DROP_ICMP Scan " -m comment --comment "DROP_ICMP PScan" + /sbin/iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "DROP_FRAG Scan " -m comment --comment "DROP_FRAG PScan" + fi + /sbin/iptables -A PSCAN -j DROP -m comment --comment "DROP_PScan" # New tcp packets without SYN set - could well be an obscure type of port scan # that's not covered above, may just be a broken windows machine /sbin/iptables -N NEWNOTSYN - /sbin/iptables -A NEWNOTSYN -m limit --limit 10/minute -j LOG --log-prefix "NEW not SYN? " - /sbin/iptables -A NEWNOTSYN -j DROP + if [ "$DROPNEWNOTSYN" == "on" ]; then + /sbin/iptables -A NEWNOTSYN -m limit --limit 10/minute -j LOG --log-prefix "DROP_NEWNOTSYN " + fi + /sbin/iptables -A NEWNOTSYN -j DROP -m comment --comment "DROP_NEWNOTSYN" # Chain to contain all the rules relating to bad TCP flags /sbin/iptables -N BADTCP + #Don't check loopback + /sbin/iptables -A BADTCP -i lo -j RETURN + # Disallow packets frequently used by port-scanners # nmap xmas /sbin/iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN @@ -96,8 +104,7 @@ iptables_red() { # This rule enables a host on ORANGE network to connect to the outside # (only if we have a red connection) if [ "$IFACE" != "" ]; then - /sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p tcp -o $IFACE -j ACCEPT - /sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p udp -o $IFACE -j ACCEPT + /sbin/iptables -A REDFORWARD -i $ORANGE_DEV -o $IFACE -j ACCEPT fi fi @@ -112,7 +119,8 @@ iptables_red() { /sbin/iptables -A REDINPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT fi - # Outgoing masquerading + # Outgoing masquerading (don't masqerade IPSEC (mark 50)) + /sbin/iptables -t nat -A REDNAT -m mark --mark 50 -o $IFACE -j RETURN /sbin/iptables -t nat -A REDNAT -o $IFACE -j MASQUERADE fi @@ -127,7 +135,7 @@ case "$1" in # original do nothing line #/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec # the correct one, but the negative '!' do nothing... - #/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit ! --limit 10/sec -j DROP + #/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN ! -m limit --limit 10/sec -j DROP # Fix for braindead ISP's /sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu @@ -135,44 +143,60 @@ case "$1" in # CUSTOM chains, can be used by the users themselves /sbin/iptables -N CUSTOMINPUT /sbin/iptables -A INPUT -j CUSTOMINPUT + /sbin/iptables -N GUARDIAN + /sbin/iptables -A INPUT -j GUARDIAN + /sbin/iptables -A FORWARD -j GUARDIAN /sbin/iptables -N CUSTOMFORWARD /sbin/iptables -A FORWARD -j CUSTOMFORWARD /sbin/iptables -N CUSTOMOUTPUT /sbin/iptables -A OUTPUT -j CUSTOMOUTPUT /sbin/iptables -N OUTGOINGFW + /sbin/iptables -N OUTGOINGFWMAC /sbin/iptables -A OUTPUT -j OUTGOINGFW /sbin/iptables -t nat -N CUSTOMPREROUTING /sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING /sbin/iptables -t nat -N CUSTOMPOSTROUTING /sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING + # IPTV chains for IGMPPROXY + /sbin/iptables -N IPTVINPUT + /sbin/iptables -A INPUT -j IPTVINPUT + /sbin/iptables -N IPTVFORWARD + /sbin/iptables -A FORWARD -j IPTVFORWARD + # filtering from GUI /sbin/iptables -N GUIINPUT /sbin/iptables -A INPUT -j GUIINPUT + /sbin/iptables -A GUIINPUT -p icmp --icmp-type 8 -j ACCEPT # Accept everything connected /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT /sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything - /sbin/iptables -N IPSECVIRTUAL + /sbin/iptables -N IPSECINPUT + /sbin/iptables -N IPSECFORWARD + /sbin/iptables -N IPSECOUTPUT /sbin/iptables -N OPENSSLVIRTUAL - /sbin/iptables -A INPUT -j IPSECVIRTUAL - /sbin/iptables -A INPUT -j OPENSSLVIRTUAL - /sbin/iptables -A FORWARD -j IPSECVIRTUAL - /sbin/iptables -A FORWARD -j OPENSSLVIRTUAL - + /sbin/iptables -A INPUT -j IPSECINPUT + /sbin/iptables -A INPUT -j OPENSSLVIRTUAL -m comment --comment "OPENSSLVIRTUAL INPUT" + /sbin/iptables -A FORWARD -j IPSECFORWARD + /sbin/iptables -A FORWARD -j OPENSSLVIRTUAL -m comment --comment "OPENSSLVIRTUAL FORWARD" + /sbin/iptables -A OUTPUT -j IPSECOUTPUT + /sbin/iptables -t nat -N IPSECNAT + /sbin/iptables -t nat -A POSTROUTING -j IPSECNAT + # Outgoing Firewall - /sbin/iptables -A FORWARD -j OUTGOINGFW + /sbin/iptables -A FORWARD -j OUTGOINGFWMAC # localhost and ethernet. - /sbin/iptables -A INPUT -i lo -m state --state NEW -j ACCEPT + /sbin/iptables -A INPUT -i lo -m state --state NEW -j ACCEPT /sbin/iptables -A INPUT -s 127.0.0.0/8 -m state --state NEW -j DROP # Loopback not on lo /sbin/iptables -A INPUT -d 127.0.0.0/8 -m state --state NEW -j DROP - /sbin/iptables -A FORWARD -i lo -m state --state NEW -j ACCEPT + /sbin/iptables -A FORWARD -i lo -m state --state NEW -j ACCEPT /sbin/iptables -A FORWARD -s 127.0.0.0/8 -m state --state NEW -j DROP /sbin/iptables -A FORWARD -d 127.0.0.0/8 -m state --state NEW -j DROP - /sbin/iptables -A INPUT -i $GREEN_DEV -m state --state NEW -j ACCEPT -p ! icmp + /sbin/iptables -A INPUT -i $GREEN_DEV -m state --state NEW -j ACCEPT ! -p icmp /sbin/iptables -A FORWARD -i $GREEN_DEV -m state --state NEW -j ACCEPT # If a host on orange tries to initiate a connection to IPFire's red IP and @@ -184,10 +208,6 @@ case "$1" in /sbin/iptables -N DHCPBLUEINPUT /sbin/iptables -A INPUT -j DHCPBLUEINPUT - # IPSec - /sbin/iptables -N IPSECPHYSICAL - /sbin/iptables -A INPUT -j IPSECPHYSICAL - # OPenSSL /sbin/iptables -N OPENSSLPHYSICAL /sbin/iptables -A INPUT -j OPENSSLPHYSICAL @@ -232,7 +252,9 @@ case "$1" in # upnp chain for our upnp daemon /sbin/iptables -t nat -N UPNPFW /sbin/iptables -t nat -A PREROUTING -j UPNPFW - + /sbin/iptables -A FORWARD -m state --state NEW -j UPNPFW + # This chain only contains dummy rules. + /sbin/iptables -N UPNPFW # Custom mangle chain (for port fowarding) /sbin/iptables -t mangle -N PORTFWMANGLE @@ -248,17 +270,25 @@ case "$1" in /sbin/iptables -t nat -A POSTROUTING -m mark --mark 3 -j SNAT --to-source $ORANGE_ADDRESS fi - # run openvpn - /usr/local/bin/openvpnctrl --create-chains-and-rules - # run local firewall configuration, if present if [ -x /etc/sysconfig/firewall.local ]; then /etc/sysconfig/firewall.local start fi # last rule in input and forward chain is for logging. - /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "INPUT " - /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT " + + if [ "$DROPINPUT" == "on" ]; then + /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT " + fi + /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT" + if [ "$DROPOUTPUT" == "on" ]; then + /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT " + fi + /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT" + ;; + startovpn) + # run openvpn + /usr/local/bin/openvpnctrl --create-chains-and-rules ;; stop) iptables_init @@ -278,16 +308,23 @@ case "$1" in /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT fi - # stop openvpn - /usr/local/bin/openvpnctrl --delete-chains-and-rules - # run local firewall configuration, if present if [ -x /etc/sysconfig/firewall.local ]; then /etc/sysconfig/firewall.local stop fi - /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "INPUT " - /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT " + if [ "$DROPINPUT" == "on" ]; then + /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "DROP_INPUT " + fi + /sbin/iptables -A INPUT -j DROP -m comment --comment "DROP_INPUT" + if [ "$DROPOUTPUT" == "on" ]; then + /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "DROP_OUTPUT " + fi + /sbin/iptables -A FORWARD -j DROP -m comment --comment "DROP_OUTPUT" + ;; + stopovpn) + # stop openvpn + /usr/local/bin/openvpnctrl --delete-chains-and-rules ;; reload) iptables_red @@ -299,7 +336,9 @@ case "$1" in ;; restart) $0 stop + $0 stopovpn $0 start + $0 startovpn ;; *) echo "Usage: $0 {start|stop|reload|restart}"