Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.
- Update firewall scripts and shared conf files from firewall/ipt-server
(HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
bash variables, fall back to IPv6 for shared variables and warn if IPv4
and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
(<short-hostname>-ipt-server.yml) and new variables.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -10,8 +10,10 @@
|
||||
# -
|
||||
# -
|
||||
# - Note:
|
||||
# - - If no mask is given mask will be set to '64'
|
||||
# - - If no mask is given mask will be set to 'ban_ipv6_mask' (main_ipv6.conf),
|
||||
# - default is '128'
|
||||
# - - wrong addresses like '2g01::1' or '2a01::1/129' will be ignored
|
||||
# - - entries covering an own (global) address of this host will be ignored
|
||||
# -
|
||||
# - Example:
|
||||
# - 240e:ec:4ab1:feba:e8b4:4fb1:7984:4c
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
# --- Default Parameter / Options
|
||||
# -------------
|
||||
|
||||
default_per_IP_connection_limit=111
|
||||
default_per_IP_connection_limit=250
|
||||
|
||||
|
||||
# -------------
|
||||
@@ -56,8 +56,9 @@ standard_prometheus_ports="9100,9256"
|
||||
|
||||
# - Mattermost (MM) Service
|
||||
# -
|
||||
stansard_mattermost_udp_ports_in="8443"
|
||||
stansard_mattermost_udp_ports_out="3478"
|
||||
standard_mattermost_udp_ports_in="8443"
|
||||
standard_mattermost_tcp_ports_in="8443"
|
||||
standard_mattermost_udp_ports_out="3478"
|
||||
|
||||
# - IPsec - Internet Security Association and
|
||||
# - Key Management Protocol
|
||||
@@ -70,6 +71,37 @@ standard_ipsec_nat_t=4500
|
||||
standard_http_ports="80,443"
|
||||
standard_mailuser_ports="587,465,110,995,143,993"
|
||||
|
||||
|
||||
# ip6t-firewall-server:
|
||||
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
|
||||
#
|
||||
throttle_tcp6_mss_for_https=false
|
||||
min_tcp6_mss_for_https_val=1280
|
||||
|
||||
# ip6t-firewall-server,ipt-firewall-server:
|
||||
# some restrictions on HTTP connections to counteract attacks.
|
||||
#
|
||||
# The default value used to be set to '30'
|
||||
#
|
||||
set_max_new_http_conn_per_ip_per_second=true
|
||||
default_max_http_new_conn_per_ip_per_second=200
|
||||
|
||||
# The default value used to be set to '50'
|
||||
#
|
||||
set_max_concurrent_http_conn_per_ip=true
|
||||
default_max_concurrent_http_conn_per_ip=100
|
||||
|
||||
# The default value used to be set to '200'
|
||||
#
|
||||
set_max_new_http_conn_per_second=true
|
||||
default_max_new_http_conn_per_second=400
|
||||
|
||||
# ip6t-firewall-server:
|
||||
# Prefix length for entries in 'ban_ipv6.list' given without mask.
|
||||
#
|
||||
default_ban_ipv6_mask=128
|
||||
|
||||
|
||||
# - Dovecot Service
|
||||
# -
|
||||
dovecot_external_auth_port="44444"
|
||||
@@ -85,20 +117,20 @@ default_jitsi_dovecout_auth_port="$dovecot_external_auth_port"
|
||||
default_jibri_out_port=5222
|
||||
# default_outbound_streaming_tcp_ports
|
||||
#
|
||||
# - outbound port 1935/TCP : outbound streaming over RTMP to most
|
||||
# - outbound port 1935/TCP : outbound streaming over RTMP to most
|
||||
# streaming providers such as YouTube Live, Vimeo or Twitch
|
||||
#
|
||||
# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn
|
||||
# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn
|
||||
# Live (port 1935 is also used for RTMP streaming to LinkedIn)
|
||||
#
|
||||
# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
|
||||
# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
|
||||
# RTMPS to LinkedIn Live
|
||||
#
|
||||
# - outbound port 443/TCP (HTTPS) : used for authentication with the
|
||||
# built-in providers such as YouTube Live, Facebook Live, Ustream,
|
||||
# - outbound port 443/TCP (HTTPS) : used for authentication with the
|
||||
# built-in providers such as YouTube Live, Facebook Live, Ustream,
|
||||
# Livestream, and Twitch
|
||||
#
|
||||
# - outbound port 53/UDP (DNS) used for DNS lookups converting
|
||||
# - outbound port 53/UDP (DNS) used for DNS lookups converting
|
||||
# hostnames to IP addresses
|
||||
#
|
||||
default_outbound_streaming_tcp_ports="1935,1936,2935,2396"
