Opensource.Platon.SK CVS: scripts/shell/firewall/configure-fw-universal.sh - diff

   Vyššie na [Platon] / scripts / shell / firewall
Rozdiely pre scripts/shell/firewall/configure-fw-universal.sh medzi verziami 1.1 a 1.2


verzia 1.1, 2005/11/01 02:16:56
verzia 1.2, 2005/11/01 18:09:33



Riadok 13 




Riadok 13 




 # 2005-11-01 - created
 # 2005-11-01 - created


 #
 #


 
 


 # $Platon$
 # $Platon: scripts/shell/firewall/configure-fw-universal.sh,v 1.1 2005/11/01 02:16:56 rajo Exp $


 
 


 DESC="firewall"
 DESC="firewall"


 TITLE="Firewall configurator"
 TITLE="Firewall configurator"




Riadok 129  RMMOD="$RMMOD"




Riadok 129  RMMOD="$RMMOD"




 AWK="$AWK"
 AWK="$AWK"


 
 


 # loopback interface
 # loopback interface


 LO_IFACE="\${LO_IFACE:=1/lo}"
 LO_IFACE="\${LO_IFACE:=lo}"


 
 


 DEFAULT
 DEFAULT


 # }}}
 # }}}


 
 cat >> $EDIT_CONFIG <<MAIN


 
 # Antispoof filter


 
 ANTISPOOF_IFACE="$ANTISPOOF_IFACE"


 
 


 
 # Allow traceroute from interfaces


 
 TRACEROUTE_IFACE="$TRACEROUTE_IFACE"


 
 


 
 # banned IP addresses - packets from this hosts are DROPPED


 
 BANNED_IP="$BANNED_IP"


 
 


 
 # accept all packetes on these interfaces


 
 # DO NOT ADD eth0 device here !!!


 
 IFACE_ACCEPT_ALL="lo tun+ tap+"


 
 


 
 # Which ports will be allowed on INPUT (TCP connections)


 
 ALL_ACCEPT_INPUT_TCP="22"


 
 ALL_ACCEPT_INPUT_UDP="68" # dhcpclient


 
 # interface eth0


 
 eth0_ACCEPT_INPUT_TCP="123 137 138 139 631 80 443 3128 2220"


 
 # interface eth1


 
 eth1_ACCEPT_INPUT_TCP="80 6000"


 
 # interface ppp0


 
 ppp0_ACCEPT_INPUT_TCP=""


 
 


 
 # Which ports will be allowed on INPUT (UDP connections)


 
 # interface eth0


 
 eth0_ACCEPT_INPUT_UDP="123 137 138 139 513 631"


 
 # interface ppp0


 
 ppp0_ACCEPT_INPUT_UDP=""


 
 


 
 # Package dropping


 
 #eth0_DROP_OUTPUT_TCP="123 137 138 139 445 631"


 
 #eth0_DROP_OUTPUT_UDP="123 137 138 139 445 631"


 
 #eth1_DROP_OUTPUT_TCP=""


 
 #eth1_DROP_OUTPUT_UDP=""


 
 


 
 #


 
 # NAT configuration


 
 #


 
 


 
 # eth0 connected to internet


 
 #NAT_LAN_IFACE="eth0"


 
 # eth1 connected to local subnet


 
 #NAT_SUBNET_IFACE="eth1"


 
 


 
 # logging must be turned on, see LOGGING="on"


 
 NAT_LOG_NEW_CONNECTIONS="no"


 
 


 
 #


 
 # Forward configuration


 
 #


 
 # don't forward Miscrosoft protocols - NOT RFC compliant packets (packets in NEW state withouth SYN flag)


 
 NAT_FORWARD_MICROSOFT="no"


 
 # redirect all outgoing connections to SMTP port 25 to local server (simple virus/antispam protection)


 
 # redirect all outgoing HTTP connection to transparent proxy server (squid)


 
 NAT_TCP_PORT_REDIRECT="25:25 80:3128 8080:3128 1080:3128 3128:3128"


 
 


 
 # forward port 2220 from your firewall/router to local machine port 22 (ssh)


 
 # you must accept port 2220 in $eth0_ACCEPT_INPUT_TCP


 
 NAT_TCP_PORT_FORWARD="2220:192.168.0.100:22"


 
 


 
 # NAT only "secure" ports


 
 NAT_FORWARD_TCP_PORTS="20 21 22 23 53 113 123 143 194 220 873 992 993 994 995 1241 2401 3306 3690 5190 5432 6000"


 
 NAT_FORWARD_UDP_PORTS="20 21 22 23 53 113 123 143 194 220 873 992 993 994 995 1241 2401 3306 3690 5190 5432 6000"


 
 


 
 #


 
 # Deny NAT for clients with this IP


 
 #


 
 #NAT_CLIENT_DROP="192.168.0.120" # ugly bad boys in your LAN


 
 


 
 #


 
 # ICMP configuration


 
 #


 
 # (4) Source Quench                     - Incoming & outgoing requests to slow down (flow control)


 
 # (12) Parameter Problem        - Incoming & outgoing error messages


 
 # (3) Destination Unreachable, Service Unavailable


 
 #                                                       - Incoming & outgoing size negotiation, service or


 
 #                                                         destination unavailability, final traceroute response


 
 # (11) Time Exceeded            - Incoming & outgoing timeout conditions, also intermediate TTL response to traceroutes


 
 # (0 | 8) Allow OUTPUT pings to anywhere


 
 


 
 # default: echo-reply destination-unreachable echo-request time-exceeded fragmentation-needed


 
 ACCEPT_ICMP_PACKETS="echo-reply destination-unreachable echo-request time-exceeded fragmentation-needed"


 
 


 
 MAIN


 # footer {{{
 # footer {{{


 cat >> $EDIT_CONFIG <<FOOT
 cat >> $EDIT_CONFIG <<FOOT


 
 




Riadok 146  FOOT




Riadok 231  FOOT




 # }}}
 # }}}


 } # }}}
 } # }}}


 
 


 tempfile=`tempfile 2> /dev/null` || tempfile=/tmp/configure-fw-universal-$$
 


 trap "rm -f $tempfile" 0 1 2 5 15
 


 
 


 varname=DEFAULT_POLICY
 


 conf_title_DEFAULT_POLICY="Default IPtables policy"
 


 if [ "x$DEFAULT_POLICY" = "xACCEPT" ]; then # {{{
 


         DEFAULT_POLICY_drop=off
 


         DEFAULT_POLICY_accept=on
 


 else
 


         DEFAULT_POLICY_drop=on
 


         DEFAULT_POLICY_accept=off
 


 fi # }}}
 


 conf_title_varname="conf_title_$varname"
 


 
 


 dialog --clear --title "$TITLE" --radiolist -- "${!conf_title_varname}" 8 50 2 DROP "for secure firewall" $DEFAULT_POLICY_drop ACCEPT "only IYKWYAD" $DEFAULT_POLICY_accept 2> $tempfile
 


 
 


 # handle user input {{{
 # handle user input {{{


 retval=$?
 start_user_input='tempfile=`tempfile 2> /dev/null` || tempfile=/tmp/configure-fw-universal-$$; trap "rm -f $tempfile" 0 1 2 5 15; '


 choice=`cat $tempfile`
 end_user_input='


 
 retval=$?;


 
 choice=`cat $tempfile`;


 case $retval in
 case $retval in


         0)
         0)


         echo "'$choice' chosen for variable $varname."
         echo "\"$choice\" chosen for variable $varname.";


         eval $varname=`cat $tempfile`
         eval "$varname=\"`cat $tempfile`\"";


         ;;
         ;;


         1)
         1)


         echo "Cancel pressed."
         echo "Cancel pressed.";


         exit 1;
         exit 1;


         ;;
         ;;


         255)
         255)


         echo "ESC pressed."
         echo "ESC pressed.";


