Mercurial > mbse-firewall / file comparison
comparison: sbin/mbse-firewall
sbin/mbse-firewall
- changeset 0
- d4d23e51be4f
- child 2
- 7c794ae9f4de
equal
deleted
inserted
replaced
| -1:000000000000 | 0:d4d23e51be4f |
|---|---|
| 1 #!/bin/bash | |
| 2 | |
| 3 # --------------------------------------------------------------------------- | |
| 4 # Copyright (C) 2013-2014 by Michiel Broek. | |
| 5 # Homepage http://www.mbse.eu | |
| 6 # Email mbse At mbse dOt eu | |
| 7 # | |
| 8 # This file is part of mbse-firewall. | |
| 9 # | |
| 10 # This program is free software; you can redistribute it and/or modify it | |
| 11 # under the terms of the GNU General Public License as published by the | |
| 12 # Free Software Foundation; either version 2, or (at your option) any | |
| 13 # later version. | |
| 14 # | |
| 15 # This program is distributed in the hope that it will be useful, but | |
| 16 # WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
| 18 # General Public License for more details. | |
| 19 # | |
| 20 # You should have received a copy of the GNU General Public License | |
| 21 # along with this program; see the file COPYING. If not, write to the Free | |
| 22 # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. | |
| 23 # --------------------------------------------------------------------------- | |
| 24 | |
| 25 MBSEFW_VERSION="0.0.12" | |
| 26 | |
| 27 # Sanity checks | |
| 28 if [ "$(id -u)" != "0" ]; then | |
| 29 echo "** You must be root to run this program" | |
| 30 exit 1 | |
| 31 fi | |
| 32 | |
| 33 # If possible, log events in /var/log/messages: | |
| 34 if [ -f /var/run/syslogd.pid -a -x /usr/bin/logger ]; then | |
| 35 LOGGER=/usr/bin/logger | |
| 36 else # output to stdout/stderr: | |
| 37 LOGGER=/bin/cat | |
| 38 fi | |
| 39 | |
| 40 | |
| 41 # IPv6 enabled? | |
| 42 USE_IPV6="0" | |
| 43 if [ -f /proc/sys/net/ipv6/conf/all/disable_ipv6 ] && [ "$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6)" == "0" ]; then | |
| 44 USE_IPV6="1" | |
| 45 fi | |
| 46 | |
| 47 # Find programs | |
| 48 IPTABLES=$(which iptables 2>/dev/null) | |
| 49 IPTABLES_SAVE=$(which iptables-save 2>/dev/null) | |
| 50 IPTABLES_RESTORE=$(which iptables-restore 2>/dev/null) | |
| 51 LSMOD=$(which lsmod 2>/dev/null) | |
| 52 AWK=$(which awk 2>/dev/null) | |
| 53 GREP=$(which grep 2>/dev/null) | |
| 54 IPSET=$(which ipset 2>/dev/null) | |
| 55 SYSCTL=$(which sysctl 2>/dev/null) | |
| 56 | |
| 57 if [ "$USE_IPV6" = "1" ]; then | |
| 58 IP6TABLES=$(which ip6tables 2>/dev/null) | |
| 59 IP6TABLES_SAVE=$(which ip6tables-save 2>/dev/null) | |
| 60 IP6TABLES_RESTORE=$(which ip6tables-restore 2>/dev/null) | |
| 61 fi | |
| 62 | |
| 63 | |
| 64 # Load configuration | |
| 65 if [ ! -f /etc/mbse-firewall/firewall.conf ]; then | |
| 66 echo "** /etc/mbse-firewall/firewall.conf not found, abort" | |
| 67 exit 1 | |
| 68 fi | |
| 69 . /etc/mbse-firewall/firewall.conf | |
| 70 | |
| 71 # Some defaults, they are replaced when configured in | |
| 72 # /etc/mbse-firewall/firewall.conf | |
| 73 | |
| 74 IF_EXT_AUTO_TO=${IF_EXT_AUTO_TO:=3600} | |
| 75 IF_EXT_AUTO_LIMIT=${IF_EXT_AUTO_LIMIT:=5/hour} | |
| 76 IF_EXT_AUTO_BURST=${IF_EXT_AUTO_BURST:=10} | |
| 77 | |
| 78 # --------------------------------------------------------------------------- | |
| 79 # | |
| 80 # Functions | |
| 81 # | |
| 82 # --------------------------------------------------------------------------- | |
| 83 | |
| 84 | |
| 85 # Reset iptables back to Slackware default. | |
| 86 reset_iptables() { | |
| 87 | |
| 88 if [ -f /proc/net/ip_tables_names ]; then | |
| 89 cat /proc/net/ip_tables_names | while read table; do | |
| 90 $IPTABLES -t $table -L -n | while read c chain rest; do | |
| 91 if test "X$c" = "XChain" ; then | |
| 92 $IPTABLES -t $table -F $chain | |
| 93 fi | |
| 94 done | |
| 95 $IPTABLES -t $table -X | |
| 96 done | |
| 97 | |
| 98 $IPTABLES -P INPUT $1 | |
| 99 $IPTABLES -P OUTPUT $1 | |
| 100 $IPTABLES -P FORWARD $1 | |
| 101 echo "Reset iptables default policy $1" | $LOGGER | |
| 102 fi | |
| 103 | |
| 104 if [ "$USE_IPV6" == "1" ] && [ -f /proc/net/ip6_tables_names ]; then | |
| 105 cat /proc/net/ip6_tables_names | while read table; do | |
| 106 $IP6TABLES -t $table -L -n | while read c chain rest; do | |
| 107 if test "X$c" = "XChain" ; then | |
| 108 $IP6TABLES -t $table -F $chain | |
| 109 fi | |
| 110 done | |
| 111 $IP6TABLES -t $table -X | |
| 112 done | |
| 113 $IP6TABLES -P OUTPUT $1 | |
| 114 $IP6TABLES -P INPUT $1 | |
| 115 $IP6TABLES -P FORWARD $1 | |
| 116 echo "Reset ip6tables default policy $1" | $LOGGER | |
| 117 fi | |
| 118 | |
| 119 # Remove any ipset tables. | |
| 120 $IPSET flush | |
| 121 $IPSET destroy | |
| 122 } | |
| 123 | |
| 124 | |
| 125 | |
| 126 is_external_if4() { | |
| 127 [ "x${IF_EXT}" == "x$1" ] && return 1 | |
| 128 | |
| 129 return 0 | |
| 130 } | |
| 131 | |
| 132 | |
| 133 | |
| 134 is_external_if6() { | |
| 135 if [ "$USE_IPV6" == "1" ]; then | |
| 136 [ "x${IF_EXT6}" == "x$1" ] && return 1 | |
| 137 [ "x${IF_EXT}" == "x$1" -a -z "${IF_EXT6}" ] && return 1 | |
| 138 fi | |
| 139 | |
| 140 return 0 | |
| 141 } | |
| 142 | |
| 143 | |
| 144 | |
| 145 reload_blocklist4() { | |
| 146 | |
| 147 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist4.conf" | |
| 148 if [ -f $BLOCKLIST ]; then | |
| 149 echo "Reload $BLOCKLIST" | $LOGGER | |
| 150 $IPSET create new-mbsefw-blk4ip hash:ip counters -exist | |
| 151 $IPSET create new-mbsefw-blk4net hash:net counters -exist | |
| 152 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do | |
| 153 set $L | |
| 154 if echo $1 | $GREP -q "/" ; then | |
| 155 $IPSET add new-mbsefw-blk4net $1 -exist | |
| 156 else | |
| 157 $IPSET add new-mbsefw-blk4ip $1 -exist | |
| 158 fi | |
| 159 done | |
| 160 $IPSET swap mbsefw-blk4net new-mbsefw-blk4net | |
| 161 $IPSET flush new-mbsefw-blk4net | |
| 162 $IPSET destroy new-mbsefw-blk4net | |
| 163 $IPSET swap mbsefw-blk4ip new-mbsefw-blk4ip | |
| 164 $IPSET flush new-mbsefw-blk4ip | |
| 165 $IPSET destroy new-mbsefw-blk4ip | |
| 166 fi | |
| 167 } | |
| 168 | |
| 169 | |
| 170 | |
| 171 reload_blocklist6() { | |
| 172 | |
| 173 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist6.conf" | |
| 174 if [ -f $BLOCKLIST ]; then | |
| 175 echo "Reload $BLOCKLIST" | $LOGGER | |
| 176 $IPSET create new-mbsefw-blk6 hash:net family inet6 counters -exist | |
| 177 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do | |
| 178 set $L ; $IPSET add new-mbsefw-blk6 $1 -exist | |
| 179 done | |
| 180 $IPSET swap mbsefw-blk6 new-mbsefw-blk6 | |
| 181 $IPSET flush new-mbsefw-blk6 | |
| 182 $IPSET destroy new-mbsefw-blk6 | |
| 183 fi | |
| 184 } | |
| 185 | |
| 186 | |
| 187 | |
| 188 fw_init_sysctl() { | |
| 189 # If we have bridges and don't want iptables to work between | |
| 190 # the physical interfaces, turn it off. | |
| 191 if [ "$FW_NO_BRIDGE_NF_CALL" = "1" ]; then | |
| 192 $SYSCTL -e -q -w net.bridge.bridge-nf-call-arptables=0 | |
| 193 $SYSCTL -e -q -w net.bridge.bridge-nf-call-ip6tables=0 | |
| 194 $SYSCTL -e -q -w net.bridge.bridge-nf-call-iptables=0 | |
| 195 fi | |
| 196 | |
| 197 # No arp about internal interfaces across the border. | |
| 198 if [ "$IF_EXT_IS_BORDER_GW" = "1" ]; then | |
| 199 $SYSCTL -q -w net.ipv4.conf.${IF_EXT}.arp_ignore=1 | |
| 200 $SYSCTL -q -w net.ipv4.conf.${IF_EXT}.arp_announce=1 | |
| 201 fi | |
| 202 } | |
| 203 | |
| 204 | |
| 205 | |
| 206 fw_start_init() { | |
| 207 | |
| 208 echo "Init new firewall" | $LOGGER | |
| 209 | |
| 210 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist4.conf" | |
| 211 if [ -f $BLOCKLIST -a -n "$IF_EXT" ]; then | |
| 212 echo " Install $BLOCKLIST" | $LOGGER | |
| 213 $IPSET create mbsefw-blk4ip hash:ip counters -exist | |
| 214 $IPSET create mbsefw-blk4net hash:net counters -exist | |
| 215 $IPTABLES -A INPUT -i $IF_EXT -m set --match-set mbsefw-blk4ip src -j DROP | |
| 216 $IPTABLES -A INPUT -i $IF_EXT -m set --match-set mbsefw-blk4net src -j DROP | |
| 217 if [ "$FW_FORWARD" = "1" ]; then | |
| 218 $IPTABLES -A FORWARD -i $IF_EXT -m set --match-set mbsefw-blk4ip src -j DROP | |
| 219 $IPTABLES -A FORWARD -i $IF_EXT -m set --match-set mbsefw-blk4net src -j DROP | |
| 220 fi | |
| 221 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do | |
| 222 set $L | |
| 223 if echo $1 | $GREP -q "/" ; then | |
| 224 $IPSET add mbsefw-blk4net $1 -exist | |
| 225 else | |
| 226 $IPSET add mbsefw-blk4ip $1 -exist | |
| 227 fi | |
| 228 done | |
| 229 echo -n "." | |
| 230 fi | |
| 231 | |
| 232 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist6.conf" | |
| 233 if [ -f $BLOCKLIST ]; then | |