|
||||
|
||||
@@ -73,6 +73,54 @@ containsElement () {
|
||||
return 1
|
||||
}
|
||||
|
||||
## - Expand a given IPv6 address (parameter 1) to 32 hex digits without colons.
|
||||
## - Returns 1 if the address cannot be parsed.
|
||||
## -
|
||||
ipv6_expand() {
|
||||
local _addr="${1,,}"
|
||||
local _head _tail _group _n _out=""
|
||||
local -a _h=() _t=()
|
||||
|
||||
if [[ "$_addr" == *::* ]] ; then
|
||||
_head="${_addr%%::*}"
|
||||
_tail="${_addr#*::}"
|
||||
[[ "$_tail" == *::* ]] && return 1
|
||||
[[ -n "$_head" ]] && IFS=':' read -ra _h <<< "$_head"
|
||||
[[ -n "$_tail" ]] && IFS=':' read -ra _t <<< "$_tail"
|
||||
_n=$(( 8 - ${#_h[@]} - ${#_t[@]} ))
|
||||
[[ $_n -lt 1 ]] && return 1
|
||||
for (( ; _n > 0; _n-- )) ; do
|
||||
_h+=("0")
|
||||
done
|
||||
_h+=("${_t[@]}")
|
||||
else
|
||||
IFS=':' read -ra _h <<< "$_addr"
|
||||
fi
|
||||
|
||||
[[ ${#_h[@]} -eq 8 ]] || return 1
|
||||
for _group in "${_h[@]}" ; do
|
||||
[[ "$_group" =~ ^[0-9a-f]{1,4}$ ]] || return 1
|
||||
_out+="$(printf '%04x' "0x$_group")"
|
||||
done
|
||||
|
||||
echo "$_out"
|
||||
}
|
||||
|
||||
## - Check if a given IPv6 address (parameter 1) lies within the network
|
||||
## - given by address (parameter 2) and prefix length (parameter 3).
|
||||
## -
|
||||
ipv6_in_net() {
|
||||
local _a _n _full _rest
|
||||
_a="$(ipv6_expand "$1")" || return 1
|
||||
_n="$(ipv6_expand "$2")" || return 1
|
||||
_full=$(( $3 / 4 ))
|
||||
_rest=$(( $3 % 4 ))
|
||||
|
||||
[[ "${_a:0:_full}" == "${_n:0:_full}" ]] || return 1
|
||||
[[ $_rest -eq 0 ]] && return 0
|
||||
(( (0x${_a:_full:1} >> (4 - _rest)) == (0x${_n:_full:1} >> (4 - _rest)) ))
|
||||
}
|
||||
|
||||
is_number() {
|
||||
|
||||
return $(test ! -z "${1##*[!0-9]*}" > /dev/null 2>&1);
|
||||
|
||||
@@ -60,7 +60,7 @@ done
|
||||
# ---
|
||||
declare -a ext_ip_arr
|
||||
for _ip in $ext_ips ; do
|
||||
host_ip_arr+=("$_ip")
|
||||
ext_ip_arr+=("$_ip")
|
||||
done
|
||||
|
||||
# ---
|
||||
|
||||
@@ -448,6 +448,29 @@ fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - ICMPv6 Neighbor Discovery and Packet Too Big
|
||||
# ---
|
||||
# Accept these before any rule blocking by source address (blocked_ips,
|
||||
# ban_ipv6.list). Otherwise a blocked network containing a router of the
|
||||
# own link breaks neighbor discovery - the router can no longer reach this host.
|
||||
#
|
||||
# 2 = packet-too-big
|
||||
# 133= router-solicitation
|
||||
# 134= router-advertisement
|
||||
# 135= neighbor-solicitation
|
||||
# 136= neighbor-advertisement
|
||||
# ---
|
||||
echononl "\tICMPv6 neighbor discovery / packet-too-big (before blocking rules).."
|
||||
for t in 2 133 134 135 136 ; do
|
||||
$ip6t -A INPUT -p ipv6-icmp --icmpv6-type $t -j ACCEPT
|
||||
done
|
||||
if $kernel_forward_between_interfaces ; then
|
||||
$ip6t -A FORWARD -p ipv6-icmp --icmpv6-type 2 -j ACCEPT
|
||||
fi
|
||||
echo_done
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Block IPs / Networks / Interfaces
|
||||
# -------------
|
||||
@@ -509,6 +532,19 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
|
||||
declare -a ban_ipv6_arr=()
|
||||
declare -a no_valid_ipv6=()
|
||||
declare -a own_ipv6_banned_arr=()
|
||||
|
||||
if [[ -z "$ban_ipv6_mask" || ! "$ban_ipv6_mask" =~ ^[0-9]+$ ]] || [[ $ban_ipv6_mask -gt 128 ]] ; then
