diff options
author | punk <punk@libernaut> | 2021-04-21 15:26:19 +0100 |
---|---|---|
committer | punk <punk@libernaut> | 2021-04-21 15:26:19 +0100 |
commit | eac48b5a8d709135a95abcc2243b369095f074f4 (patch) | |
tree | a2e34d995cef5ac8068ec7047e93b1125c80d175 /linux/conf/iptables/ipt-client.sh | |
parent | 3bd43803fc8cb7a39a87394cb7c491ddc151e06b (diff) | |
parent | 452477a2635d85ecf772a5242ce97d9479503bb3 (diff) | |
download | doc-eac48b5a8d709135a95abcc2243b369095f074f4.tar.gz |
release 0.7.0
Diffstat (limited to 'linux/conf/iptables/ipt-client.sh')
-rw-r--r-- | linux/conf/iptables/ipt-client.sh | 60 |
1 files changed, 60 insertions, 0 deletions
diff --git a/linux/conf/iptables/ipt-client.sh b/linux/conf/iptables/ipt-client.sh new file mode 100644 index 0000000..3e82bf7 --- /dev/null +++ b/linux/conf/iptables/ipt-client.sh @@ -0,0 +1,60 @@ +#!/bin/bash + +echo "setting dhcp network..." + +if [ "${GW}" == "" ]; then + + $IPT -A INPUT -j srv_icmp + $IPT -A OUTPUT -j srv_icmp + $IPT -A INPUT -j srv_dhcp + $IPT -A OUTPUT -j srv_dhcp + + echo "no gateway, wating for one..." + + while [ "${GW}" == "" ] + do + #we wait for a connection + sleep 2; + GW=$(ip route | grep "default via" | cut -d " " -f 3) + done +fi + +echo "setting client network..." + +####### Input Chain ###### +$IPT -A INPUT -j blocker +$IPT -A INPUT -j blockip_in + +$IPT -A INPUT -i ${PUB_IF} -j cli_dns_in +$IPT -A INPUT -i ${PUB_IF} -j cli_http_in +$IPT -A INPUT -i ${PUB_IF} -j cli_https_in +$IPT -A INPUT -i ${PUB_IF} -j cli_git_in +$IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in +$IPT -A INPUT -i ${PUB_IF} -j srv_icmp +$IPT -A INPUT -i ${PUB_IF} -j cli_pops_in +$IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in +$IPT -A INPUT -i ${PUB_IF} -j cli_irc_in +$IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in +$IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT + + +####### Output Chain ###### +$IPT -A OUTPUT -j blocker +$IPT -A OUTPUT -j blockip_out + +$IPT -A OUTPUT -o ${PUB_IF} -j cli_dns_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_https_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out +$IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp +$IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:655335 --dport 1024:65535 -j ACCEPT + +## log everything else and drop +ipt_log |