Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.
- Update firewall scripts and shared conf files from firewall/ipt-server
(HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
bash variables, fall back to IPv6 for shared variables and warn if IPv4
and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
(<short-hostname>-ipt-server.yml) and new variables.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -448,6 +448,29 @@ fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - ICMPv6 Neighbor Discovery and Packet Too Big
|
||||
# ---
|
||||
# Accept these before any rule blocking by source address (blocked_ips,
|
||||
# ban_ipv6.list). Otherwise a blocked network containing a router of the
|
||||
# own link breaks neighbor discovery - the router can no longer reach this host.
|
||||
#
|
||||
# 2 = packet-too-big
|
||||
# 133= router-solicitation
|
||||
# 134= router-advertisement
|
||||
# 135= neighbor-solicitation
|
||||
# 136= neighbor-advertisement
|
||||
# ---
|
||||
echononl "\tICMPv6 neighbor discovery / packet-too-big (before blocking rules).."
|
||||
for t in 2 133 134 135 136 ; do
|
||||
$ip6t -A INPUT -p ipv6-icmp --icmpv6-type $t -j ACCEPT
|
||||
done
|
||||
if $kernel_forward_between_interfaces ; then
|
||||
$ip6t -A FORWARD -p ipv6-icmp --icmpv6-type 2 -j ACCEPT
|
||||
fi
|
||||
echo_done
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Block IPs / Networks / Interfaces
|
||||
# -------------
|
||||
@@ -509,6 +532,19 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
|
||||
declare -a ban_ipv6_arr=()
|
||||
declare -a no_valid_ipv6=()
|
||||
declare -a own_ipv6_banned_arr=()
|
||||
|
||||
if [[ -z "$ban_ipv6_mask" || ! "$ban_ipv6_mask" =~ ^[0-9]+$ ]] || [[ $ban_ipv6_mask -gt 128 ]] ; then
|
||||
ban_ipv6_mask=${default_ban_ipv6_mask:-128}
|
||||
fi
|
||||
|
||||
# Own global IPv6 addresses (read at runtime, also covers SLAAC addresses).
|
||||
# Entries covering one of them would block the own prefix including its routers.
|
||||
#
|
||||
declare -a own_ipv6_arr=()
|
||||
for _own_ip in $(ip -6 -o addr show scope global | awk '{split($4, a, "/"); print a[1]}') ; do
|
||||
own_ipv6_arr+=("$_own_ip")
|
||||
done
|
||||
|
||||
# Regex valid ipv6 address
|
||||
#
|
||||
@@ -568,7 +604,7 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
fi
|
||||
fi
|
||||
else
|
||||
mask=64
|
||||
mask=$ban_ipv6_mask
|
||||
is_valid_mask=true
|
||||
fi
|
||||
|
||||
@@ -586,6 +622,22 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
# Never ban a network containing an own address
|
||||
#
|
||||
_covers_own_ip=false
|
||||
for _own_ip in "${own_ipv6_arr[@]}" ; do
|
||||
if ipv6_in_net "$_own_ip" "$ipv6" "$mask" ; then
|
||||
_covers_own_ip=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
if $_covers_own_ip ; then
|
||||
if ! containsElement "$_ip" "${own_ipv6_banned_arr[@]}" ; then
|
||||
own_ipv6_banned_arr+=("$_ip")
|
||||
fi
|
||||
continue
|
||||
fi
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
if $log_blocked_ip || $log_all ; then
|
||||
$ip6t -A INPUT -i $_dev -s $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Blocked by ban_ipv6.list: "
|
||||
@@ -614,6 +666,9 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
|
||||
if [[ ${#no_valid_ipv6_arr[@]} -gt 0 ]]; then
|
||||
warn "Ignored: ${no_valid_ipv6_arr[@]}"
|
||||
fi
|
||||
if [[ ${#own_ipv6_banned_arr[@]} -gt 0 ]]; then
|
||||
warn "Ignored (covers own address): ${own_ipv6_banned_arr[@]}"
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
@@ -644,6 +699,59 @@ echo_skipped
|
||||
#echo_done
|
||||
|
||||
|
||||
# ---
|
||||
# - IPv6 TCP MSS adjustment for incoming HTTPS connections
|
||||
# ---
|
||||
# The IPv6 path MTU can be smaller than the interface MTU.
|
||||
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
|
||||
# This prevents oversized TCP segments in server responses.
|
||||
#
|
||||
# Tested on oolm-shop on 2026-10-26.
|
||||
# ---
|
||||
|
||||
echononl "\tAdjust IPv6 TCP MSS for HTTPS connections"
|
||||
|
||||
if $throttle_tcp6_mss_for_https ; then
|
||||
|
||||
if [[ -n "$tcp6_mss_for_https_val" ]] ; then
|
||||
|
||||
# Notice:
|
||||
#
|
||||
# - take care 'tcp6_mss_for_https_val' consists only of digits (is a natural number)
|
||||
#
|
||||
# - 1280 is the minimum IPv6 packet size that all routers must be able to process
|
||||
#
|
||||
if [[ "$tcp6_mss_for_https_val" =~ ^[0-9]+$ ]] ; then
|
||||
|
||||
if [[ "$tcp6_mss_for_https_val" -lt 1280 ]]; then
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
fi
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
$ip6t -t mangle -A PREROUTING -i $_dev \
|
||||
-p tcp --dport 443 \
|
||||
--tcp-flags SYN,RST SYN \
|
||||
-j TCPMSS --set-mss $tcp6_mss_for_https_val
|
||||
done
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# Drop TCP packets that are new and are not SYN
|
||||
# ---
|
||||
@@ -709,13 +817,18 @@ echo_done
|
||||
# ---
|
||||
|
||||
echononl "\tBlock spoofed (own ip) packets"
|
||||
|
||||
# Note:
|
||||
# Exclude loopback - local traffic to an own address (e.g. a web application
|
||||
# requesting its own domain) passes PREROUTING via 'lo' with src = dst.
|
||||
#
|
||||
if $log_spoofed || $log_all ; then
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
$ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
done
|
||||
fi
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ip6t -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
|
||||
$ip6t -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
|
||||
done
|
||||
echo_done
|
||||
|
||||
@@ -2057,6 +2170,134 @@ echo_done
|
||||
# - HTTP(S) (local) Webserver
|
||||
# ---
|
||||
|
||||
echo ""
|
||||
|
||||
# Note:
|
||||
# The following rules only DROP/REJECT excess connections - they never ACCEPT.
|
||||
# Ports are opened exclusively by the rules for 'http_server_ips' below.
|
||||
# Without local webserver (empty 'http_server_ips') no rules are created.
|
||||
#
|
||||
echononl "\t\tA maximum number new connections per second per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_ip_per_second ; then
|
||||
|
||||
if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6_log --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 'max_http_new_conn_per_ip_per_second' neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of concurrent TCP connections per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_concurrent_http_conn_per_ip ; then
|
||||
|
||||
if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 'max_concurrent_http_conn_per_ip' parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv6-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of new TCP handshakes per second."
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_second ; then
|
||||
|
||||
if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_new_http_conn_per_second=$default_max_new_http_conn_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