|
||||
ban_ipv6_mask=${default_ban_ipv6_mask:-128}
|
||||
fi
|
||||
|
||||
# Own global IPv6 addresses (read at runtime, also covers SLAAC addresses).
|
||||
# Entries covering one of them would block the own prefix including its routers.
|
||||
#
|
||||
declare -a own_ipv6_arr=()
|
||||
for _own_ip in $(ip -6 -o addr show scope global | awk '{split($4, a, "/"); print a[1]}') ; do
|
||||
own_ipv6_arr+=("$_own_ip")
|
||||
done
|
||||
|
||||
# Regex valid ipv6 address
|
||||
#
|
||||
@@ -568,7 +604,7 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
fi
|
||||
fi
|
||||
else
|
||||
mask=64
|
||||
mask=$ban_ipv6_mask
|
||||
is_valid_mask=true
|
||||
fi
|
||||
|
||||
@@ -586,6 +622,22 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
# Never ban a network containing an own address
|
||||
#
|
||||
_covers_own_ip=false
|
||||
for _own_ip in "${own_ipv6_arr[@]}" ; do
|
||||
if ipv6_in_net "$_own_ip" "$ipv6" "$mask" ; then
|
||||
_covers_own_ip=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
if $_covers_own_ip ; then
|
||||
if ! containsElement "$_ip" "${own_ipv6_banned_arr[@]}" ; then
|
||||
own_ipv6_banned_arr+=("$_ip")
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
if $log_blocked_ip || $log_all ; then
|
||||
$ip6t -A INPUT -i $_dev -s $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Blocked by ban_ipv6.list: "
|
||||
@@ -614,6 +666,9 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
if [[ ${#no_valid_ipv6_arr[@]} -gt 0 ]]; then
|
||||
warn "Ignored: ${no_valid_ipv6_arr[@]}"
|
||||
fi
|
||||
if [[ ${#own_ipv6_banned_arr[@]} -gt 0 ]]; then
|
||||
warn "Ignored (covers own address): ${own_ipv6_banned_arr[@]}"
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
@@ -644,6 +699,59 @@ echo_skipped
|
||||
#echo_done
|
||||
|
||||
|
||||
# ---
|
||||
# - IPv6 TCP MSS adjustment for incoming HTTPS connections
|
||||
# ---
|
||||
# The IPv6 path MTU can be smaller than the interface MTU.
|
||||
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
|
||||
# This prevents oversized TCP segments in server responses.
|
||||
#
|
||||
# Tested on oolm-shop on 2026-10-26.
|
||||
# ---
|
||||
|
||||
echononl "\tAdjust IPv6 TCP MSS for HTTPS connections"
|
||||
|
||||
if $throttle_tcp6_mss_for_https ; then
|
||||
|
||||
if [[ -n "$tcp6_mss_for_https_val" ]] ; then
|
||||
|
||||
# Notice:
|
||||
#
|
||||
# - take care 'tcp6_mss_for_https_val' consists only of digits (is a natural number)
|
||||
#
|
||||
# - 1280 is the minimum IPv6 packet size that all routers must be able to process
|
||||
#
|
||||
if [[ "$tcp6_mss_for_https_val" =~ ^[0-9]+$ ]] ; then
|
||||
|
||||
if [[ "$tcp6_mss_for_https_val" -lt 1280 ]]; then
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
fi
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
$ip6t -t mangle -A PREROUTING -i $_dev \
|
||||
-p tcp --dport 443 \
|
||||
--tcp-flags SYN,RST SYN \
|
||||
-j TCPMSS --set-mss $tcp6_mss_for_https_val
|
||||
done
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# Drop TCP packets that are new and are not SYN
|
||||
# ---
|
||||
@@ -709,13 +817,18 @@ echo_done
|
||||
# ---
|
||||
|
||||
echononl "\tBlock spoofed (own ip) packets"
|
||||
|
||||
# Note:
|
||||
# Exclude loopback - local traffic to an own address (e.g. a web application
|
||||
# requesting its own domain) passes PREROUTING via 'lo' with src = dst.
|
||||
#
|
||||
if $log_spoofed || $log_all ; then
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
$ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
done
|
||||
fi
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
|
||||
$ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
|
||||
done
|
||||
echo_done
|
||||
|
||||
@@ -2057,6 +2170,134 @@ echo_done
|
||||
# - HTTP(S) (local) Webserver
|
||||
# ---
|
||||
|
||||
echo ""
|
||||
|
||||
# Note:
|
||||
# The following rules only DROP/REJECT excess connections - they never ACCEPT.
|
||||
# Ports are opened exclusively by the rules for 'http_server_ips' below.
|
||||
# Without local webserver (empty 'http_server_ips') no rules are created.
|
||||
#
|
||||
echononl "\t\tA maximum number new connections per second per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_ip_per_second ; then
|
||||
|
||||
if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6_log --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 'max_http_new_conn_per_ip_per_second' neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of concurrent TCP connections per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_concurrent_http_conn_per_ip ; then
|
||||
|
||||
if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 'max_concurrent_http_conn_per_ip' parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv6-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of new TCP handshakes per second."