         ;;
         ;;


 esac
 esac; '


 # }}}
 # }}}


 
 


 
 dialog_width=50


 
 dialog_height=15


 
 


 
 varname=DEFAULT_POLICY # {{{


 
 eval $start_user_input


 
 conf_title="Default IPtables policy"


 
 if [ "x$DEFAULT_POLICY" = "xACCEPT" ]; then


 
         DEFAULT_POLICY_drop=off


 
         DEFAULT_POLICY_accept=on


 
 else


 
         DEFAULT_POLICY_drop=on


 
         DEFAULT_POLICY_accept=off


 
 fi


 
 


 
 dialog --clear --title "$TITLE" --radiolist -- "$varname\n\n$conf_title" $dialog_height $dialog_width 2 DROP "for secure firewall" $DEFAULT_POLICY_drop ACCEPT "only IYKWYAD" $DEFAULT_POLICY_accept 2> $tempfile


 
 


 
 eval $end_user_input # }}}


 
 


 
 varname=ANTISPOOF_IFACE # {{{


 
 eval $start_user_input


 
 conf_title="Interface protected to spoofing. Do NOT add LAN interface here. If you are directly connected to internet, type 'eth0'"


 
 


 
 dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile


 
 


 
 eval $end_user_input # }}}


 
 


 
 varname=TRACEROUTE_IFACE # {{{


 
 eval $start_user_input


 
 conf_title="Usefull with NAT and for power users. Keep empty or type 'eth1'"


 
 


 
 dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile


 
 


 
 eval $end_user_input # }}}


 
 


 
 varname=BANNED_IP # {{{


 
 eval $start_user_input


 
 conf_title="Banned IP addresses - packets from this hosts are DROPPED. Multiple items in form 146.48.97.0/24 are allowed"


 
 


 
 dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile


 
 


 
 eval $end_user_input # }}}


 
 


 
 varname=IFACE_ACCEPT_ALL # {{{


 
 eval $start_user_input


 
 conf_title="ALL packets from these interfaces are accepted. Add only 'lo' interface here. If you know, what you are doing and do you have VPN interfaces, add 'tun+' and 'tap+' interfaces too."


 
 


 
 dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile


 
 


 
 eval $end_user_input # }}}


 
 


 
 


 
 


 #
 #









Legend:


Odstranené z verzie1.1
 


zmenené riadky


 
Pridané vo verzii1.2


















Platon Group <platon@platon.sk> http://platon.sk/
  Vyššie na [Platon] / scripts / shell / firewall
-verzia 1.1, 2005/11/01 02:16:56
+verzia 1.2, 2005/11/01 18:09:33
 Riadok 13
 Riadok 13
 Riadok 13
  # 2005-11-01 - created
  #
- # $Platon$
+ # $Platon: scripts/shell/firewall/configure-fw-universal.sh,v 1.1 2005/11/01 02:16:56 rajo Exp $
  DESC="firewall"
  TITLE="Firewall configurator"
 Riadok 129  RMMOD="$RMMOD"
 Riadok 129  RMMOD="$RMMOD"
 Riadok 129  RMMOD="$RMMOD"
  AWK="$AWK"
  # loopback interface
- LO_IFACE="\${LO_IFACE:=1/lo}"
+ LO_IFACE="\${LO_IFACE:=lo}"
  DEFAULT
  # }}}
+ cat >> $EDIT_CONFIG <<MAIN
+ # Antispoof filter
+ ANTISPOOF_IFACE="$ANTISPOOF_IFACE"
+ # Allow traceroute from interfaces
+ TRACEROUTE_IFACE="$TRACEROUTE_IFACE"
+ # banned IP addresses - packets from this hosts are DROPPED
+ BANNED_IP="$BANNED_IP"
+ # accept all packetes on these interfaces
+ # DO NOT ADD eth0 device here !!!
+ IFACE_ACCEPT_ALL="lo tun+ tap+"
+ # Which ports will be allowed on INPUT (TCP connections)
+ ALL_ACCEPT_INPUT_TCP="22"
+ ALL_ACCEPT_INPUT_UDP="68" # dhcpclient
+ # interface eth0
+ eth0_ACCEPT_INPUT_TCP="123 137 138 139 631 80 443 3128 2220"
+ # interface eth1
+ eth1_ACCEPT_INPUT_TCP="80 6000"
+ # interface ppp0
+ ppp0_ACCEPT_INPUT_TCP=""
+ # Which ports will be allowed on INPUT (UDP connections)
+ # interface eth0
+ eth0_ACCEPT_INPUT_UDP="123 137 138 139 513 631"
+ # interface ppp0
+ ppp0_ACCEPT_INPUT_UDP=""
+ # Package dropping
+ #eth0_DROP_OUTPUT_TCP="123 137 138 139 445 631"
+ #eth0_DROP_OUTPUT_UDP="123 137 138 139 445 631"
+ #eth1_DROP_OUTPUT_TCP=""
+ #eth1_DROP_OUTPUT_UDP=""
+ #
+ # NAT configuration
+ #
+ # eth0 connected to internet
+ #NAT_LAN_IFACE="eth0"
+ # eth1 connected to local subnet
+ #NAT_SUBNET_IFACE="eth1"
+ # logging must be turned on, see LOGGING="on"
+ NAT_LOG_NEW_CONNECTIONS="no"
+ #
+ # Forward configuration
+ #
+ # don't forward Miscrosoft protocols - NOT RFC compliant packets (packets in NEW state withouth SYN flag)
+ NAT_FORWARD_MICROSOFT="no"
+ # redirect all outgoing connections to SMTP port 25 to local server (simple virus/antispam protection)
+ # redirect all outgoing HTTP connection to transparent proxy server (squid)
+ NAT_TCP_PORT_REDIRECT="25:25 80:3128 8080:3128 1080:3128 3128:3128"
+ # forward port 2220 from your firewall/router to local machine port 22 (ssh)
+ # you must accept port 2220 in $eth0_ACCEPT_INPUT_TCP
+ NAT_TCP_PORT_FORWARD="2220:192.168.0.100:22"
+ # NAT only "secure" ports
+ NAT_FORWARD_TCP_PORTS="20 21 22 23 53 113 123 143 194 220 873 992 993 994 995 1241 2401 3306 3690 5190 5432 6000"
+ NAT_FORWARD_UDP_PORTS="20 21 22 23 53 113 123 143 194 220 873 992 993 994 995 1241 2401 3306 3690 5190 5432 6000"
+ #
+ # Deny NAT for clients with this IP
+ #
+ #NAT_CLIENT_DROP="192.168.0.120" # ugly bad boys in your LAN
+ #
+ # ICMP configuration
+ #
+ # (4) Source Quench                     - Incoming & outgoing requests to slow down (flow control)
+ # (12) Parameter Problem        - Incoming & outgoing error messages
+ # (3) Destination Unreachable, Service Unavailable
+ #                                                       - Incoming & outgoing size negotiation, service or
+ #                                                         destination unavailability, final traceroute response
+ # (11) Time Exceeded            - Incoming & outgoing timeout conditions, also intermediate TTL response to traceroutes
+ # (0 | 8) Allow OUTPUT pings to anywhere
+ # default: echo-reply destination-unreachable echo-request time-exceeded fragmentation-needed
+ ACCEPT_ICMP_PACKETS="echo-reply destination-unreachable echo-request time-exceeded fragmentation-needed"
+ MAIN
  # footer {{{
  cat >> $EDIT_CONFIG <<FOOT
-Riadok 146  FOOT
+Riadok 231  FOOT
 Riadok 146  FOOT
 Riadok 231  FOOT
  # }}}
  } # }}}
- tempfile=`tempfile 2> /dev/null` || tempfile=/tmp/configure-fw-universal-$$
- trap "rm -f $tempfile" 0 1 2 5 15
- varname=DEFAULT_POLICY
- conf_title_DEFAULT_POLICY="Default IPtables policy"
- if [ "x$DEFAULT_POLICY" = "xACCEPT" ]; then # {{{
-         DEFAULT_POLICY_drop=off
-         DEFAULT_POLICY_accept=on
- else
-         DEFAULT_POLICY_drop=on
-         DEFAULT_POLICY_accept=off
- fi # }}}
- conf_title_varname="conf_title_$varname"
- dialog --clear --title "$TITLE" --radiolist -- "${!conf_title_varname}" 8 50 2 DROP "for secure firewall" $DEFAULT_POLICY_drop ACCEPT "only IYKWYAD" $DEFAULT_POLICY_accept 2> $tempfile
  # handle user input {{{
- retval=$?
+ start_user_input='tempfile=`tempfile 2> /dev/null` || tempfile=/tmp/configure-fw-universal-$$; trap "rm -f $tempfile" 0 1 2 5 15; '
- choice=`cat $tempfile`
+ end_user_input='
+ retval=$?;
+ choice=`cat $tempfile`;
  case $retval in
 )
-         echo "'$choice' chosen for variable $varname."
+         echo "\"$choice\" chosen for variable $varname.";
-         eval $varname=`cat $tempfile`
+         eval "$varname=\"`cat $tempfile`\"";
          ;;
 )
-         echo "Cancel pressed."
+         echo "Cancel pressed.";
          exit 1;
          ;;
 )
-         echo "ESC pressed."
+         echo "ESC pressed.";
          ;;
- esac
+ esac; '
  # }}}
+ dialog_width=50
+ dialog_height=15
+ varname=DEFAULT_POLICY # {{{
+ eval $start_user_input
+ conf_title="Default IPtables policy"
+ if [ "x$DEFAULT_POLICY" = "xACCEPT" ]; then
+         DEFAULT_POLICY_drop=off
+         DEFAULT_POLICY_accept=on
+ else
+         DEFAULT_POLICY_drop=on
+         DEFAULT_POLICY_accept=off
+ fi
+ dialog --clear --title "$TITLE" --radiolist -- "$varname\n\n$conf_title" $dialog_height $dialog_width 2 DROP "for secure firewall" $DEFAULT_POLICY_drop ACCEPT "only IYKWYAD" $DEFAULT_POLICY_accept 2> $tempfile
+ eval $end_user_input # }}}
+ varname=ANTISPOOF_IFACE # {{{
+ eval $start_user_input
+ conf_title="Interface protected to spoofing. Do NOT add LAN interface here. If you are directly connected to internet, type 'eth0'"
+ dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile
+ eval $end_user_input # }}}
+ varname=TRACEROUTE_IFACE # {{{
+ eval $start_user_input
+ conf_title="Usefull with NAT and for power users. Keep empty or type 'eth1'"
+ dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile
+ eval $end_user_input # }}}
+ varname=BANNED_IP # {{{
+ eval $start_user_input
+ conf_title="Banned IP addresses - packets from this hosts are DROPPED. Multiple items in form 146.48.97.0/24 are allowed"
+ dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile
+ eval $end_user_input # }}}
+ varname=IFACE_ACCEPT_ALL # {{{
+ eval $start_user_input
+ conf_title="ALL packets from these interfaces are accepted. Add only 'lo' interface here. If you know, what you are doing and do you have VPN interfaces, add 'tun+' and 'tap+' interfaces too."
+ dialog --clear --title "$TITLE" --inputbox -- "$varname\n\n$conf_title" $dialog_height $dialog_width "${!varname}" 2> $tempfile
+ eval $end_user_input # }}}
  #
 Legend:


Odstranené z verzie1.1
 


zmenené riadky


 
Pridané vo verzii1.2
 Legend:


Odstranené z verzie1.1
 


zmenené riadky


 
Pridané vo verzii1.2
-Odstranené z verzie1.1
+Pridané vo verzii1.2


Copyright © 2002-2006 Platon Group Stránka používa redakčný systém Metafox	Na začiatok