From f905c797c8f2ec87a8aa641a44c49fc1d0a23ebe Mon Sep 17 00:00:00 2001 From: Silvino Date: Sat, 8 Jun 2019 01:49:10 +0100 Subject: core network better iptables documentation --- core/conf/iptables/ipt-open.sh | 47 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 core/conf/iptables/ipt-open.sh (limited to 'core/conf/iptables/ipt-open.sh') diff --git a/core/conf/iptables/ipt-open.sh b/core/conf/iptables/ipt-open.sh new file mode 100644 index 0000000..3ef1254 --- /dev/null +++ b/core/conf/iptables/ipt-open.sh @@ -0,0 +1,47 @@ +#!/bin/bash + +echo "setting client network..." +source ipt-conf.sh +source ipt-firewall.sh +ipt_clear +ipt_tables + +# Unlimited on loopback +$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT + +####### Input Chain ###### +$IPT -A INPUT -j blocker + +$IPT -A INPUT -i ${PUB_IF} -j cli_dns_in +$IPT -A INPUT -i ${PUB_IF} -j cli_http_in +$IPT -A INPUT -i ${PUB_IF} -j cli_https_in +$IPT -A INPUT -i ${PUB_IF} -j cli_git_in +$IPT -A INPUT -i ${PUB_IF} -j cli_ssh_in +$IPT -A INPUT -i ${PUB_IF} -j srv_icmp +$IPT -A INPUT -i ${PUB_IF} -j cli_pops_in +$IPT -A INPUT -i ${PUB_IF} -j cli_smtps_in +$IPT -A INPUT -i ${PUB_IF} -j cli_irc_in +$IPT -A INPUT -i ${PUB_IF} -j cli_ftp_in +$IPT -A INPUT -i ${PUB_IF} -j cli_gpg_in + + +####### Output Chain ###### +$IPT -A OUTPUT -j blocker + +$IPT -A OUTPUT -o ${PUB_IF} -j cli_dns_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_https_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_ssh_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_git_out +$IPT -A OUTPUT -o ${PUB_IF} -j srv_icmp +$IPT -A OUTPUT -o ${PUB_IF} -j cli_pops_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_smtps_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_irc_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_ftp_out +$IPT -A OUTPUT -o ${PUB_IF} -j cli_gpg_out + +## log everything else and drop +ipt_log + +iptables-save > open.v4 -- cgit 1.4.1-2-gfad0