|
||||
|
||||
# SYN-Rate begrenzen (global, alle Quell-IPs zusammen)
|
||||
#
|
||||
# hashlimit ohne '--hashlimit-mode' verwendet einen einzigen Bucket für alle
|
||||
# Pakete. SYN-Pakete oberhalb des Limits werden gedroppt; alles darunter
|
||||
# läuft weiter zu den Regeln für 'http_server_ips' (kein ACCEPT hier!).
|
||||
#
|
||||
# Kurzfristig auch bis zu 'burst_max_new_http_conn_per_second' SYN-Pakete erlaubt.
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v6_syn_log \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
fi
|
||||
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v6_syn \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
|
||||
echononl "\t\tHTTP(S) (local) Webserver"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
@@ -2089,12 +2330,22 @@ if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_mm_server_ip_arr[@]} -gt
|
||||
if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip in ${mm_server_ip_arr[@]} ; do
|
||||
$ip6t -A INPUT -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ip6t -A INPUT -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ip6t -A INPUT -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ip6t -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
|
||||
if [[ ${#forward_mm_server_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
for _ip in ${forward_mm_server_ip_arr[@]} ; do
|
||||
$ip6t -A FORWARD -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ip6t -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ip6t -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ip6t -A FORWARD -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
fi
|
||||
|
||||
@@ -814,13 +814,18 @@ echo_done
|
||||
# ---
|
||||
|
||||
echononl "\tBlock spoofed (own ip) packets"
|
||||
|
||||
# Note:
|
||||
# Exclude loopback - local traffic to an own address (e.g. a web application
|
||||
# requesting its own domain) passes PREROUTING via 'lo' with src = dst.
|
||||
#
|
||||
if $log_spoofed || $log_all ; then
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
$ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofed (own ip): "
|
||||
done
|
||||
fi
|
||||
for _ip in ${ext_ip_arr[@]} ; do
|
||||
$ipt -t mangle -A PREROUTING -s $_ip -d $_ip -j DROP
|
||||
$ipt -t mangle -A PREROUTING ! -i lo -s $_ip -d $_ip -j DROP
|
||||
done
|
||||
echo_done
|
||||
|
||||
@@ -2241,6 +2246,134 @@ echo_done
|
||||
# - HTTP(S) (local) Webserver
|
||||
# ---
|
||||
|
||||
echo ""
|
||||
|
||||
# Note:
|
||||
# The following rules only DROP/REJECT excess connections - they never ACCEPT.
|
||||
# Ports are opened exclusively by the rules for 'http_server_ips' below.
|
||||
# Without local webserver (empty 'http_server_ips') no rules are created.
|
||||
#
|
||||
echononl "\t\tA maximum number new connections per second per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_ip_per_second ; then
|
||||
|
||||
if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v4_log --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 'max_http_new_conn_per_ip_per_second' neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v4 --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of concurrent TCP connections per IP"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_concurrent_http_conn_per_ip ; then
|
||||
|
||||
if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 32 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 'max_concurrent_http_conn_per_ip' parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 32)
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 32 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tA maximum number of new TCP handshakes per second."
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] && $set_max_new_http_conn_per_second ; then
|
||||
|
||||
if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_new_http_conn_per_second=$default_max_new_http_conn_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
|
||||
|
||||
# SYN-Rate begrenzen (global, alle Quell-IPs zusammen)
|
||||
#
|
||||
# hashlimit ohne '--hashlimit-mode' verwendet einen einzigen Bucket für alle
|
||||
# Pakete. SYN-Pakete oberhalb des Limits werden gedroppt; alles darunter
|
||||
# läuft weiter zu den Regeln für 'http_server_ips' (kein ACCEPT hier!).
|
||||
#
|
||||
# Kurzfristig auch bis zu 'burst_max_new_http_conn_per_second' SYN-Pakete erlaubt.
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v4_syn_log \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
fi
|
||||
|
||||
$ipt -A INPUT -p tcp -m multiport --dports $http_ports \
|
||||
--syn \
|
||||
-m hashlimit --hashlimit-name http_v4_syn \
|
||||
--hashlimit-above ${max_new_http_conn_per_second}/second \
|
||||
--hashlimit-burst $burst_max_new_http_conn_per_second \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
|
||||
echononl "\t\tHTTP(S) (local) Webserver"
|
||||
|
||||
if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
@@ -2273,12 +2406,22 @@ if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_mm_server_ip_arr[@]} -gt
|
||||
if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip in ${mm_server_ip_arr[@]} ; do
|
||||
$ipt -A INPUT -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ipt -A INPUT -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ipt -A INPUT -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ipt -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
|
||||
if [[ ${#forward_mm_server_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
for _ip in ${forward_mm_server_ip_arr[@]} ; do
|
||||
$ipt -A FORWARD -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
if [[ -n "$mm_tcp_ports_in" ]] ; then
|
||||
$ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
else
|
||||
$ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ipt -A FORWARD -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user