diff options
Diffstat (limited to 'core/conf/iptables/ipt-client.sh')
| -rw-r--r-- | core/conf/iptables/ipt-client.sh | 48 |
1 files changed, 21 insertions, 27 deletions
diff --git a/core/conf/iptables/ipt-client.sh b/core/conf/iptables/ipt-client.sh index 77de218..f832c51 100644 --- a/core/conf/iptables/ipt-client.sh +++ b/core/conf/iptables/ipt-client.sh @@ -1,14 +1,25 @@ #!/bin/bash -echo "setting client network..." -source ipt-conf.sh -source ipt-firewall.sh -ipt_clear -ipt_tables +echo "setting dhcp network..." + +if [ "${GW}" == "" ]; then + + $IPT -A INPUT -j srv_icmp + $IPT -A OUTPUT -j srv_icmp + $IPT -A INPUT -j srv_dhcp + $IPT -A OUTPUT -j srv_dhcp -# Unlimited on loopback -$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT -$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + echo "no gateway, wating for one..." + + while [ "${GW}" == "" ] + do + #we wait for a connection + sleep 2; + GW=$(ip route | grep "default via" | cut -d " " -f 3) + done +fi + +echo "setting client network..." ####### Input Chain ###### $IPT -A INPUT -j blocker @@ -19,21 +30,13 @@ $IPT -A INPUT -i ${PUB_IF} -j cli_https_in $IPT -A INPUT -i ${PUB_IF} -j cli_git_in $IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in $IPT -A INPUT -i ${PUB_IF} -j srv_icmp -$IPT -A INPUT -i ${PUB_IF} -j srv_ntp $IPT -A INPUT -i ${PUB_IF} -j cli_pops_in $IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in $IPT -A INPUT -i ${PUB_IF} -j cli_irc_in $IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in $IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in -$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j DROP - -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT +$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT -# allow all established and related -$IPT -A INPUT -p tcp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p udp --dport 1024:65535 --sport 1:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT -$IPT -A INPUT -p icmp -j ACCEPT ####### Output Chain ###### $IPT -A OUTPUT -j blocker @@ -44,21 +47,12 @@ $IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out $IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp -$IPT -A OUTPUT -o ${PUB_IF} -j srv_ntp $IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out $IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out - -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1024:65535 -j ACCEPT - -# allow all out (make nmap and others happy) -$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1:65535 -j ACCEPT -$IPT -A OUTPUT -p icmp -j ACCEPT +$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:655335 --dport 1024:65535 -j ACCEPT ## log everything else and drop ipt_log -iptables-save > /etc/iptables/client.v4 |