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_second ; then
|
||||
|
||||
if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_new_http_conn_per_second=$default_max_new_http_conn_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
|
||||
|
||||
# SYN-Rate begrenzen (global, alle Quell-IPs zusammen)
|
||||
#
|
||||
# hashlimit ohne '--hashlimit-mode' verwendet einen einzigen Bucket für alle
|
||||
# Pakete. SYN-Pakete oberhalb des Limits werden gedroppt; alles darunter
|
||||
# läuft weiter zu den Regeln für 'http_server_ips' (kein ACCEPT hier!).
|
||||
#
|
||||
# Kurzfristig auch bis zu 'burst_max_new_http_conn_per_second' SYN-Pakete erlaubt.
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v6_syn_log \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
fi
|
||||
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v6_syn \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
|
||||
echononl "\t\tHTTP(S) (local) Webserver"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
@@ -2089,12 +2330,22 @@ if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_mm_server_ip_arr[@]} -gt
|
||||
if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip in ${mm_server_ip_arr[@]} ; do
|
||||
$ip6t -A INPUT -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ip6t -A INPUT -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ip6t -A INPUT -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ip6t -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
|
||||
if [[ ${#forward_mm_server_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
for _ip in ${forward_mm_server_ip_arr[@]} ; do
|
||||
$ip6t -A FORWARD -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ip6t -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ip6t -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ip6t -A FORWARD -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
fi
|
||||
|
||||
@@ -814,13 +814,18 @@ echo_done
|
||||
# ---
|
||||
|
||||
echononl "\tBlock spoofed (own ip) packets"
|
||||
|
||||
# Note:
|
||||
# Exclude loopback - local traffic to an own address (e.g. a web application
|
||||
# requesting its own domain) passes PREROUTING via 'lo' with src = dst.
|
||||
#
|
||||
if $log_spoofed || $log_all ; then
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
$ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
done
|
||||
fi
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
|
||||
$ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
|
||||
done
|
||||
echo_done
|
||||
|
||||
@@ -2241,6 +2246,134 @@ echo_done
|
||||
# - HTTP(S) (local) Webserver
|
||||
# ---
|
||||
|
||||
echo ""
|
||||
|
||||
# Note:
|
||||
# The following rules only DROP/REJECT excess connections - they never ACCEPT.
|
||||
# Ports are opened exclusively by the rules for 'http_server_ips' below.
|
||||
# Without local webserver (empty 'http_server_ips') no rules are created.
|
||||
#
|
||||
echononl "\t\tA maximum number new connections per second per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_ip_per_second ; then
|
||||
|
||||
if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v4_log --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 'max_http_new_conn_per_ip_per_second' neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v4 --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of concurrent TCP connections per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_concurrent_http_conn_per_ip ; then
|
||||
|
||||
if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 32 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 'max_concurrent_http_conn_per_ip' parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 32)
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 32 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of new TCP handshakes per second."
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_second ; then
|
||||
|
||||
if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_new_http_conn_per_second=$default_max_new_http_conn_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
|
||||
|
||||
# SYN-Rate begrenzen (global, alle Quell-IPs zusammen)
|
||||
#
|
||||
# hashlimit ohne '--hashlimit-mode' verwendet einen einzigen Bucket für alle
|
||||
# Pakete. SYN-Pakete oberhalb des Limits werden gedroppt; alles darunter
|
||||
# läuft weiter zu den Regeln für 'http_server_ips' (kein ACCEPT hier!).
|
||||
#
|
||||
# Kurzfristig auch bis zu 'burst_max_new_http_conn_per_second' SYN-Pakete erlaubt.
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v4_syn_log \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
fi
|
||||
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v4_syn \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
|
||||
echononl "\t\tHTTP(S) (local) Webserver"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
@@ -2273,12 +2406,22 @@ if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_mm_server_ip_arr[@]} -gt
|
||||
if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip in ${mm_server_ip_arr[@]} ; do
|
||||
$ipt -A INPUT -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ipt -A INPUT -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ipt -A INPUT -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ipt -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
|
||||
if [[ ${#forward_mm_server_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
for _ip in ${forward_mm_server_ip_arr[@]} ; do
|
||||
$ipt -A FORWARD -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ipt -A FORWARD -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user