version 2.15, 2005/01/16 12:13:32 |
version 2.16, 2005/01/16 15:27:15 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.14 2005/01/16 11:06:46 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.15 2005/01/16 12:13:32 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
Line 48 AWK="${AWK:=/usr/bin/awk}" |
|
Line 48 AWK="${AWK:=/usr/bin/awk}" |
|
LO_IFACE="${LO_IFACE:=lo}" |
LO_IFACE="${LO_IFACE:=lo}" |
LO_IP="IP_$LO_IFACE" |
LO_IP="IP_$LO_IFACE" |
|
|
|
# |
|
# CONSTANTS - Do not edit |
|
# |
|
ANYWHERE="0.0.0.0/0" # Match any IP address |
|
BROADCAST_SRC="0.0.0.0" # Broadcast Source Address |
|
BROADCAST_DEST="255.255.255.255" # Broadcast Destination Address |
|
CLASS_A="10.0.0.0/8" # Class-A Private (RFC-1918) Networks |
|
CLASS_B="172.16.0.0/12" # Class-B Private (RFC-1918) Networks |
|
CLASS_C="192.168.0.0/16" # Class-C Private (RFC-1918) Networks |
|
CLASS_D_MULTICAST="224.0.0.0/4" # Class-D Multicast Addresses |
|
CLASS_E_RESERVED_NET="240.0.0.0/5" # Class-E Reserved Addresses |
|
PRIVPORTS="0:1023" # Well-Known, Privileged Port Range |
|
UNPRIVPORTS="1024:65535" # Unprivileged Port Range |
|
TRACEROUTE_SRC_PORTS="32769:65535" # Traceroute Source Ports |
|
TRACEROUTE_DEST_PORTS="33434:33523" # Traceroute Destination Ports |
|
|
|
|
# allow some ICMP packets - needed for ping etc. |
# allow some ICMP packets - needed for ping etc. |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
|
|
|
|
# load necessary modules from $MODULES variable |
# load necessary modules from $MODULES variable |
load_modules() |
load_modules() |
{ # {{{ |
{ # {{{ |
|
|
fi |
fi |
done |
done |
|
|
|
# Enable outgoing TRACEROUTE requests (required e.g. by Skype, http://www.skype.com) |
|
if [ ! -z "$TRACEROUTE_IFACE" ]; then |
|
ip="IP_$ANTISPOOF_IFACE"; |
|
echo -en "Accepting traceroute:" |
|
|
|
$IPTABLES -A OUTPUT -o $ANTISPOOF_IFACE -p UDP \ |
|
--sport $TRACEROUTE_SRC_PORTS --dport $TRACEROUTE_DEST_PORTS \ |
|
-s ${!ip} -d $ANYWHERE -j ACCEPT |
|
|
|
for iface in $TRACEROUTE_IFACE; do |
|
$IPTABLES -A FORWARD -p UDP -i $iface --sport $TRACEROUTE_SRC_PORTS \ |
|
--dport $TRACEROUTE_DEST_PORTS -j ACCEPT |
|
done |
|
echo " done." |
|
fi |
|
|
} # }}} |
} # }}} |
|
|
# ACCEPT all packets from our IP address |
# ACCEPT all packets from our IP address |