| 234 echo " Install $BLOCKLIST" | $LOGGER | |
| 235 $IPSET create mbsefw-blk6 hash:net family inet6 counters -exist | |
| 236 if [ -n "$IF_EXT6" ]; then | |
| 237 IF6=$IF_EXT6 | |
| 238 else | |
| 239 IF6=$IF_EXT | |
| 240 fi | |
| 241 $IP6TABLES -A INPUT -i $IF6 -m set --match-set mbsefw-blk6 src -j DROP | |
| 242 if [ "$FW_FORWARD" = "1" ]; then | |
| 243 $IP6TABLES -A FORWARD -i $IF6 -m set --match-set mbsefw-blk6 src -j DROP | |
| 244 fi | |
| 245 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do | |
| 246 set $L | |
| 247 $IPSET add mbsefw-blk6 $1 -exist | |
| 248 done | |
| 249 echo -n "." | |
| 250 fi | |
| 251 | |
| 252 # accept established and related connections | |
| 253 $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 254 $IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 255 [ "$FW_FORWARD" = "1" ] && $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 256 if [ "$USE_IPV6" == "1" ]; then | |
| 257 $IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 258 $IP6TABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 259 [ "$FW_FORWARD" = "1" ] && $IP6TABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 260 fi | |
| 261 | |
| 262 # drop packets that do not match any valid state. This also blocks invalid | |
| 263 # flag combinations that are used by portscans. | |
| 264 $IPTABLES -A OUTPUT -m state --state INVALID -j DROP | |
| 265 $IPTABLES -A INPUT -m state --state INVALID -j DROP | |
| 266 [ "$FW_FORWARD" = "1" ] && $IPTABLES -A FORWARD -m state --state INVALID -j DROP | |
| 267 if [ "$USE_IPV6" == "1" ]; then | |
| 268 $IP6TABLES -A OUTPUT -m state --state INVALID -j DROP | |
| 269 $IP6TABLES -A INPUT -m state --state INVALID -j DROP | |
| 270 [ "$FW_FORWARD" = "1" ] && $IP6TABLES -A FORWARD -m state --state INVALID -j DROP | |
| 271 fi | |
| 272 | |
| 273 # Allow everything on the loopback interface | |
| 274 $IPTABLES -A INPUT -i lo -j ACCEPT | |
| 275 $IPTABLES -A OUTPUT -o lo -j ACCEPT | |
| 276 if [ "$USE_IPV6" == "1" ]; then | |
| 277 $IP6TABLES -A INPUT -i lo -j ACCEPT | |
| 278 $IP6TABLES -A OUTPUT -o lo -j ACCEPT | |
| 279 fi | |
| 280 | |
| 281 # Anti spoofing on the external interface. Methods since the 3.3 kernel! | |
| 282 if [ -n "$IF_EXT" ]; then | |
| 283 for f in $(ls /proc/sys/net/ipv4/conf/*/rp_filter); do | |
| 284 echo 1 > $f | |
| 285 done | |
| 286 $IPTABLES -A PREROUTING -t raw -i $IF_EXT -m rpfilter --invert -j DROP | |
| 287 if [ "$USE_IPV6" == "1" ]; then | |
| 288 if [ -n "$IF_EXT6" ]; then | |
| 289 $IP6TABLES -A PREROUTING -t raw -i $IF_EXT6 -m rpfilter --invert -j DROP | |
| 290 else | |
| 291 $IP6TABLES -A PREROUTING -t raw -i $IF_EXT -m rpfilter --invert -j DROP | |
| 292 fi | |
| 293 fi | |
| 294 # Manual anti spoofing on the interfaces is configured using the | |
| 295 # interfaces configuration and only if the system is a router. | |
| 296 fi | |
| 297 | |
| 298 # IPv4 ssh backdoor | |
| 299 if [ -n "$IPV4_BACKDOOR_SSH" ]; then | |
| 300 $IPTABLES -A INPUT -p tcp -m tcp -s $IPV4_BACKDOOR_SSH --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT | |
| 301 $IPTABLES -A OUTPUT -p tcp -m tcp -d $IPV4_BACKDOOR_SSH --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 302 fi | |
| 303 # IPv6 ssh backdoor | |
| 304 if [ "$USE_IPV6" == "1" ] && [ -n "$IPV6_BACKDOOR_SSH" ]; then | |
| 305 $IP6TABLES -A INPUT -p tcp -m tcp -s $IPV6_BACKDOOR_SSH --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT | |
| 306 $IP6TABLES -A OUTPUT -p tcp -m tcp -d $IPV6_BACKDOOR_SSH --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT | |
| 307 fi | |
| 308 | |
| 309 # Usefull ICMPv4 | |
| 310 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 311 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 0/0 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 312 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 8/0 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 313 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/0 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 314 $IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/1 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 315 $IPTABLES -A INPUT -p icmp -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=ICMPv4_INPUT " | |
| 316 $IPTABLES -A INPUT -p icmp -j DROP | |
| 317 $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT | |
| 318 $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 0/0 -j ACCEPT | |
| 319 $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 8/0 -j ACCEPT | |
| 320 $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/0 -j ACCEPT | |
| 321 $IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/1 -j ACCEPT | |
| 322 $IPTABLES -A OUTPUT -p icmp -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=ICMPv4_OUTPUT " | |
| 323 $IPTABLES -A OUTPUT -p icmp -j DROP | |
| 324 if [ "$FW_FORWARD" = "1" ]; then | |
| 325 $IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 3 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 326 $IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 0/0 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 327 $IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 8/0 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 328 $IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 11/0 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 329 $IPTABLES -A FORWARD -p icmp -m icmp --icmp-type 11/1 -m hashlimit --hashlimit 15/second --hashlimit-mode srcip --hashlimit-name icmp -j ACCEPT | |
| 330 $IPTABLES -A FORWARD -p icmp -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=ICMPv4_FORWARD " | |
| 331 $IPTABLES -A FORWARD -p icmp -j DROP | |
| 332 fi | |
| 333 | |
| 334 # If this system has enabled IPv6 ... | |
| 335 if [ "$USE_IPV6" == "1" ]; then | |
| 336 # ICMPv6 | |
| 337 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type destination-unreachable -j ACCEPT | |
| 338 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type packet-too-big -j ACCEPT | |
| 339 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type time-exceeded -j ACCEPT | |
| 340 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type parameter-problem -j ACCEPT | |
| 341 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type destination-unreachable -j ACCEPT | |
| 342 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type packet-too-big -j ACCEPT | |
| 343 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type time-exceeded -j ACCEPT | |
| 344 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type parameter-problem -j ACCEPT | |
| 345 if [ "$FW_FORWARD" = "1" ]; then | |
| 346 $IP6TABLES -A FORWARD -p ipv6-icmp -m icmp6 --icmpv6-type destination-unreachable -j ACCEPT | |
| 347 $IP6TABLES -A FORWARD -p ipv6-icmp -m icmp6 --icmpv6-type packet-too-big -j ACCEPT | |
| 348 $IP6TABLES -A FORWARD -p ipv6-icmp -m icmp6 --icmpv6-type time-exceeded -j ACCEPT | |
| 349 $IP6TABLES -A FORWARD -p ipv6-icmp -m icmp6 --icmpv6-type parameter-problem -j ACCEPT | |
| 350 fi | |
| 351 | |
| 352 # Rate limited icmpv6 | |
| 353 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request -m limit --limit 15/second -j ACCEPT | |
| 354 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-reply -m limit --limit 15/second -j ACCEPT | |
| 355 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT | |
| 356 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type echo-reply -j ACCEPT | |
| 357 if [ "$FW_FORWARD" = "1" ]; then | |
| 358 $IP6TABLES -A FORWARD -p ipv6-icmp -m icmp6 --icmpv6-type echo-request -m limit --limit 15/second -j ACCEPT | |
| 359 $IP6TABLES -A FORWARD -p ipv6-icmp -m icmp6 --icmpv6-type echo-reply -m limit --limit 15/second -j ACCEPT | |
| 360 fi | |
| 361 | |
| 362 # rules to permit IPv6 Neighbor discovery | |
| 363 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT | |
| 364 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT | |
| 365 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -j ACCEPT | |
| 366 $IP6TABLES -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT | |
| 367 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT | |
| 368 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT | |
| 369 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -j ACCEPT | |
| 370 $IP6TABLES -A OUTPUT -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT | |
| 371 | |
| 372 # MLD messages. DROP on external interface, but ACCEPT on others. | |
| 373 if [ -n "$IF_EXT6" -a "$IF_EXT_IS_BORDER_GW" = "1" ]; then | |
| 374 $IP6TABLES -A OUTPUT -o $IF_EXT6 -p ipv6-icmp -d ff00::/8 -m icmp6 --icmpv6-type 143 -j DROP | |
| 375 elif [ -n "$IF_EXT" -a "$IF_EXT_IS_BORDER_GW" = "1" ]; then | |
| 376 $IP6TABLES -A OUTPUT -o $IF_EXT -p ipv6-icmp -d ff00::/8 -m icmp6 --icmpv6-type 143 -j DROP | |
| 377 fi | |
| 378 $IP6TABLES -A OUTPUT -p ipv6-icmp -d ff00::/8 -m icmp6 --icmpv6-type 143 -j ACCEPT | |
| 379 | |
| 380 # Drop unmatched icmpv6 but log them so we can debug | |
| 381 $IP6TABLES -A INPUT -p ipv6-icmp -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=ICMPv6_INPUT " | |
| 382 $IP6TABLES -A INPUT -p ipv6-icmp -j DROP | |
| 383 $IP6TABLES -A OUTPUT -p ipv6-icmp -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=ICMPv6_OUTPUT " | |
| 384 $IP6TABLES -A OUTPUT -p ipv6-icmp -j DROP | |
| 385 [ "$FW_FORWARD" = "1" ] && { | |
| 386 $IP6TABLES -A FORWARD -p ipv6-icmp -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=ICMPv6_FORWARD " | |
| 387 $IP6TABLES -A FORWARD -p ipv6-icmp -j DROP | |
| 388 } | |
| 389 fi | |
| 390 | |
| 391 if [ "$CLAMP_MSS_TO_PMTU" = "1" ]; then | |
| 392 # ================ Table 'mangle', automatic rules | |
| 393 [ "$FW_FORWARD" = "1" ] && $IPTABLES -t mangle -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu | |
| 394 if [ "$USE_IPV6" == "1" ]; then | |
| 395 [ "$FW_FORWARD" = "1" ] && $IP6TABLES -t mangle -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu | |
| 396 fi | |
| 397 fi | |
| 398 | |
| 399 # Filter all packets that have RH0 header | |
| 400 if [ "$USE_IPV6" == "1" ]; then | |
| 401 # Filter all packets that have RH0 header | |
| 402 $IP6TABLES -A OUTPUT -m rt --rt-type 0 -j DROP | |
| 403 $IP6TABLES -A INPUT -m rt --rt-type 0 -j DROP | |
| 404 [ "$FW_FORWARD" = "1" ] && $IP6TABLES -A FORWARD -m rt --rt-type 0 -j DROP | |
| 405 | |
| 406 # Allow Link-Local sddresses | |
| 407 $IP6TABLES -A INPUT -s fe80::/10 -j ACCEPT | |
| 408 $IP6TABLES -A OUTPUT -s fe80::/10 -j ACCEPT | |
| 409 | |
| 410 # Allow Multicast | |
| 411 $IP6TABLES -A INPUT -d ff00::/8 -j ACCEPT | |
| 412 $IP6TABLES -A OUTPUT -d ff00::/8 -j ACCEPT | |
| 413 fi | |
| 414 | |
| 415 # Traceroute | |
| 416 if [ "$FW_TRACEROUTE" = "1" ]; then | |
| 417 $IPTABLES -A OUTPUT -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT | |
| 418 $IPTABLES -A INPUT -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT | |
| 419 [ "$FW_FORWARD" = "1" ] && $IPTABLES -A FORWARD -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT | |
| 420 if [ "$USE_IPV6" == "1" ]; then | |
| 421 $IP6TABLES -A OUTPUT -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT | |
| 422 $IP6TABLES -A INPUT -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT | |
| 423 [ "$FW_FORWARD" = "1" ] && $IP6TABLES -A FORWARD -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT | |
| 424 fi | |
| 425 fi | |
| 426 | |
| 427 echo -n "." | |
| 428 } | |
| 429 | |
| 430 | |
| 431 | |
| 432 fw_start_interface_chain() | |
| 433 { | |
| 434 local multi iodir IFS=\; | |
| 435 | |
| 436 INTF=$1 | |
| 437 FCHAIN=$2 | |
| 438 NCHAIN=$3 | |
| 439 SCHAIN=$4 | |
| 440 CONFFILE="/etc/mbse-firewall/conf.d/${INTF}-${FCHAIN}.conf" | |
| 441 is_external_if4 $1 | |
| 442 EXTERN4=$? | |
| 443 is_external_if6 $1 | |
| 444 EXTERN6=$? | |
| 445 | |
| 446 # TODO: use subchains, but we need to do 2 passes on the config | |
| 447 # files to make it work. | |
| 448 | |
| 449 # Are there rules for this chain? | |
| 450 if [ -f $CONFFILE ]; then | |
| 451 echo " Start chain ${NCHAIN} on interface ${INTF} is external ipv4: ${EXTERN4} ipv6: ${EXTERN6}" | $LOGGER | |
| 452 | |
| 453 # Install auto blacklisting if set for this interface and this is the | |
| 454 # INPUT or FORWARD chain. In /etc/mbse-firewall/firewall.conf set then | |
| 455 # IF_EXT_AUTO_TO value for the block timeout. Default is 3600 seconds. | |
| 456 # See the end of this function for the actual test. | |
| 457 if [ "$NCHAIN" = "INPUT" -o "$NCHAIN" = "FORWARD" ]; then | |
| 458 if [ "$IF_EXT_AUTO_BLOCK" = "1" ]; then | |
| 459 if [ "$EXTERN4" = "1" ]; then | |
| 460 echo " Installing IPv4 auto blacklisting on interface ${INTF}" | $LOGGER | |
| 461 $IPSET create mbsefw-auto4 hash:ip timeout $IF_EXT_AUTO_TO counters -exist | |
| 462 $IPTABLES -I $NCHAIN -m set --match-set mbsefw-auto4 src -j DROP | |
| 463 fi | |
| 464 if [ "$EXTERN6" = "1" ]; then | |
| 465 echo " Installing IPv6 auto blacklisting on interface ${INTF}" | $LOGGER | |
| 466 $IPSET create mbsefw-auto6 hash:ip family inet6 timeout $IF_EXT_AUTO_TO counters -exist | |
| 467 $IP6TABLES -I $NCHAIN -m set --match-set mbsefw-auto6 src -j DROP | |
| 468 fi | |
| 469 fi | |
| 470 fi | |
| 471 | |
| 472 # Adjust for the direction of the chain | |
| 473 if [ "$NCHAIN" = "OUTPUT" -o "$NCHAIN" = "POSTROUTING" ]; then | |
| 474 iodir="-o" | |
| 475 else | |
| 476 iodir="-i" | |
| 477 fi | |
| 478 | |
| 479 # Read the configuration | |
| 480 $GREP -Ev '^#|^\s*$' $CONFFILE | while read L ; do | |
| 481 set $L | |
| 482 # Build command | |
| 483 if [ "$1" = "6" ]; then | |
| 484 CMD=$IP6TABLES | |
| 485 else | |
| 486 CMD=$IPTABLES | |
| 487 fi | |
| 488 | |
| 489 if [ -n "$2" ]; then | |
| 490 args=("-t" "$2" "-A" "$NCHAIN" "$iodir" "${INTF}") | |
| 491 else | |
| 492 args=("-A" "$NCHAIN" "$iodir" "${INTF}") | |
| 493 fi | |
| 494 | |
| 495 # Protocol | |
| 496 [ -n "$3" ] && args+=("-p" "$3" "-m" "$3") | |
| 497 | |
| 498 # Test for multiport | |
| 499 multi=0 | |
| 500 [ -n "$5$7" ] && { | |
| 501 [[ $5$7 == *","* ]] && multi=1 | |
| 502 [[ $5$7 == *":"* ]] && multi=1 | |
| 503 } | |
| 504 [ "$multi" = "1" ] && args+=("-m" "multiport") | |
| 505 | |
| 506 # Source address | |
| 507 [ -n "$4" ] && args+=("-s" "$4") | |
| 508 | |
| 509 # Source port(s) | |
| 510 [ -n "$5" ] && { | |
| 511 multi=0 | |
| 512 [[ $5 == *","* ]] && multi=1 | |
| 513 [[ $5 == *":"* ]] && multi=1 | |
| 514 if [ "$multi" = "1" ]; then | |
| 515 args+=("--sports" "$5") | |
| 516 else | |
| 517 args+=("--sport" "$5") | |
| 518 fi | |
| 519 } | |
| 520 | |
| 521 # Destination address | |
| 522 [ -n "$6" ] && args+=("-d" "$6") | |
| 523 | |
| 524 # Destination port(s) | |
| 525 [ -n "$7" ] && { | |
| 526 multi=0 | |
| 527 [[ $7 == *","* ]] && multi=1 | |
| 528 [[ $7 == *":"* ]] && multi=1 | |
| 529 if [ "$multi" = "1" ]; then | |
| 530 args+=("--dports" "$7") | |
| 531 else | |
| 532 args+=("--dport" "$7") | |
| 533 fi | |
| 534 } | |
| 535 | |
| 536 # Rule options | |
| 537 [ -n "$9" ] && { | |
| 538 IFS=' ' | |
| 539 for arg in $9; do | |
| 540 args+=("$arg") | |
| 541 done | |
| 542 IFS=\; | |
| 543 } | |
| 544 | |
| 545 # Rule action | |
| 546 [ -n "$8" ] && { | |
| 547 IFS=' ' | |
| 548 args+=("-j") | |
| 549 for arg in $8; do | |
| 550 args+=("$arg") | |
| 551 done | |
| 552 IFS=\; | |
| 553 } | |
| 554 | |
| 555 $CMD "${args[@]}" | |
| 556 rc=$? | |
| 557 echo " " $CMD "${args[@]}" | $LOGGER | |
| 558 if [ $rc -ne 0 ]; then | |
| 559 echo "Error in $CONFFILE" | $LOGGER | |
| 560 fi | |
| 561 done | |
| 562 | |
| 563 # In PREROUTING or POSTROUTING chains we are done here. | |
| 564 if [ "$NCHAIN" = "PREROUTING" -o "$NCHAIN" = "POSTROUTING" ]; then | |
| 565 return | |
| 566 fi | |
| 567 | |
| 568 # Ignore timing problems with old connections | |
| 569 $IPTABLES -A $NCHAIN $iodir ${INTF} -p tcp -m tcp --tcp-flags ACK,PSH ACK,PSH -j DROP | |
| 570 [ "$USE_IPV6" = "1" ] && $IP6TABLES -A $NCHAIN $iodir ${INTF} -p tcp -m tcp --tcp-flags ACK,PSH ACK,PSH -j DROP | |
| 571 | |
| 572 # Install the final autoblock rule if this is the INPUT or FORWARD chain. | |
| 573 # We allow upto 1 probe per minute or a burst of 3 probes. This should be | |
| 574 # a good balance to catch the real bad guys. Note that until the IP is | |
| 575 # blocked these systems are logged using the rule below this one. | |
| 576 if [ "$IF_EXT_AUTO_BLOCK" = "1" -a "$NCHAIN" != "OUTPUT" ]; then | |
| 577 if [ "${EXTERN4}" = "1" ]; then | |
| 578 $IPTABLES -A $NCHAIN $iodir ${INTF} \ | |
| 579 -m hashlimit --hashlimit-above ${IF_EXT_AUTO_LIMIT} --hashlimit-burst ${IF_EXT_AUTO_BURST} --hashlimit-mode srcip --hashlimit-name hash-auto4 \ | |
| 580 -j SET --add-set mbsefw-auto4 src | |
| 581 fi | |
| 582 if [ "${EXTERN6}" = "1" ]; then | |
| 583 $IP6TABLES -A $NCHAIN $iodir ${INTF} \ | |
| 584 -m hashlimit --hashlimit-above ${IF_EXT_AUTO_LIMIT} --hashlimit-burst ${IF_EXT_AUTO_BURST} --hashlimit-mode srcip --hashlimit-name hash-auto6 \ | |
| 585 -j SET --add-set mbsefw-auto6 src | |
| 586 fi | |
| 587 fi | |
| 588 # deny and log the rest | |
| 589 $IPTABLES -A $NCHAIN $iodir ${INTF} -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=$NCHAIN " | |
| 590 [ "$USE_IPV6" == "1" ] && $IP6TABLES -A $NCHAIN $iodir ${INTF} -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=$NCHAIN " | |
| 591 $IPTABLES -A $NCHAIN $iodir ${INTF} -j DROP | |
