diff options
| author | Silvino Silva <silvino@bk.ru> | 2018-04-11 17:01:15 +0100 |
|---|---|---|
| committer | Silvino Silva <silvino@bk.ru> | 2018-04-11 17:01:15 +0100 |
| commit | 4f0a749494c7d31b8d203490ec008918c8bacc87 (patch) | |
| tree | 6d690512d0724d8b8386d8ae36715d03fd75fe56 /core/conf/rc.d/iptables | |
| parent | 50f9d4a5d286fff80b4df38136c45bde5abcd4c4 (diff) | |
| download | doc-4f0a749494c7d31b8d203490ec008918c8bacc87.tar.gz | |
iptables moved to core
Diffstat (limited to 'core/conf/rc.d/iptables')
| -rw-r--r-- | core/conf/rc.d/iptables | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/core/conf/rc.d/iptables b/core/conf/rc.d/iptables index bb5cf91..dd17b97 100644 --- a/core/conf/rc.d/iptables +++ b/core/conf/rc.d/iptables @@ -3,8 +3,7 @@ # /etc/rc.d/iptables: load/unload iptable rules # -rules=rules.v4 -#rules=vlan.v4 +rules=/etc/iptables/net.v4 iptables_clear () { echo "clear all iptables tables" @@ -22,9 +21,8 @@ iptables_clear () { case $1 in start) - iptables_clear echo "starting IPv4 firewall filter table..." - /usr/sbin/iptables-restore < /etc/iptables/${rules} + /usr/sbin/iptables-restore ${rules} ;; stop) iptables_clear @@ -51,6 +49,12 @@ case $1 in /usr/sbin/iptables -P FORWARD DROP /usr/sbin/iptables -P OUTPUT ACCEPT + /usr/sbin/iptables -t mangle -P PREROUTING ACCEPT + /usr/sbin/iptables -t mangle -P INPUT ACCEPT + /usr/sbin/iptables -t mangle -P FORWARD ACCEPT + /usr/sbin/iptables -t mangle -P OUTPUT ACCEPT + /usr/sbin/iptables -t mangle -P POSTROUTING ACCEPT + /usr/sbin/iptables -A OUTPUT -j ACCEPT # Unlimited on local @@ -58,8 +62,9 @@ case $1 in /usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT # Accept passive - /usr/sbin/iptables -A INPUT -p tcp --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT - /usr/sbin/iptables -A INPUT -p udp --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT + /usr/sbin/iptables -A INPUT -p tcp --dport 1024: -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT + /usr/sbin/iptables -A INPUT -p tcp --dport 1024: -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT + /usr/sbin/iptables -A INPUT -p udp --dport 1024: -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT # log everything else and drop /usr/sbin/iptables -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " |