From 4b97303acdcf305bad30614e3f08761f48545770 Mon Sep 17 00:00:00 2001 From: Christoph Date: Sat, 19 Sep 2020 13:40:39 +0200 Subject: [PATCH] Add 'allow_to_ext_net' and 'allow_to_ext_service'. --- conf/main_ipv4.conf.sample | 44 +++++++++++++++++++++ conf/main_ipv6.conf.sample | 44 +++++++++++++++++++++ conf/post_decalrations.conf | 16 ++++++++ ip6t-firewall-gateway | 77 +++++++++++++++++++++++++++++++++++++ ipt-firewall-gateway | 76 ++++++++++++++++++++++++++++++++++++ 5 files changed, 257 insertions(+) diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample index c9ef417..639b10a 100644 --- a/conf/main_ipv4.conf.sample +++ b/conf/main_ipv4.conf.sample @@ -382,6 +382,50 @@ allow_local_net_to_ext_net="" +# ============= +# - Allow extern service +# ============= + +# - allow_to_ext_service +# - +# - allow_to_ext_service=" [ext-ip:port:protocol> [.." +# - +# - All traffic to the given (extern) service is allowed +# - +# - Example: +# - allow_to_ext_service="83.223.86.98:3306:tcp +# - 83.223.86.98:10194:udp" +# - +# - Blank separated list +# - +allow_to_ext_service="" + + + +# ============= +# - Allow extern network +# ============= + + +# - allow_to_ext_net +# - +# - Allow all traffic to given extern network +# - +# - allow_to_ext_net=" [ [.." +# - +# - All traffic to the given (extern) network is allowed +# - +# - Example: +# - allow_to_ext_net="83.223.86.98/32 +# - 83.223.86.101/32 +# - 192.68.11.81/27" +# - +# - Blank separated list +# - +allow_to_ext_net="" + + + # ============= # --- Separate local Networks # ============= diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample index 081ba8d..449a1eb 100644 --- a/conf/main_ipv6.conf.sample +++ b/conf/main_ipv6.conf.sample @@ -370,6 +370,50 @@ allow_local_net_to_ext_net="" +# ============= +# - Allow extern service +# ============= + +# - allow_to_ext_service +# - +# - Allow all traffic to given extern service +# - +# - allow_to_ext_service=" [ext-ip,port,protocol> [.." +# - +# - All traffic to the given (extern) service is allowed +# - +# - Example: +# - allow_to_ext_service="2a01:30:0:13:211:84ff:feb7:7f9c,3306,tcp +# - 2a01:30:0:13:211:84ff:feb7:7f9c,10194,tcp" +# - +# - Blank separated list +# - +allow_to_ext_service="" + + + +# ============= +# - Allow extern network +# ============= + +# - allow_to_ext_net +# - +# - Allow all traffic to given extern network +# - +# - allow_to_ext_net=" [ [.." +# - +# - All traffic from the given (local) network to the given (extern) network is allowed +# - +# - Example: +# - allow_to_ext_net="2a01:30:0:13:211:84ff:feb7:7f9c/64 +# - 2001:678:a40:3000::/64" +# - +# - Blank separated list +# - +allow_to_ext_net="" + + + # ============= # --- Separate local Networks # ============= diff --git a/conf/post_decalrations.conf b/conf/post_decalrations.conf index 3169879..9d26a25 100644 --- a/conf/post_decalrations.conf +++ b/conf/post_decalrations.conf @@ -197,6 +197,22 @@ for _val in $allow_local_net_to_ext_net ; do allow_local_net_to_ext_net_arr+=("$_val") done +# --- +# - Allow extern service +# --- +declare -a allow_to_ext_service_arr +for _val in $allow_to_ext_service ; do + allow_to_ext_service_arr+=("$_val") +done + +# --- +# - Allow extern network +# --- +declare -a allow_to_ext_net_arr +for _val in $allow_to_ext_net ; do + allow_to_ext_net_arr+=("$_val") +done + # --- # - Separate local Networks # --- diff --git a/ip6t-firewall-gateway b/ip6t-firewall-gateway index dd1fcdb..a5cd1be 100755 --- a/ip6t-firewall-gateway +++ b/ip6t-firewall-gateway @@ -861,6 +861,11 @@ if $permit_local_net_to_inet ; then $ip6t -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT fi done + + if $local_alias_interfaces && $kernel_forward_between_interfaces; then + $ip6t -A FORWARD -p tcp --tcp-flag ACK ACK -j ACCEPT + fi + echo_done else echo_skipped @@ -1320,6 +1325,78 @@ fi +# --- +# - Allow extern service +# --- + +echononl "\tAllow extern service" + +if [[ ${#allow_to_ext_service_arr[@]} -gt 0 ]] ; then + + for _val in "${allow_to_ext_service_arr[@]}" ; do + + IFS=',' read -a _val_arr <<< "${_val}" + + for _dev in ${ext_if_arr[@]} ; do + + $ip6t -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + $ip6t -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT + fi + done + + if $local_alias_interfaces && $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + if [[ "${_val_arr[2]}" = "tcp" ]]; then + $ip6t -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT + $ip6t -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT + fi + fi + + + done + + echo_done +else + echo_skipped +fi + + + +# --- +# - Allow extern network +# --- + +echononl "\tAllow extern network" + +if [[ ${#allow_to_ext_net_arr[@]} -gt 0 ]] ; then + + for _net in "${allow_to_ext_net_arr[@]}" ; do + + for _dev in ${ext_if_arr[@]} ; do + + $ip6t -A OUTPUT -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + $ip6t -A FORWARD -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT + fi + done + + if $local_alias_interfaces && $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + if [[ "${_val_arr[2]}" = "tcp" ]]; then + $ip6t -A FORWARD -p tcp -d $_net --tcp-flag ACK ACK -j ACCEPT + $ip6t -A FORWARD -p tcp -s $_net --tcp-flag ACK ACK -j ACCEPT + fi + fi + + + done + + echo_done +else + echo_skipped +fi + + + # --- # - Separate local networks # --- diff --git a/ipt-firewall-gateway b/ipt-firewall-gateway index 5d86521..5353f75 100755 --- a/ipt-firewall-gateway +++ b/ipt-firewall-gateway @@ -1409,6 +1409,11 @@ if $permit_local_net_to_inet ; then $ipt -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT fi done + + if $local_alias_interfaces && $kernel_activate_forwarding ; then + $ipt -A FORWARD -p tcp --tcp-flag ACK ACK -j ACCEPT + fi + echo_done else echo_skipped @@ -1948,6 +1953,77 @@ fi +# --- +# - Allow extern service +# --- + +echononl "\tAllow extern service" + +if [[ ${#allow_to_ext_service_arr[@]} -gt 0 ]] ; then + + for _val in "${allow_to_ext_service_arr[@]}" ; do + + IFS=':' read -a _val_arr <<< "${_val}" + + for _dev in ${ext_if_arr[@]} ; do + + $ipt -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + $ipt -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT + fi + done + + if $local_alias_interfaces ; then + if [[ "${_val_arr[2]}" = "tcp" ]]; then + $ipt -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT + $ipt -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT + fi + fi + + + done + + echo_done +else + echo_skipped +fi + + + +# --- +# - Allow extern network +# --- + +echononl "\tAllow extern network" + +if [[ ${#allow_to_ext_net_arr[@]} -gt 0 ]] ; then + + for _net in "${allow_to_ext_net_arr[@]}" ; do + + for _dev in ${ext_if_arr[@]} ; do + + $ipt -A OUTPUT -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT + + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + $ipt -A FORWARD -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT + fi + done + + if $local_alias_interfaces ; then + $ipt -A FORWARD -p tcp -d $_net --tcp-flag ACK ACK -j ACCEPT + $ipt -A FORWARD -p tcp -s $_net --tcp-flag ACK ACK -j ACCEPT + fi + + + done + + echo_done +else + echo_skipped +fi + + + # --- # - Separate local networks # ---