| 592 [ "$USE_IPV6" == "1" ] && $IP6TABLES -A $NCHAIN $iodir ${INTF} -j DROP | |
| 593 echo -n "." | |
| 594 fi | |
| 595 } | |
| 596 | |
| 597 | |
| 598 | |
| 599 fw_start_interface() | |
| 600 { | |
| 601 fw_start_interface_chain $1 "prerouting" "PREROUTING" "pre" | |
| 602 fw_start_interface_chain $1 "input" "INPUT" "in" | |
| 603 fw_start_interface_chain $1 "output" "OUTPUT" "out" | |
| 604 fw_start_interface_chain $1 "forward" "FORWARD" "fwd" | |
| 605 fw_start_interface_chain $1 "postrouting" "POSTROUTING" "post" | |
| 606 } | |
| 607 | |
| 608 | |
| 609 | |
| 610 fw_start_main() { | |
| 611 i=0 | |
| 612 | |
| 613 [ -n "$IF_EXT" ] && fw_start_interface "$IF_EXT" | |
| 614 [ -n "$IF_EXT6" ] && fw_start_interface "$IF_EXT6" | |
| 615 | |
| 616 while [ $i -lt 50 ]; | |
| 617 do | |
| 618 [ -z "${IF_TRUNK[$i]}" ] && break | |
| 619 fw_start_interface "${IF_TRUNK[$i]}" | |
| 620 i=$(($i+1)) | |
| 621 done | |
| 622 } | |
| 623 | |
| 624 | |
| 625 | |
| 626 fw_start_final() { | |
| 627 # Deny and log everything else | |
| 628 $IPTABLES -N FINAL_RULE | |
| 629 $IPTABLES -A OUTPUT -j FINAL_RULE | |
| 630 $IPTABLES -A INPUT -j FINAL_RULE | |
| 631 [ "$FW_FORWARD" = "1" ] && $IPTABLES -A FORWARD -j FINAL_RULE | |
| 632 $IPTABLES -A FINAL_RULE -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=999 " | |
| 633 $IPTABLES -A FINAL_RULE -j DROP | |
| 634 if [ "$USE_IPV6" = "1" ]; then | |
| 635 $IP6TABLES -N FINAL_RULE | |
| 636 $IP6TABLES -A OUTPUT -j FINAL_RULE | |
| 637 $IP6TABLES -A INPUT -j FINAL_RULE | |
| 638 [ "$FW_FORWARD" = "1" ] && $IP6TABLES -A FORWARD -j FINAL_RULE | |
| 639 $IP6TABLES -A FINAL_RULE -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=999 " | |
| 640 $IP6TABLES -A FINAL_RULE -j DROP | |
| 641 fi | |
| 642 echo "Firewall installed" | $LOGGER | |
| 643 } | |
| 644 | |
| 645 | |
| 646 | |
| 647 fw_install() { | |
| 648 echo -n "Installing $(basename $0) $MBSEFW_VERSION: " | |
| 649 reset_iptables DROP | |
| 650 echo -n "." | |
| 651 fw_init_sysctl | |
| 652 echo -n "." | |
| 653 fw_start_init | |
| 654 fw_start_main | |
| 655 fw_start_final | |
| 656 echo " done." | |
| 657 } | |
| 658 | |
| 659 | |
| 660 | |
| 661 fw_start() { | |
| 662 if [ -f /etc/mbse-firewall/data/firewall-ipv4.data -a \ | |
| 663 -f /etc/mbse-firewall/data/firewall-ipv6.data -a \ | |
| 664 -f /etc/mbse-firewall/data/firewall-ipset.data ]; then | |
| 665 # Do a full restore of all saved data | |
| 666 echo -n "Starting $(basename $0) $MBSEFW_VERSION: " | |
| 667 echo "Start new firewall" | $LOGGER | |
| 668 reset_iptables DROP | |
| 669 echo -n "." | |
| 670 fw_init_sysctl | |
| 671 $IPSET restore < /etc/mbse-firewall/data/firewall-ipset.data | |
| 672 echo " Restored /etc/mbse-firewall/data/firewall-ipset.data" | $LOGGER | |
| 673 echo -n "." | |
| 674 $IPTABLES_RESTORE < /etc/mbse-firewall/data/firewall-ipv4.data | |
| 675 echo " Restored /etc/mbse-firewall/data/firewall-ipv4.data" | $LOGGER | |
| 676 echo -n "." | |
| 677 $IP6TABLES_RESTORE < /etc/mbse-firewall/data/firewall-ipv6.data | |
| 678 echo " Restored /etc/mbse-firewall/data/firewall-ipv6.data" | $LOGGER | |
| 679 echo " done." | |
| 680 echo -n "New firewall active" | $LOGGER | |
| 681 else | |
| 682 # If there is no saved firewall, install a new one and save it. | |
| 683 fw_install | |
| 684 fw_save | |
| 685 fi | |
| 686 } | |
| 687 | |
| 688 | |
| 689 | |
| 690 fw_stop() { | |
| 691 echo -n "Stopping $(basename $0) $MBSEFW_VERSION: " | |
| 692 # Slackware defaults to ACCEPT when no firewall is active. | |
| 693 reset_iptables ACCEPT | |
| 694 echo "done." | |
| 695 } | |
| 696 | |
| 697 | |
| 698 | |
| 699 # If there are blocklist tables, reload them. | |
| 700 fw_reload() { | |
| 701 echo -n "Reload $(basename $0) $MBSEFW_VERSION: " | |
| 702 reload_blocklist4 | |
| 703 reload_blocklist6 | |
| 704 echo done. | |
| 705 } | |
| 706 | |
| 707 | |
| 708 | |
| 709 fw_save() { | |
| 710 echo -n "Saving $(basename $0) $MBSEFW_VERSION: " | |
| 711 echo "Saving firewall" | $LOGGER | |
| 712 mkdir -p /etc/mbse-firewall/data | |
| 713 [ -n "$IPTABLES_SAVE" ] && $IPTABLES_SAVE > /etc/mbse-firewall/data/firewall-ipv4.data | |
| 714 echo -n "." | |
| 715 [ -n "$IP6TABLES_SAVE" ] && $IP6TABLES_SAVE > /etc/mbse-firewall/data/firewall-ipv6.data | |
| 716 echo -n "." | |
| 717 | |
