Compare commits
No commits in common. "v963" and "v961" have entirely different histories.
|
|
@ -208,21 +208,6 @@ ActivateMasq() {
|
|||
-j MASQUERADE >>$TMPSCRIPT
|
||||
}
|
||||
|
||||
AllowLocalServer() {
|
||||
SERVER=$1
|
||||
CLIENT=$2
|
||||
PORT=$3
|
||||
PROT=$4
|
||||
RULE=ACCEPT
|
||||
|
||||
echo $DEBUG $IPTABLES -A FORWARD \
|
||||
-s $CLIENT \
|
||||
-d $SERVER \
|
||||
-p $PROT \
|
||||
--dport $PORT \
|
||||
-j $RULE >>$TMPSCRIPT
|
||||
}
|
||||
|
||||
AllowDMZServiceAccess() {
|
||||
SRVIP=$1
|
||||
UDPPORTS=$2
|
||||
|
|
@ -325,35 +310,6 @@ LocalAllowWSAll() {
|
|||
done
|
||||
}
|
||||
|
||||
AllowIntranetService() {
|
||||
WSIP=$1
|
||||
WSPORT=$2
|
||||
WSPROT=$3
|
||||
|
||||
WSMASK=`getmask $WSIP`
|
||||
WSNET=`getnetaddr $WSIP $WSMASK`
|
||||
NETDEV=`netstat -rn| \
|
||||
grep $WSNET| \
|
||||
sed -e "/^0.0.0.0/d" | \
|
||||
awk '{print $8}'`
|
||||
LOCIP=`ifconfig $NETDEV|grep inet|awk '{print $2}'|cut -d":" -f 2`
|
||||
echo "AllowIntanetService $NETDEV , $LOCIP"
|
||||
echo $DEBUG $IPTABLES -A OUTPUT \
|
||||
-p $WSPROT \
|
||||
-d $WSIP \
|
||||
-s $LOCIP \
|
||||
-o $NETDEV \
|
||||
--dport $WSPORT \
|
||||
-j ACCEPT >>$TMPSCRIPT
|
||||
echo $DEBUG $IPTABLES -A INPUT \
|
||||
-p $WSPROT \
|
||||
-s $WSIP \
|
||||
-d $LOCIP \
|
||||
-i $NETDEV \
|
||||
--sport $WSPORT \
|
||||
-j ACCEPT >>$TMPSCRIPT
|
||||
}
|
||||
|
||||
LocalAllowPortIN() {
|
||||
UDP=$1
|
||||
TCP=$2
|
||||
|
|
@ -719,57 +675,6 @@ AllowWSntpSync() {
|
|||
-j $RULE >>$TMPSCRIPT
|
||||
}
|
||||
|
||||
AllowNetBios() {
|
||||
OUTDEV=$1
|
||||
WSIP=$2
|
||||
RULE=$3
|
||||
echo >&2 "Executing AllowNetBios with \"$1\" \"$2\" \"$3\""
|
||||
WSIPADDR=`echo $WSIP|sed -e "s/\/.*$//"`
|
||||
INDEV=`FindInDevice $WSIPADDR`
|
||||
for i in 137 138 139; do
|
||||
echo $DEBUG $IPTABLES -A FORWARD \
|
||||
-p tcp \
|
||||
-s $WSIP \
|
||||
--sport $i \
|
||||
--dport $i \
|
||||
-o $OUTDEV \
|
||||
-i $INDEV \
|
||||
-m state \
|
||||
--state NEW,ESTABLISHED \
|
||||
-j $RULE >>$TMPSCRIPT
|
||||
echo $DEBUG $IPTABLES -A FORWARD \
|
||||
-p tcp \
|
||||
-d $WSIP \
|
||||
--sport $i \
|
||||
--dport $i \
|
||||
-o $INDEV \
|
||||
-i $OUTDEV \
|
||||
-m state \
|
||||
--state ESTABLISHED \
|
||||
-j $RULE >>$TMPSCRIPT
|
||||
echo $DEBUG $IPTABLES -A FORWARD \
|
||||
-p udp \
|
||||
-s $WSIP\
|
||||
--sport $i \
|
||||
--dport $i \
|
||||
-o $OUTDEV \
|
||||
-i $INDEV \
|
||||
-m state \
|
||||
--state NEW,ESTABLISHED \
|
||||
-j $RULE >>$TMPSCRIPT
|
||||
echo $DEBUG $IPTABLES -A FORWARD \
|
||||
-p udp \
|
||||
-d $WSIP \
|
||||
--sport $i \
|
||||
--dport $i \
|
||||
-o $INDEV \
|
||||
-i $OUTDEV \
|
||||
-m state \
|
||||
--state ESTABLISHED \
|
||||
-j $RULE >>$TMPSCRIPT
|
||||
done
|
||||
}
|
||||
|
||||
AllowDHCPRelay() {
|
||||
SERVERIP=$1
|
||||
|
||||
|
|
|
|||
|
|
@ -106,9 +106,6 @@ if [ -f "$CFGFILE" ]; then
|
|||
case $1 in
|
||||
start)
|
||||
if [ -f /var/state/iptables.state ]; then
|
||||
echo -n "Disabling Kernel Console Output"
|
||||
echo "0" >/proc/sys/kernel/printk
|
||||
evaluate_retval
|
||||
echo -n "Restoring Firewall Table"
|
||||
cat /var/state/iptables.state|iptables-restore
|
||||
evaluate_retval
|
||||
|
|
