Ubuntu-Forum & Kubuntu-Forum | www.Ubuntu-Forum.de

Quellcode

#!/bin/sh 
#
#  This is automatically generated file. DO NOT MODIFY !
#
#  Firewall Builder  fwb_ipt v2.1.11-1 
#
#  Generated Mon Dec 10 10:44:58 2007 CET by me
#
# files: * fw.fw
#
#
#  
#
#
#


PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
export PATH

LSMOD="/sbin/lsmod"
MODPROBE="/sbin/modprobe"
IPTABLES="/sbin/iptables"
IPTABLES_RESTORE="/sbin/iptables-restore"
IP="/sbin/ip"
LOGGER="/usr/bin/logger"


#
# Prolog script
#

#
# End of prolog script
#

log() {
  echo "$1"
  test -x "$LOGGER" && $LOGGER -p info "$1"
}

check_file() {
  test -r "$2" || {
    echo "Can not find file $2 referenced by AddressTable object $1"
    exit 1
  }
}

va_num=1
add_addr() {
  addr=$1
  nm=$2
  dev=$3

  type=""
  aadd=""

  L=`$IP -4 link ls $dev | head -n1`
  if test -n "$L"; then
    OIFS=$IFS
    IFS=" /:,<"
    set $L
    type=$4
    IFS=$OIFS

    L=`$IP -4 addr ls $dev to $addr | grep inet | grep -v :`
    if test -n "$L"; then
      OIFS=$IFS
      IFS=" /"
      set $L
      aadd=$2
      IFS=$OIFS
    fi
  fi
  if test -z "$aadd"; then
    if test "$type" = "POINTOPOINT"; then
      $IP -4 addr add $addr dev $dev scope global label $dev:FWB${va_num}
      va_num=`expr $va_num + 1`
    fi
    if test "$type" = "BROADCAST"; then
      $IP -4 addr add $addr/$nm dev $dev brd + scope global label $dev:FWB${va_num}
      va_num=`expr $va_num + 1`
    fi
  fi
}

getInterfaceVarName() {
  echo $1 | sed 's/\./_/'
}

getaddr() {
  dev=$1
  name=$2
  L=`$IP -4 addr show dev $dev | grep inet | grep -v :`
  test -z "$L" && { 
    eval "$name=''"
    return
  }
  OIFS=$IFS
  IFS=" /"
  set $L
  eval "$name=$2"
  IFS=$OIFS
}


getinterfaces() {
  NAME=$1
  $IP link show | grep ": $NAME" | while read L; do
    OIFS=$IFS
    IFS=" :"
    set $L
    IFS=$OIFS
    echo $2
  done
}


# increment ip address
incaddr()
{
  n1=$4
  n2=$3
  n3=$2
  n4=$1

  vn1=`eval  "echo \\$$n1"`

  R=`expr $vn1 \< 255`
  if test $R = "1"; then
    eval "$n1=`expr $vn1 + 1`"
  else
    eval "$n1=0"
    incaddr XX $n4 $n3 $n2
  fi
}

if $IP link ls >/dev/null 2>&1; then
  echo;
else
  echo "iproute not found"
  exit 1
fi



MODULES_DIR="/lib/modules/`uname -r`/kernel/net/"
MODULES=`find $MODULES_DIR -name '*conntrack*'  |  sed -e 's/\.[^\.]*$//' -e 's/^.*\///'`
for module in $MODULES; do 
  if $LSMOD | grep ${module} >/dev/null; then continue; fi
  $MODPROBE ${module} ||  exit 1 
done


# Using 0 address table files


INTERFACES="eth0 "
for i in $INTERFACES ; do
  $IP link show "$i" > /dev/null 2>&1 || {
    log "Interface $i does not exist"
    exit 1
  }
done


# Configure interfaces



getaddr eth0  i_eth0

# Add virtual addresses for NAT rules


log 'Activating firewall script generated Mon Dec 10 10:44:58 2007  by muellert in /root/firewall.fw'

$IPTABLES -P OUTPUT  DROP
$IPTABLES -P INPUT   DROP
$IPTABLES -P FORWARD DROP
ip6tables -L -n > /dev/null 2>&1 && {
  ip6tables -P OUTPUT  DROP
  ip6tables -P INPUT   DROP
  ip6tables -P FORWARD DROP
}



cat /proc/net/ip_tables_names | while read table; do
  $IPTABLES -t $table -L -n | while read c chain rest; do
      if test "X$c" = "XChain" ; then
        $IPTABLES -t $table -F $chain
      fi
  done
  $IPTABLES -t $table -X
done


$IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# 
# Rule 0 (global)
# 
echo "Rule 0 (global)"
# 
# 
# 
$IPTABLES -N RULE_0
test -n "$i_eth0" && $IPTABLES -A INPUT -p tcp -m tcp  -s $i_eth0  --dport 6665:6669  -j RULE_0 
test -n "$i_eth0" && $IPTABLES -A INPUT -p tcp -m tcp  -s $i_eth0  --dport 6667  -j RULE_0 
test -n "$i_eth0" && $IPTABLES -A OUTPUT -p tcp -m tcp  -s $i_eth0  --dport 6665:6669  -j RULE_0 
test -n "$i_eth0" && $IPTABLES -A OUTPUT -p tcp -m tcp  -s $i_eth0  --dport 6667  -j RULE_0 
$IPTABLES -A RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- DENY "
$IPTABLES -A RULE_0  -j DROP 
# 
# Rule 1 (global)
# 
echo "Rule 1 (global)"
# 
# 
# 
$IPTABLES -A OUTPUT  -m state --state NEW  -j ACCEPT 
$IPTABLES -A INPUT  -m state --state NEW  -j ACCEPT 
$IPTABLES -A FORWARD  -m state --state NEW  -j ACCEPT 
#
#
echo 1 > /proc/sys/net/ipv4/ip_forward


#
# Epilog script
#


# End of epilog script
#