| 718 rm -f /etc/mbse-firewall/data/firewall-ipset.data | |
| 719 touch /etc/mbse-firewall/data/firewall-ipset.data | |
| 720 SETS="$($IPSET list -n)" | |
| 721 for set in $SETS ; do | |
| 722 if [ "$set" = "mbsefw-auto4" -o "$set" = "mbsefw-auto6" ]; then | |
| 723 # Only save structure for auto blocklists | |
| 724 $IPSET save $set -t >> /etc/mbse-firewall/data/firewall-ipset.data | |
| 725 else | |
| 726 $IPSET save $set >> /etc/mbse-firewall/data/firewall-ipset.data | |
| 727 fi | |
| 728 echo -n "." | |
| 729 done | |
| 730 echo " done." | |
| 731 echo "Save firewall done in /etc/mbse-firewall/data" | $LOGGER | |
| 732 } | |
| 733 | |
| 734 | |
| 735 | |
| 736 fw_status() { | |
| 737 | |
| 738 echo -n "$(basename $0) $MBSEFW_VERSION" | |
| 739 | |
| 740 IP_MODULES=$($LSMOD | $AWK '{print $1}' | $GREP '^ip') | |
| 741 if [ "${IP_MODULES}x" = "x" ]; then | |
| 742 echo " - You do not have any iptables loaded." | |
| 743 return | |
| 744 else | |
| 745 echo " - You have the following ip modules loaded:" | |
| 746 echo -n " " | |
| 747 echo ${IP_MODULES} | |
| 748 fi | |
| 749 | |
| 750 if [ ! -z "$( echo $IP_MODULES | $GREP iptable_filter )" ]; then | |
| 751 echo | |
| 752 echo ' FILTER TABLE IPv4' | |
| 753 echo | |
| 754 $IPTABLES -t filter -L -n -v --line-numbers | |
| 755 fi | |
| 756 | |
| 757 if [ ! -z "$( echo $IP_MODULES | $GREP ip6table_filter )" ]; then | |
| 758 echo | |
| 759 echo ' FILTER TABLE IPv6' | |
| 760 echo | |
| 761 $IP6TABLES -t filter -L -n -v --line-numbers | |
| 762 fi | |
| 763 | |
| 764 if [ ! -z "$( echo $IP_MODULES | $GREP iptable_nat )" ]; then | |
| 765 echo | |
| 766 echo ' NAT TABLE IPv4' | |
| 767 echo | |
| 768 $IPTABLES -t nat -L -v -n --line-numbers | |
| 769 fi | |
| 770 | |
| 771 if [ ! -z "$( echo $IP_MODULES | $GREP ip6table_nat )" ]; then | |
| 772 echo | |
| 773 echo ' NAT TABLE IPv6' | |
| 774 echo | |
| 775 $IP6TABLES -t nat -L -v -n --line-numbers | |
| 776 fi | |
| 777 | |
| 778 if [ ! -z "$( echo $IP_MODULES | $GREP iptable_raw )" ]; then | |
| 779 echo | |
| 780 echo ' RAW TABLE IPv4' | |
| 781 echo | |
| 782 $IPTABLES -t raw -L -v -n --line-numbers | |
| 783 fi | |
| 784 | |
| 785 if [ ! -z "$( echo $IP_MODULES | $GREP ip6table_raw )" ]; then | |
| 786 echo | |
| 787 echo ' RAW TABLE IPv6' | |
| 788 echo | |
| 789 $IP6TABLES -t raw -L -v -n --line-numbers | |
| 790 fi | |
| 791 | |
| 792 if [ ! -z "$( echo $IP_MODULES | $GREP iptable_mangle )" ]; then | |
| 793 echo | |
| 794 echo ' MANGLE TABLE IPv4' | |
| 795 echo | |
| 796 $IPTABLES -t mangle -L -v -n --line-numbers | |
| 797 fi | |
| 798 | |
| 799 if [ ! -z "$( echo $IP_MODULES | $GREP ip6table_mangle )" ]; then | |
| 800 echo | |
| 801 echo ' MANGLE TABLE IPv6' | |
| 802 echo | |
| 803 $IP6TABLES -t mangle -L -v -n --line-numbers | |
| 804 fi | |
| 805 | |
| 806 if [ ! -z "$( echo $IP_MODULES | $GREP iptable_security )" ]; then | |
| 807 echo | |
| 808 echo ' SECURITY TABLE IPv4' | |
| 809 echo | |
| 810 $IPTABLES -t security -L -v -n --line-numbers | |
| 811 fi | |
| 812 | |
| 813 if [ ! -z "$( echo $IP_MODULES | $GREP ip6table_security )" ]; then | |
| 814 echo | |
| 815 echo ' SECURITY TABLE IPv6' | |
| 816 echo | |
| 817 $IP6TABLES -t security -L -v -n --line-numbers | |
| 818 fi | |
| 819 | |
| 820 if [ -n "$IPSET" ] && [ ! -z "$($IPSET list)" ]; then | |
| 821 echo | |
| 822 echo ' IPSET listing' | |
| 823 echo | |
| 824 $IPSET list | |
| 825 fi | |
| 826 } | |
| 827 | |
| 828 | |
| 829 | |
| 830 # --------------------------------------------------------------------------- | |
| 831 # | |
| 832 # MAIN program part | |
| 833 # | |
| 834 # --------------------------------------------------------------------------- | |
| 835 | |
| 836 | |
| 837 # See how we were called | |
| 838 cmd=$1 | |
| 839 | |
| 840 case "$cmd" in | |
| 841 start) | |
| 842 fw_start | |
| 843 ;; | |
| 844 | |
| 845 stop) | |
| 846 fw_stop | |
| 847 ;; | |
| 848 | |
| 849 restart) | |
| 850 fw_stop | |
| 851 fw_start | |
| 852 ;; | |
| 853 | |
| 854 save) | |
| 855 fw_save | |
| 856 ;; | |
| 857 install) | |
| 858 fw_install | |
| 859 ;; | |
| 860 reload) | |
| 861 fw_reload | |
| 862 ;; | |
| 863 status) | |
| 864 fw_status | |
| 865 ;; | |
| 866 | |
| 867 *) | |
| 868 echo "Usage $0 [start|stop|restart|status]" | |
| 869 ;; | |
| 870 esac | |
| 871 | |
| 872 |