@ -172,20 +169,6 @@ if [ -f "$CFGFILE" ]; then
|
|||
AllowInternRouting ACCEPT $INTERNROUTING
|
||||
evaluate_retval
|
||||
fi
|
||||
y=0
|
||||
while [ "${LOCALSERVER[$y]}" ]; do
|
||||
echo -n "Activating allow for localserver ${LOCALSERVER[$y]}"
|
||||
LOCSERVER=`echo ${LOCALSERVER[$y]}|cut -d":" -f 2`
|
||||
DMZCLIENT=`echo ${LOCALSERVER[$y]}|cut -d":" -f 1`
|
||||
LOCPORT=`echo ${LOCALSERVER[$y]}|cut -d":" -f 3`
|
||||
LOCPROT=`echo ${LOCALSERVER[$y]}|cut -d":" -f 4`
|
||||
AllowLocalServer $LOCSERVER \
|
||||
$DMZCLIENT \
|
||||
$LOCPORT \
|
||||
$LOCPROT
|
||||
evaluate_retval
|
||||
(( y++ ))
|
||||
done
|
||||
if [ "$ALLOWNET" ]; then
|
||||
echo -n "Allowing routing for NET=$ALLOWNET over $TUNDEV"
|
||||
echo "#Netz $ALLOWNET komplett freischalten" >>$TMPSCRIPT
|
||||
|
|
@ -210,18 +193,6 @@ if [ -f "$CFGFILE" ]; then
|
|||
evaluate_retval
|
||||
(( y++ ))
|
||||
done
|
||||
y=0
|
||||
while [ ${INSERVER[$y]} ]; do
|
||||
echo "Allow Access to Intranet Service ${INSERVER[$y]}"
|
||||
IP=`echo ${INSERVER[$y]}|awk -F":" '{print $1}'`
|
||||
PORT=`echo ${INSERVER[$y]}|awk -F":" '{print $2}'`
|
||||
PROT=`echo ${INSERVER[$y]}|awk -F":" '{print $3}'`
|
||||
AllowIntranetService ${IP} \
|
||||
${PORT} \
|
||||
${PROT}
|
||||
evaluate_retval
|
||||
(( y++ ))
|
||||
done
|
||||
for i in $GLOBALSERVER; do
|
||||
echo -n "Allow Access to Server $i"
|
||||
echo "#Zugriff auf server $i freigeben" >>$TMPSCRIPT
|
||||
|
|
@ -264,10 +235,6 @@ if [ -f "$CFGFILE" ]; then
|
|||
echo "#ntp fuer ${LOCALWS[$wszahler]}" >>$TMPSCRIPT
|
||||
AllowWSntpSync $OUTDEV ${LOCALWS[$wszahler]} $ACCEPTRULE
|
||||
fi
|
||||
if [ "${ALLOWNETBIOS[$wszahler]}" = "yes" ]; then
|
||||
echo "#netbios fuer ${LOCALWS[$wszahler]}" >>$TMPSCRIPT
|
||||
AllowNetBios $OUTDEV ${LOCALWS[$wszahler]} $ACCEPTRULE
|
||||
fi
|
||||
evaluate_retval
|
||||
(( wszahler = $wszahler + 1 ))
|
||||
done
|
||||
|
|
@ -389,12 +356,8 @@ if [ -f "$CFGFILE" ]; then
|
|||
evaluate_retval
|
||||
;;
|
||||
stop)
|
||||
for i in filter nat mangle raw; do
|
||||
$DEBUG $IPTABLES -t $i -F
|
||||
$DEBUG $IPTABLES -t $i -X
|
||||
done
|
||||
|
||||
for i in INPUT FORWARD OUTPUT; do
|
||||
$DEBUG $IPTABLES -F $i
|
||||
$DEBUG $IPTABLES -P $i ACCEPT
|
||||
done
|
||||
if [ "$ACCOUNTING" == "yes" ]; then
|
||||
|
|
|
|||
|
|
@ -1,20 +0,0 @@
|
|||
description "Setup and Start iptables firewall"
|
||||
author "Harald Kueller <harald.kueller@compuextreme.de>"
|
||||
version 1.0
|
||||
emits none special
|
||||
|
||||
start on ( runlevel [2345] and (stopped routing))
|
||||
|
||||
console output
|
||||
|
||||
pre-start script
|
||||
if [ [ ! -f /var/state/iptables.state ] && [ -f /etc/sysconfig/net/firewall ] ]; then
|
||||
/etc/init.d/firewall configure
|
||||
fi
|
||||
end script
|
||||
|
||||
script
|
||||
if [ -f /var/state/iptables.state ]; then
|
||||
/etc/init.d/firewall start
|
||||
fi
|
||||
end script
|
||||
|
|
@ -73,7 +73,7 @@ INTERNROUTING="eth1 lo"
|
|||
#Leider kann hier nur EIN Locales Netz angegeben werden. Jedoch kann
|
||||
#durch gute Definition des Localen Netzes ein sehr grosser Bereich
|
||||
#Maskiert werden. Das Locale Netz muss mit "NetzIP/ShortMask" angegeben werden.
|
||||
#MASQNET=192.168.66.0/24
|
||||
MASQNET=192.168.66.0/24
|
||||
|
||||
#Mit den folgenden Variablen lässt sich ein Komplettes Netz freischalten, das
|
||||
#z.B. hinter einem weiteren Router im Netzwerk angeschlossen ist.
|
||||
|
|
@ -91,12 +91,6 @@ BGNETTCP[1]="13,15,20,21,25,43,70,80 109:115,143,143 220,443,554,765,1024:65535"
|
|||
ROUTEDBGNETSW[1]="yes"
|
||||
ROUTEDBGNETNTP[1]="yes"
|
||||
|
||||
#Bei DMZ Systemen solle u.U. bestimmte Services im geschuetzen Netzbereich
|
||||
#aus der DMZ heraus ansprechbar sein.
|
||||
#Die Server werden mit Portnummer und Protokoll jeweils in $LOCALSERVER[#]
|
||||
#eingetragen
|
||||
#LOCALSERVER[0]="hugin.compuextreme.de:pgsql.compuextreme.lan:5432:tcp"
|
||||
|
||||
#Mit den folgenden Zeilen wird die Internet Berechtigung für einzelne IP
|
||||
#Adressen festgelegt. LOCALWS Enthält die IP jeweils einer localen Workstation
|
||||
#Alternativ kann in LOCALWS auch ein komplettes SubNet angegeben werden. Dies wird
|
||||
|
|
@ -111,8 +105,6 @@ ROUTEDBGNETNTP[1]="yes"
|
|||
#Aufgebaut, sondern Server und Client verwenden den gleichen Port 123.
|
||||
#Daher kann eine spezielle Regel für NTP eingefügt werden. Hierzu muss der
|
||||
#Wert von ALLOWNTP auf "yes" gesetzt werden.
|
||||
#Gleiches gild fuer netbios von Microsoft. Hier kann die Variable ALLOWNETBIOS
|
||||
#auf "yes" gesetzt werden, um die entsprechende Sonderbehandlung zu aktivieren.
|
||||
#In den Eckigen Klammern wird fuer jede freizuschaltende Workstation
|
||||
#eine andere Nummer eingesetzt. Es muessen alle vier Variablen jeweils einmal
|
||||
#pro Workstation gesetzt werden.
|
||||
|
|
@ -153,14 +145,6 @@ ALLOWNTP[1]="no"
|
|||
#space zeichen voneinander getrennt werden.
|
||||
GLOBALSERVER="192.168.66.49 192.168.66.53"
|
||||
|
||||
#Liegen die genutzen Dienste hinter einem grouteten Netz, so muss die
|
||||
#Freischaltung anders erfolgen. Hierzu die Variable unten
|
||||
#definieren. Angegeben wird hier die Server IP, der Dienst Port, sowie das
|
||||
#Protokoll. Hier wird NUR dem Firewall Rechner der Zugriff auf diese
|
||||
#Dienste erlaubt.
|
||||
INSERVER[0]="192.168.75.67:53:tcp"
|
||||
INSERVER[1]="192.168.75.67:53:udp"
|
||||
|
||||
#Serverdienste Auf Router. Hiermit können Bestimmte Zugriffe auf den Router
|
||||
#aus dem gesammten Localen Netz (definiert über die angegebenen Devices)
|
||||
#erlaubt werden. Die Angabe der Freigeschalteten Dienste erfolgt auf
|
||||
|
|
|
|||
32
init/genpkg
32
init/genpkg
|
|
@ -21,20 +21,18 @@
|
|||
#
|
||||
#
|
||||
|
||||
if [ -d /var/install/sysvinit* ]; then
|
||||
WDIR=`pwd`
|
||||
cd etc/init.d
|
||||
chmod 755 firewall
|
||||
mkdir rc{0,1,2,3,4,5,6}.d
|
||||
for i in 0 6; do
|
||||
cd rc$i.d
|
||||
ln -s ../firewall K75firewall
|
||||
cd ..
|
||||
done
|
||||
for i in 1 2 3 4 5; do
|
||||
cd rc$i.d
|
||||
ln -s ../firewall S12firewall
|
||||
cd ..
|
||||
done
|
||||
cd $WDIR
|
||||
fi
|
||||
WDIR=`pwd`
|
||||
cd etc/init.d
|
||||
chmod 755 firewall
|
||||
mkdir rc{0,1,2,3,4,5,6}.d
|
||||
for i in 0 6; do
|
||||
cd rc$i.d
|
||||
ln -s ../firewall K75firewall
|
||||
cd ..
|
||||
done
|
||||
for i in 1 2 3 4 5; do
|
||||
cd rc$i.d
|
||||
ln -s ../firewall S12firewall
|
||||
cd ..
|
||||
done
|
||||
cd $WDIR
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user