Advanced blocking added

master
bbruns 2010-10-06 18:23:08 +00:00
parent 83b3f05fc8
commit 8840c3c630
5 changed files with 65 additions and 5 deletions

View File

@ -6,6 +6,9 @@
- Cleanups
- No longer display list of blocked IPs, considering if they are
as long as my list is, they'll take 4 pages to display...
- New block file format, much more capable now, thanks to
an hour or two of improving my bash scripting skills to the
point where I can do more complex breakdowns of formats
0.9.7 - Brielle Bruns <bruns@2mbit.com>
- Support for marking packets, uses new config file and

View File

@ -139,8 +139,54 @@ if [ $BLOCKEDIP ]; then
display_c YELLOW "Adding blocked IPs... "
for i in `grep -v "\#" $BLOCKEDIP`; do
#echo -n "$i "
$IPTABLES -A INPUT -s $i -j DROP
$IPTABLES -A OUTPUT -d $i -j DROP
if [[ "$i" =~ ":" ]]; then
IFS_OLD=${IFS};IFS=:
ADVBLKIP=($BLOCK)
IFS=${IFS_OLD}
SRCIF=${ADVBLKIP[0]}
SRCIP=${ADVBLKIP[1]}
SRCPORT=${ADVBLKIP[2]}
DSTIF=${ADVBLKIP[3]}
DSTIP=${ADVBLKIP[4]}
DSTPORT=${ADVBLKIP[5]}
DIRECTION=${ADVBLKIP[6]}
PROTO=${ADVBLKIP[7]}
if [ "$SRCIF" ]; then
SRCIF="-i ${SRCIF} "
fi
if [ "$SRCIP" ]; then
SRCIP="-s ${SRCIP} "
fi
if [ "$SRCPORT" ]; then
SRCPORT="--sport ${SRCPORT/-/:} "
fi
if [ "$DSTIF" ]; then
DSTIF="-o ${DSTIF} "
fi
if [ "$DSTIP" ]; then
DSTIP="-d ${DSTIP} "
fi
if [ "$DSTPORT" ]; then
DSTPORT="--dport ${DSTPORT/-/:} "
fi
if [ "$PROTO" ]; then
case $PROTO in
TCP|tcp) PROTO="-p tcp";;
UDP|udp) PROTO="-p udp";;
*) PROTO="-p ${PROTO}";;
esac
fi
case $DIRECTION in
IN) DIRECTION="INPUT" ;;
OUT) DIRECTION="OUTPUT" ;;
FWD) DIRECTION="FORWARD" ;;
*) DIRECTION="INPUT" ;;
esac
${IPTABLES} -A ${DIRECTION} ${SRCIF} ${SRCIP} ${SRCPORT} ${DSTIF} ${DSTIP} ${DSTPORT} ${PROTO} -j DROP"
else
$IPTABLES -A INPUT -s $i -j DROP
$IPTABLES -A OUTPUT -d $i -j DROP
fi
done
fi
@ -385,7 +431,7 @@ if [ -s "$BASEDIR/include/ipv4_custom_portforward" ]; then
. "$BASEDIR/include/ipv4_custom_portforward"
fi
if [ $PORTFW ] && [ $NAT ]; then
if [ "$PORTFW" ] && [ "$NAT" ]; then
display_c YELLOW "Adding port forward for:"
for i in `grep -v "\#" $PORTFW`; do
PORTADD=( ${i//:/ } )

View File

@ -1 +0,0 @@
# List of IPs to block outright

10
ipv4-blocked.default Normal file
View File

@ -0,0 +1,10 @@
# List of IPs to block outright
# Two formats:
# 1) One IP or range per line
# 2) One ip or range per line with added specific IN/OUT/FWD and TCP/UDP port (added in 0.9.8)
# <SRC IF>:<SRC IP>:<SRC PORT RNG>:<DST IF>:<DST IP>:<DST PORT RNG>:<IN/OUT/FWD>:<PROTO>
# One can leave out <SRC IF> <SRC IP> <SRC PORT RNG> <DST IF> <DST IP> <DST PORT RNG>
# if you want to apply to all ports/interfaces/etc
# Example:
# - Block SRC of eth1 192.168.0.5:80 from contacting DST eth0 192.168.1.10:20 through 21, TCP
# eth1:192.168.0.5:80:eth0:192.168.1.10:20-21:IN:TCP

View File

@ -89,9 +89,11 @@ HACK_IPV4="NS-IN-DDOS"
#NAT_RANGE=
# IP Ranges to block all traffic incoming/outgoing
BLOCKEDIP=$BASEDIR/blocked
# New functionality in 0.9.8 obsoletes BLOCKTCPPORTS and BLOCKUDPPORTS
BLOCKEDIP=$BASEDIR/ipv4-blocked
# Block outgoing traffic on these TCP/UDP ports
# Obsoleted: Use BLOCKEDIP above in new format. Going away in 1.0
#BLOCKTCPPORTS="6881"
#BLOCKUDPPORTS="6881"