@@ -1,5 +1,8 @@ | |||
2.00 Alpha 3 - | |||
- (Hopefully) Resolved UDP reply issue with conntracking and default DROP | |||
- Give people knobs to tinker with regarding state matching. Kills | |||
multiple birds with one stone. | |||
- forward.conf | |||
2.00 Alpha 2 - 04/12/2014 | |||
@@ -19,7 +19,7 @@ | |||
# along with this program. If not, see <http://www.gnu.org/licenses/>. | |||
# Static config options, normally do not need to change | |||
FW_VERSION="2.0 Alpha 2" | |||
FW_VERSION="2.0 Alpha 3" | |||
# Important directory locations | |||
FWPREFIX="/usr/local" | |||
@@ -2,7 +2,7 @@ | |||
# Use this file to set up more complex access control lists. | |||
# Use tabs or single space to separate | |||
# | |||
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> | |||
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> | |||
# | |||
# Direction: Required ( IN | OUT ) | |||
# Action: Required (ACCEPT | DROP) | |||
@@ -13,9 +13,11 @@ | |||
# Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol ) | |||
# Protocol: Optional, Required if port is specified ( tcp | udp ) | |||
# Syn: Optional, only match (not) syn packets (syn | notsyn ) | |||
# State: Optional, set the connection tracking states ( comma separated list ) | |||
# You can use '-' for optional fields | |||
#============================================================ | |||
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> | |||
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> | |||
#IN ACCEPT eth0 10.0.0.1 22 - - tcp - | |||
#IN DROP - - - - 22 tcp syn | |||
@@ -2,7 +2,7 @@ | |||
# Use this file to set up network address translation rules | |||
# Use tabs or single space to separate | |||
# | |||
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> | |||
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> | |||
# | |||
# Action: Required ( ACCEPT | DROP ) | |||
# Source Interface: Optional ( interface name, aka eth0 ) | |||
@@ -16,12 +16,14 @@ | |||
# Destination Port: Optional ( destination port number, or range 1:65535 ) | |||
# Protocol: Optional, required if port numbers specified ( tcp | udp ) | |||
# Syn: Optional, only match (not) syn packets (syn | notsyn ) | |||
# State: Optional, set the connection tracking states ( comma separated list ) | |||
# | |||
# You can use '-' for optional fields | |||
#============================================================ | |||
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> | |||
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> | |||
#ACCEPT eth0 - eth1 - yes | |||
#DROP eth1 192.168.2.0/24 eth0 0/0 no | |||
#DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn | |||
#DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn NEW | |||
#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED | |||
@@ -2,7 +2,7 @@ | |||
# Use this file to set up more complex access control lists. | |||
# Use tabs or single space to separate | |||
# | |||
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> | |||
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> | |||
# | |||
# Direction: Required ( IN | OUT ) | |||
# Action: Required (ACCEPT | DROP) | |||
@@ -13,9 +13,11 @@ | |||
# Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol ) | |||
# Protocol: Optional, Required if port is specified ( tcp | udp ) | |||
# Syn: Optional, only match (not) syn packets (syn | notsyn ) | |||
# State: Optional, set the connection tracking states ( comma separated list ) | |||
# | |||
# You can use '-' for optional fields | |||
#============================================================ | |||
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> | |||
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> | |||
#IN ACCEPT eth0 2002:dead:beef::/64 22 - - tcp - | |||
#IN DROP - - - - 22 tcp syn | |||
@@ -2,7 +2,7 @@ | |||
# Use this file to set up network address translation rules | |||
# Use tabs or single space to separate | |||
# | |||
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> | |||
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> | |||
# | |||
# Action: Required ( ACCEPT | DROP ) | |||
# Source Interface: Optional ( interface name, aka eth0 ) | |||
@@ -16,10 +16,12 @@ | |||
# Destination Port: Optional ( destination port number, or range 1:65535 ) | |||
# Protocol: Optional, required if port numbers specified ( tcp | udp ) | |||
# Syn: Optional, only match (not) syn packets (syn | notsyn ) | |||
# State: Optional, set the connection tracking states ( comma separated list ) | |||
# | |||
# You can use '-' for optional fields | |||
#============================================================ | |||
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> | |||
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> | |||
#ACCEPT eth0 - eth1 - yes | |||
#DROP eth1 2002::/64 eth0 2001::/3 no | |||
#DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn | |||
#DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn | |||
#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED |
@@ -360,14 +360,12 @@ function enable_forwarding { | |||
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading" | |||
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then | |||
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful" | |||
while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn; do | |||
while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn state; do | |||
unset conntrack_state conntrack_udp_new revsrcaddress revdstaddress revdstinterface revsrcinterface revsrcport revdstport | |||
([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" | |||
([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" | |||
[[ ${action} = \#* ]] && continue | |||
[[ -z ${action} ]] && continue | |||
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \ | |||
&& ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn}" && continue | |||
&& ${display} RED "forward.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn} ${state}" && continue | |||
# Do some creative work with variables to make building the iptables rules fairly painless | |||
@@ -378,6 +376,12 @@ function enable_forwarding { | |||
[[ -z ${srcport} ]] && srcport="-" | |||
[[ -z ${protocol} ]] && protocol="-" | |||
[[ -z ${syn} ]] && syn="-" | |||
[[ -z ${state} ]] && state="-" | |||
([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]] && [[ ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" | |||
([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]] && [[ ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ESTABLISHED,RELATED" | |||
([[ ${IP_VERSION} == "ipv4" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]] && [[ ! ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ${state}" | |||
([[ ${IP_VERSION} == "ipv6" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]] && [[ ! ${state} == "-" ]]) && conntrack_state="${M_STATE} ${C_STATE} ${state}" | |||
([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}" | |||
([[ ${bidirectional} == "yes" ]] && [[ ${dstaddress} != "-" ]]) && revdstaddress="-s ${dstaddress}" | |||
@@ -397,7 +401,7 @@ function enable_forwarding { | |||
([[ ${bidirectional} == "yes" ]] && [[ ${dstport} != "-" ]]) && revdstport="--sport ${dstport}" | |||
[[ ${protocol} != "-" ]] && protocol="-p ${protocol}" | |||
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn}" | |||
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${bidirectional} ${srcport} ${dstport} ${protocol} ${syn} ${state}" | |||
# Blank variables that we're not going to use. | |||
[[ ${srcinterface} == "-" ]] && srcinterface="" | |||
@@ -407,14 +411,15 @@ function enable_forwarding { | |||
[[ ${dstport} == "-" ]] && dstport="" | |||
[[ ${srcport} == "-" ]] && srcport="" | |||
[[ ${syn} == "-" ]] && syn="" | |||
[[ ${state} == "-" ]] && state="" | |||
[[ ${protocol} == "-" ]] && protocol="" | |||
[[ ${bidirectional} == "-" ]] && bidirectional="no" | |||
[[ ${action} == "DROP" ]] && conntrack_state="" | |||
${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state}${conntrack_udp_new} -j ${action} | |||
[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state}${conntrack_udp_new} -j ${action} | |||
${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} -j ${action} | |||
[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} -j ${action} | |||
done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" | |||
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" | |||
fi | |||