firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for restricted VPN networks.

Browse Source
This commit is contained in:
Christoph 2023-09-27 17:41:09 +02:00
parent c427d4fefd
commit 4c98319ddf
5 changed files with 397 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
conf/main_ipv4.conf.sample
View File

@ -563,6 +563,47 @@ vpn_local_net_ports="1194"
vpn_out_ports="$standard_vpn_port" vpn_out_ports="$standard_vpn_port"
# -----
# - Restrict VPN Network to local Service
# -----#
# - restrict_vpn_net_to_local_service
# -
# - allow_ext_net_to_local_service="vpn-net:local-address:port:protocol [vpn-net:local-address:port:protocol] [..]"
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - restrict_vpn_net_to_local_service="
# - 10.100.112.0/24:192.168.112.192/27:80:tcp
# - 10.100.112.0/24:192.168.112.192/27:443:tcp
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_service=""
# -----
# - Restrict VPN Network to local (Sub) network
# -----
# - restrict_vpn_net_to_local_subnet
# -
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>:<dst-local-net> [<src-vpn-net>:<dst-local-net>} [..]
# -
# - Example:
# - restrict_vpn_net_to_local_subnet="
# - 10.100.112.0/24:192.168.112.192/27
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_subnet=""
# ====== # ======
# - WireGuard Service # - WireGuard Service
# ====== # ======

41
conf/main_ipv6.conf.sample
View File

@ -548,6 +548,47 @@ vpn_local_net_ports="1194"
vpn_out_ports="$standard_vpn_port" vpn_out_ports="$standard_vpn_port"
# -----
# - Restrict VPN Network to local Service
# -----#
# - restrict_vpn_net_to_local_service
# -
# - allow_ext_net_to_local_service="vpn-net,local-address,port,protocol [vpn-net,local-address,port,protocol] [..]"
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - restrict_vpn_net_to_local_service="
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,80,tcp
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,443,tcp
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_service=""
# -----
# - Restrict VPN Network to local (Sub) network
# -----
# - restrict_vpn_net_to_local_subnet
# -
# - restrict_vpn_net_to_local_subnet="<src-vpn-net>,<dst-local-net> [<src-vpn-net>,<dst-local-net>} [..]
# -
# - Example:
# - restrict_vpn_net_to_local_subnet="
# - 2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64
# - "
# -
# - Blank separated list
# -
restrict_vpn_net_to_local_subnet=""
# ====== # ======
# - WireGuard Service # - WireGuard Service
# ====== # ======

16
conf/post_decalrations.conf
View File

@ -130,6 +130,22 @@ for _dev in $unprotected_ifs ; do
unprotected_if_arr+=("$_dev") unprotected_if_arr+=("$_dev")
done done
# ---
# - Restrict VPN Network to local Service
# ---
declare -a restrict_vpn_net_to_local_service_arr=()
for _val in $restrict_vpn_net_to_local_service ; do
restrict_vpn_net_to_local_service_arr+=("$_val")
done
# ---
# - Restrict VPN Network to local (Sub) network
# ---
declare -a restrict_vpn_net_to_local_subnet_arr=()
for _val in $restrict_vpn_net_to_local_subnet ; do
restrict_vpn_net_to_local_subnet_arr+=("$_val")
done
# --- # ---
# - Allow these local networks any access to the internet # - Allow these local networks any access to the internet
# --- # ---

150
ip6t-firewall-gateway
View File

@ -851,6 +851,156 @@ fi
echo_done echo_done
echo ""
unset restricted_vpn_network_arr
unset restricted_vpn_target_network_arr
declare -a restricted_vpn_network_arr
declare -a restricted_vpn_target_network_arr
# ---
# - Restrict VPN Network to local Service
# ---
echononl "\tRestrict VPN Network to local Service"
if [[ ${#restrict_vpn_net_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in "${restrict_vpn_net_to_local_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
if ! containsElement "${_val_arr[0]}" "${restricted_vpn_network_arr[@]}" ; then
restricted_vpn_network_arr+=("${_val_arr[0]}")
fi
if ! containsElement "${_val_arr[1]}" "${restricted_vpn_target_network_arr[@]}" ; then
restricted_vpn_target_network_arr+=("${_val_arr[1]}")
fi
if containsElement "${_val_arr[1]}" "${gateway_ipv6_address_arr[@]}" ; then
$ip6t -A INPUT -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# Allow also ICMP (ping)
$ip6t -A INPUT -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
$ipt -A INPUT -s $_net
else
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# Allow also ICMP (ping) to these target networks/hosts
$ip6t -A FORWARD -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
fi
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if [[ "${_val_arr[3]}" = "tcp" ]]; then
$ip6t -A FORWARD -p ${_val_arr[3]} -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Restrict VPN Network to local (Sub) network
# ---
# - !! Note:
# - does NOT depend on settings 'permit_between_local_networks' !!
# -
echononl "\tRestrict VPN Network to local (Sub) network"
if [[ ${#restrict_vpn_net_to_local_subnet_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in ${restrict_vpn_net_to_local_subnet_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"
if ! containsElement "${_val_arr[0]}" "${restricted_vpn_network_arr[@]}" ; then
restricted_vpn_network_arr+=("${_val_arr[0]}")
fi
if ! containsElement "${_val_arr[1]}" "${restricted_vpn_target_network_arr[@]}" ; then
restricted_vpn_target_network_arr+=("${_val_arr[1]}")
fi
$ip6t -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local DNS Service for restricted VPN Networks
# ---
echononl "\tAllow local DNS Service for restricted VPN Networks"
if [[ ${#restricted_vpn_network_arr[@]} -gt 0 ]] ; then
for _net in "${restricted_vpn_network_arr[@]}" ; do
for _ip in "${gateway_ipv6_address_arr[@]}" ; do
$ip6t -A INPUT -p udp -s $_net -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A INPUT -p icmp -s $_net -d $_ip -j ACCEPT
done
done
echo_done
else
echo_skipped
fi
# ---
# - Block further traffic from Restrict VPN Networks
# ---
echononl "\tBlock further traffic from Restrict VPN Networks"
if [[ ${#restricted_vpn_network_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _net in ${restricted_vpn_network_arr[@]} ; do
#$ip6t -A INPUT -p ALL -s $_net -m conntrack --ctstate NEW -j DROP
#$ip6t -A FORWARD -p ALL -s $_net -m conntrack --ctstate NEW -j DROP
$ip6t -A INPUT -p ALL -s $_net -j DROP
$ip6t -A FORWARD -p ALL -s $_net -j DROP
done
echo_done
else
echo_skipped
fi
echo ""
# --- # ---
# - Permit all traffic through VPN lines # - Permit all traffic through VPN lines
# --- # ---

149
ipt-firewall-gateway
View File

@ -1486,6 +1486,155 @@ fi
echo_done echo_done
echo ""
unset restricted_vpn_network_arr
unset restricted_vpn_target_network_arr
declare -a restricted_vpn_network_arr
declare -a restricted_vpn_target_network_arr
# ---
# - Restrict VPN Network to local Service
# ---
echononl "\tRestrict VPN Network to local Service"
if [[ ${#restrict_vpn_net_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding ; then
for _val in "${restrict_vpn_net_to_local_service_arr[@]}" ; do
IFS=':' read -a _val_arr <<< "${_val}"
if ! containsElement "${_val_arr[0]}" "${restricted_vpn_network_arr[@]}" ; then
restricted_vpn_network_arr+=("${_val_arr[0]}")
fi
if ! containsElement "${_val_arr[1]}" "${restricted_vpn_target_network_arr[@]}" ; then
restricted_vpn_target_network_arr+=("${_val_arr[1]}")
fi
if containsElement "${_val_arr[1]}" "${gateway_ipv4_address_arr[@]}" ; then
$ipt -A INPUT -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# Allow also ICMP (ping)
$ipt -A INPUT -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
$ipt -A INPUT -s $_net
else
$ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# Allow also ICMP (ping) to these target networks/hosts
$ipt -A FORWARD -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
fi
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if $local_alias_interfaces ; then
if [[ "${_val_arr[3]}" = "tcp" ]]; then
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
fi
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Restrict VPN Network to local (Sub) network
# ---
# - !! Note:
# - does NOT depend on settings 'permit_between_local_networks' !!
# -
echononl "\tRestrict VPN Network to local (Sub) network"
if [[ ${#restrict_vpn_net_to_local_subnet_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding ; then
for _val in ${restrict_vpn_net_to_local_subnet_arr[@]} ; do
IFS=':' read -a _val_arr <<< "${_val}"
if ! containsElement "${_val_arr[0]}" "${restricted_vpn_network_arr[@]}" ; then
restricted_vpn_network_arr+=("${_val_arr[0]}")
fi
if ! containsElement "${_val_arr[1]}" "${restricted_vpn_target_network_arr[@]}" ; then
restricted_vpn_target_network_arr+=("${_val_arr[1]}")
fi
$ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
#$ipt -A FORWARD -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local DNS Service for restricted VPN Networks
# ---
echononl "\tAllow local DNS Service for restricted VPN Networks"
if [[ ${#restricted_vpn_network_arr[@]} -gt 0 ]] ; then
for _net in "${restricted_vpn_network_arr[@]}" ; do
for _ip in "${gateway_ipv4_address_arr[@]}" ; do
$ipt -A INPUT -p udp -s $_net -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT
$ipt -A INPUT -p icmp -s $_net -d $_ip -j ACCEPT
done
done
echo_done
else
echo_skipped
fi
# ---
# - Block further traffic from Restrict VPN Networks
# ---
echononl "\tBlock further traffic from Restrict VPN Networks"
if [[ ${#restricted_vpn_network_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding ; then
for _net in ${restricted_vpn_network_arr[@]} ; do
#$ipt -A INPUT -p ALL -s $_net -m conntrack --ctstate NEW -j DROP
#$ipt -A FORWARD -p ALL -s $_net -m conntrack --ctstate NEW -j DROP
$ipt -A INPUT -p ALL -s $_net -j DROP
$ipt -A FORWARD -p ALL -s $_net -j DROP
done
echo_done
else
echo_skipped
fi
echo "" echo ""