diff options
Diffstat (limited to 'tools/conf/etc/iptables/iptables-br.sh')
| -rw-r--r-- | tools/conf/etc/iptables/iptables-br.sh | 95 |
1 files changed, 48 insertions, 47 deletions
diff --git a/tools/conf/etc/iptables/iptables-br.sh b/tools/conf/etc/iptables/iptables-br.sh index 25a3331..96475f4 100644 --- a/tools/conf/etc/iptables/iptables-br.sh +++ b/tools/conf/etc/iptables/iptables-br.sh @@ -148,7 +148,8 @@ SPAMLIST="blockedip" SPAMDROPMSG="BLOCKED IP DROP" # public interface to network/internet #PUB_IF="wlp7s0" -PUB_IF="br0" +PUB_IF="enp8s0" +BR_IF="br0" PUB_IP="10.0.0.254" NET_ADDR="10.0.0.0/8" GW="10.0.0.1" @@ -186,6 +187,8 @@ echo "Starting ipv4 firewall tables..." # Unlimited on loopback $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +$IPT -A INPUT -i lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT +$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT #modprobe ip_conntrack #modprobe ip_conntrack_ftp @@ -222,15 +225,21 @@ $IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP $IPT -A blocker -j RETURN ####### server input Chain ###### +echo "server_in chain: Allow to VNC Server" +$IPT -A server_in -p tcp --dport 5900 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow to DataBase Server" +$IPT -A server_in -p tcp --dport 5432 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT echo "server_in chain: Allow to SSH server" $IPT -A server_in -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT echo "server_in chain: Allow input to HTTPS Server" $IPT -A server_in -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -#echo "server_in chain: Allow input to HTTP Server" -#$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow input to HTTP Server" +$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT echo "server_in chain: Allow input to DNS Server" $IPT -A server_in -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A server_in -p tcp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow output from GIT server" +$IPT -A server_in -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT ## Return to caller $IPT -A server_in -j RETURN @@ -239,12 +248,18 @@ $IPT -A server_in -j RETURN echo "server_out chain: Allow output from DNS server" $IPT -A server_out -p udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT $IPT -A server_out -p tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from GIT server" +$IPT -A server_out -p tcp --sport 9418 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT echo "server_out chain: Allow output from https server" $IPT -A server_out -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT -#echo "server_out chain: Allow output from http server" -#$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from http server" +$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT echo "server_out chain: Allow output from SSH server" $IPT -A server_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from Data Base server" +$IPT -A server_out -p tcp --sport 5432 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "FORWARD chain: Allow output from VNC server" +$IPT -A server_out -p tcp --sport 5900 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT ## Return to caller $IPT -A server_out -j RETURN @@ -260,16 +275,18 @@ echo "client_in chain: Allow input from POP3S server" $IPT -A client_in -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT echo "client_in chain: Allow input from SMTPS server" $IPT -A client_in -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -#echo "client_in chain: Allow input from HTTP Server" -#$IPT -A client_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from HTTP Server" +$IPT -A client_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT echo "client_in chain: Allow input from HTTPS server" $IPT -A client_in -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT #$IPT -A client_in -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT echo "client_in chain: Allow input from DNS Server" $IPT -A client_in -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT echo "client_in chain: Allow input from SSH Server" -$IPT -A client_in -p udp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT -$IPT -A client_in -p udp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A client_in -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A client_in -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from GPG key Server" +$IPT -A client_in -p tcp --sport 11371 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT ## Return to caller $IPT -A client_in -j RETURN @@ -287,14 +304,17 @@ echo "client_out chain: Allow output to SMTPS server" $IPT -A client_out -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT echo "client_out chain: Allow output to HTTPS server" $IPT -A client_out -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -#$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT -##echo "Allow to HTTP server" -#$IPT -A client_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "Allow to HTTP server" +$IPT -A client_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT echo "client_out chain: Allow output to DNS server" $IPT -A client_out -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT echo "client_out chain: Allow output to SSH server" -$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A client_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to GPG key Server" +$IPT -A client_out -p tcp --dport 11371 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + ## Return to caller $IPT -A client_out -j RETURN @@ -331,24 +351,27 @@ $IPT -A netconf_out -j RETURN ####### AP rules ###### $IPT -A FORWARD -j blocker -#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT -$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_in -$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_out -$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j client_in -$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -j client_out -#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d ${NET_ADDR} -j netconf_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d ${NET_ADDR} -j netconf_out +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d ${NET_ADDR} -j client_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${NET_ADDR} -j client_out +#$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -d ${NET_ADDR} -j server_in +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${NET_ADDR} -j server_out + +#$IPT -t nat -A POSTROUTING -o ${BR_IF} -j SNAT --to ${PUB_IP} ####### Input Chain ###### $IPT -A INPUT -j blocker -$IPT -A INPUT -i ${PUB_IF} -j server_in -$IPT -A INPUT -i ${PUB_IF} -j client_in -$IPT -A INPUT -i ${PUB_IF} -j netconf_in +$IPT -A INPUT -i ${BR_IF} -s ${NET_ADDR} -d ${PUB_IP} -j server_in +$IPT -A INPUT -i ${BR_IF} -d ${NET_ADDR} -j client_in +$IPT -A INPUT -i ${BR_IF} -j netconf_in ####### Output Chain ###### $IPT -A OUTPUT -j blocker -$IPT -A OUTPUT -o ${PUB_IF} -j server_out -$IPT -A OUTPUT -o ${PUB_IF} -j client_out -$IPT -A OUTPUT -o ${PUB_IF} -j netconf_out +$IPT -A OUTPUT -o ${BR_IF} -s ${PUB_IP} -d ${NET_ADDR} -j server_out +$IPT -A OUTPUT -o ${BR_IF} -s ${NET_ADDR} -j client_out +$IPT -A OUTPUT -o ${BR_IF} -j netconf_out ## log everything else and drop @@ -357,25 +380,3 @@ $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " exit 0 - -#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -s ${NET_ADDR} -j ACCEPT -#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -d ${NET_ADDR} -j ACCEPT -#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 68 --dport 67 -j ACCEPT -#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 520 --dport 520 -j ACCEPT -# -## You Dirty bitch -#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT - -## Unlimited on loopback -#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT -##$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT -# -## Unlimited on local -#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT -# -### less logs -# - -#echo "Allow output DHCP protocol" -#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT - |