Rededign rules foe 'FTP Service DMZ'.
This commit is contained in:
parent
b39014e611
commit
70f8e953e2
@ -2287,7 +2287,7 @@ if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_i
|
|||||||
|
|
||||||
# - (1)
|
# - (1)
|
||||||
# -
|
# -
|
||||||
# - Open FTP connection and add the destination ip (--rdest) to ftpdata recent list 'ftpdata_$i'.
|
# - Open FTP connection and add the destination ip (--rdest) to ftpdata recent list 'ftp6data_$i'.
|
||||||
# -
|
# -
|
||||||
$ip6t -A OUTPUT -p tcp -d $_ip --dport 21 --sport 1024: -m state --state NEW \
|
$ip6t -A OUTPUT -p tcp -d $_ip --dport 21 --sport 1024: -m state --state NEW \
|
||||||
-m recent --name ftp6data_local_$k --rdest --set -j ACCEPT
|
-m recent --name ftp6data_local_$k --rdest --set -j ACCEPT
|
||||||
@ -2296,7 +2296,7 @@ if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_i
|
|||||||
-m recent --name ftp6data_local_$k --rdest --set -j ACCEPT
|
-m recent --name ftp6data_local_$k --rdest --set -j ACCEPT
|
||||||
|
|
||||||
# - (2)
|
# - (2)
|
||||||
# - - Accept packets if the destination ip-address (--rdest) is in the 'ftpdata_$i' list (--update)
|
# - - Accept packets if the destination ip-address (--rdest) is in the 'ftp6data_$i' list (--update)
|
||||||
# - and the destination ip-address was seen within the last 1800 seconds (--seconds 1800).
|
# - and the destination ip-address was seen within the last 1800 seconds (--seconds 1800).
|
||||||
# -
|
# -
|
||||||
# - - If matched, the "last seen" timestamp of the destination address will be updated (--update).
|
# - - If matched, the "last seen" timestamp of the destination address will be updated (--update).
|
||||||
@ -2323,11 +2323,11 @@ if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_i
|
|||||||
$ip6t -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -s $_ip --dport 1024: -j ACCEPT
|
$ip6t -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
fi
|
fi
|
||||||
|
|
||||||
done
|
done
|
||||||
|
|
||||||
echo_done
|
echo_done
|
||||||
else
|
else
|
||||||
echo_skipped
|
echo_skipped
|
||||||
fi
|
fi
|
||||||
|
|
||||||
#echononl "\t\tFTP Service local Networks"
|
#echononl "\t\tFTP Service local Networks"
|
||||||
@ -2366,6 +2366,23 @@ unset no_if_for_ip_arr
|
|||||||
declare -a no_if_for_ip_arr
|
declare -a no_if_for_ip_arr
|
||||||
|
|
||||||
if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
|
if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
|
||||||
|
|
||||||
|
# - Used for different ftpdata recent lists 'ftp6data_dmz_$m'
|
||||||
|
# -
|
||||||
|
declare -i m=1
|
||||||
|
|
||||||
|
# - (Re)define helper
|
||||||
|
# -
|
||||||
|
if ! $ftp_helper_output_defined ; then
|
||||||
|
$ip6t -A OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||||
|
ftp_helper_output_defined=true
|
||||||
|
fi
|
||||||
|
if $kernel_activate_forwarding && ! $ftp_helper_prerouting_defined ; then
|
||||||
|
$ip6t -A PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||||
|
ftp_helper_prerouting_defined=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
|
IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
|
||||||
for _ip in "${!ftp_server_dmz_arr[@]}"; do
|
for _ip in "${!ftp_server_dmz_arr[@]}"; do
|
||||||
|
|
||||||
@ -2376,34 +2393,110 @@ if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; th
|
|||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
|
|
||||||
$ip6t -A OUTPUT -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
# =====
|
||||||
|
# -
|
||||||
|
# - ip_conntrack_ftp cannot see the TLS-encrypted traffic
|
||||||
|
# - ======================================================
|
||||||
|
# -
|
||||||
|
# - Workaround:
|
||||||
|
# - (1) add source ip to a 'recent list' named 'ftp6data_$i! if ftp control connections appear
|
||||||
|
# - (2) accept packets of the formaly created recent list 'ftp6data_$i!
|
||||||
|
# -
|
||||||
|
# =====
|
||||||
|
|
||||||
# - From extern
|
# ---
|
||||||
if $kernel_forward_between_interfaces ; then
|
# - From gateway itself
|
||||||
$ip6t -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
# ---
|
||||||
|
|
||||||
|
# - (1)
|
||||||
|
# -
|
||||||
|
# - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftp6data_$i'.
|
||||||
|
# -
|
||||||
|
$ip6t -A OUTPUT -p tcp -d $_ip --dport 21 -m state --state NEW \
|
||||||
|
-m recent --name ftp6data_dmz_$m --rdest --set -j ACCEPT
|
||||||
|
|
||||||
|
# - (2)
|
||||||
|
# - - Accept packets if the destination ip-address (--rdest) is in the 'ftp6data_$i' list (--update)
|
||||||
|
# - and the destination ip-address was seen within the last 1800 seconds (--seconds 1800).
|
||||||
|
# -
|
||||||
|
# - - If matched, the "last seen" timestamp of the destination address will be updated (--update).
|
||||||
|
# -
|
||||||
|
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
|
||||||
|
# -
|
||||||
|
$ip6t -A OUTPUT -p tcp -d $_ip -m state --state NEW --dport 1024: \
|
||||||
|
-m recent --name ftp6data_dmz_$m --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||||
|
|
||||||
|
((m++))
|
||||||
|
|
||||||
|
# - Accept (helper ftp) related connections
|
||||||
|
# -
|
||||||
|
$ip6t -A OUTPUT -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -d $_ip --dport 1024: -j ACCEPT
|
||||||
|
$ip6t -A INPUT -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# - From extern
|
||||||
|
# ---
|
||||||
|
|
||||||
|
if $kernel_activate_forwarding ; then
|
||||||
|
|
||||||
|
# - (1)
|
||||||
|
# -
|
||||||
|
$ip6t -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m state --state NEW \
|
||||||
|
-m recent --name ftp6data_dmz_$m --rdest --set -j ACCEPT
|
||||||
|
|
||||||
|
# - (2)
|
||||||
|
# -
|
||||||
|
$ip6t -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 1024: -m state --state NEW \
|
||||||
|
-m recent --name ftp6data_dmz_$m --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||||
|
|
||||||
|
((m++))
|
||||||
|
|
||||||
|
# - Accept (helper ftp) related connections
|
||||||
|
# -
|
||||||
|
$ip6t -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
|
-i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 1024: -j ACCEPT
|
||||||
|
$ip6t -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
|
-o ${ftp_server_dmz_arr[$_ip]} -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
|
|
||||||
|
# - Finally we have to Nat the connection
|
||||||
|
# -
|
||||||
|
#$ip6t -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 21 -j DNAT --to $_ip:21
|
||||||
|
#$ip6t -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 20 -j DNAT --to $_ip:20
|
||||||
|
#$ip6t -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport $ftp_passive_port_range \
|
||||||
|
# -j DNAT --to $_ip:${ftp_passive_port_arr[0]}-${ftp_passive_port_arr[1]}
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# - From intern
|
|
||||||
if $kernel_forward_between_interfaces && ! $permit_between_local_networks ; then
|
# ---
|
||||||
|
# - From intern
|
||||||
|
# ---
|
||||||
|
|
||||||
|
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||||
|
|
||||||
for _dev in ${local_if_arr[@]} ; do
|
for _dev in ${local_if_arr[@]} ; do
|
||||||
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
|
||||||
|
# - (1)
|
||||||
|
# -
|
||||||
|
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m state --state NEW \
|
||||||
|
-m recent --name ftp6data_dmz_$m --rdest --set -j ACCEPT
|
||||||
|
|
||||||
|
# - (2)
|
||||||
|
# -
|
||||||
|
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip --dport 1024: -m state --state NEW \
|
||||||
|
-m recent --name ftp6data_dmz_$m --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||||
|
|
||||||
|
((m++))
|
||||||
|
|
||||||
|
# - Accept (helper ftp) related connections
|
||||||
|
# -
|
||||||
|
$ip6t -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
|
-i $_dev -p tcp -d $_ip --dport 1024: -j ACCEPT
|
||||||
|
$ip6t -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
|
-o $_dev -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# - Rule is needed if (local) interface aliases in use (like eth0:1)
|
|
||||||
# -
|
|
||||||
if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
|
|
||||||
|
|
||||||
# - Control Port
|
|
||||||
$ip6t -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
$ip6t -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
# - Data Port activ
|
|
||||||
$ip6t -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
$ip6t -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
# - Data Port passiv
|
|
||||||
$ip6t -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $ftp_passive_port_range --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
|
|
||||||
fi
|
|
||||||
done
|
done
|
||||||
|
|
||||||
if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
|
if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
|
||||||
@ -2418,6 +2511,64 @@ if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; th
|
|||||||
else
|
else
|
||||||
echo_skipped
|
echo_skipped
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
#echononl "\t\tFTP Service DMZ"
|
||||||
|
#unset no_if_for_ip_arr
|
||||||
|
#declare -a no_if_for_ip_arr
|
||||||
|
#
|
||||||
|
#if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
|
||||||
|
# IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
|
||||||
|
# for _ip in "${!ftp_server_dmz_arr[@]}"; do
|
||||||
|
#
|
||||||
|
# # - Skip if no interface is given
|
||||||
|
# # -
|
||||||
|
# if [[ -z "${ftp_server_dmz_arr[$_ip]}" ]] ; then
|
||||||
|
# no_if_for_ip_arr+=("$_ip")
|
||||||
|
# continue
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
# $ip6t -A OUTPUT -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||||
|
#
|
||||||
|
# # - From extern
|
||||||
|
# if $kernel_forward_between_interfaces ; then
|
||||||
|
# $ip6t -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
# # - From intern
|
||||||
|
# if $kernel_forward_between_interfaces && ! $permit_between_local_networks ; then
|
||||||
|
# for _dev in ${local_if_arr[@]} ; do
|
||||||
|
# $ip6t -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||||
|
# done
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
# # - Rule is needed if (local) interface aliases in use (like eth0:1)
|
||||||
|
# # -
|
||||||
|
# if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
|
||||||
|
#
|
||||||
|
# # - Control Port
|
||||||
|
# $ip6t -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# $ip6t -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# # - Data Port activ
|
||||||
|
# $ip6t -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# $ip6t -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# # - Data Port passiv
|
||||||
|
# $ip6t -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $ftp_passive_port_range --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
#
|
||||||
|
# fi
|
||||||
|
# done
|
||||||
|
#
|
||||||
|
# if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
|
||||||
|
# echo_warning
|
||||||
|
# for _ip in ${no_if_for_ip_arr[@]} ; do
|
||||||
|
# warn "No Interface given for ip '$_ip'"
|
||||||
|
# done
|
||||||
|
# else
|
||||||
|
# echo_done
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
#else
|
||||||
|
# echo_skipped
|
||||||
|
#fi
|
||||||
|
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
|
|||||||
@ -3005,11 +3005,11 @@ if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwardi
|
|||||||
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -s $_ip --dport 1024: -j ACCEPT
|
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
fi
|
fi
|
||||||
|
|
||||||
done
|
done
|
||||||
|
|
||||||
echo_done
|
echo_done
|
||||||
else
|
else
|
||||||
echo_skipped
|
echo_skipped
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|
||||||
@ -3050,6 +3050,23 @@ unset no_if_for_ip_arr
|
|||||||
declare -a no_if_for_ip_arr
|
declare -a no_if_for_ip_arr
|
||||||
|
|
||||||
if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
|
if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
|
||||||
|
|
||||||
|
# - Used for different ftpdata recent lists 'ftpdata_dmz_$m'
|
||||||
|
# -
|
||||||
|
declare -i m=1
|
||||||
|
|
||||||
|
# - (Re)define helper
|
||||||
|
# -
|
||||||
|
if ! $ftp_helper_output_defined ; then
|
||||||
|
$ipt -A OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||||
|
ftp_helper_output_defined=true
|
||||||
|
fi
|
||||||
|
if $kernel_activate_forwarding && ! $ftp_helper_prerouting_defined ; then
|
||||||
|
$ipt -A PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||||
|
ftp_helper_prerouting_defined=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
|
IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
|
||||||
for _ip in "${!ftp_server_dmz_arr[@]}"; do
|
for _ip in "${!ftp_server_dmz_arr[@]}"; do
|
||||||
|
|
||||||
@ -3060,42 +3077,110 @@ if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; th
|
|||||||
continue
|
continue
|
||||||
fi
|
fi
|
||||||
|
|
||||||
$ipt -A OUTPUT -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
# =====
|
||||||
|
# -
|
||||||
|
# - ip_conntrack_ftp cannot see the TLS-encrypted traffic
|
||||||
|
# - ======================================================
|
||||||
|
# -
|
||||||
|
# - Workaround:
|
||||||
|
# - (1) add source ip to a 'recent list' named 'ftpdata_$i! if ftp control connections appear
|
||||||
|
# - (2) accept packets of the formaly created recent list 'ftpdata_$i!
|
||||||
|
# -
|
||||||
|
# =====
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# - From gateway itself
|
||||||
|
# ---
|
||||||
|
|
||||||
|
# - (1)
|
||||||
|
# -
|
||||||
|
# - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftpdata_$i'.
|
||||||
|
# -
|
||||||
|
$ipt -A OUTPUT -p tcp -d $_ip --dport 21 -m state --state NEW \
|
||||||
|
-m recent --name ftpdata_dmz_$m --rdest --set -j ACCEPT
|
||||||
|
|
||||||
|
# - (2)
|
||||||
|
# - - Accept packets if the destination ip-address (--rdest) is in the 'ftpdata_$i' list (--update)
|
||||||
|
# - and the destination ip-address was seen within the last 1800 seconds (--seconds 1800).
|
||||||
|
# -
|
||||||
|
# - - If matched, the "last seen" timestamp of the destination address will be updated (--update).
|
||||||
|
# -
|
||||||
|
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
|
||||||
|
# -
|
||||||
|
$ipt -A OUTPUT -p tcp -d $_ip -m state --state NEW --dport 1024: \
|
||||||
|
-m recent --name ftpdata_dmz_$m --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||||
|
|
||||||
|
((m++))
|
||||||
|
|
||||||
|
# - Accept (helper ftp) related connections
|
||||||
|
# -
|
||||||
|
$ipt -A OUTPUT -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -d $_ip --dport 1024: -j ACCEPT
|
||||||
|
$ipt -A INPUT -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
|
|
||||||
|
|
||||||
|
# ---
|
||||||
|
# - From extern
|
||||||
|
# ---
|
||||||
|
|
||||||
# - From extern
|
|
||||||
if $kernel_activate_forwarding ; then
|
if $kernel_activate_forwarding ; then
|
||||||
$ipt -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
|
||||||
|
|
||||||
# - Nat if interface is on a dsl line
|
# - (1)
|
||||||
|
# -
|
||||||
|
$ipt -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m state --state NEW \
|
||||||
|
-m recent --name ftpdata_dmz_$m --rdest --set -j ACCEPT
|
||||||
|
|
||||||
|
# - (2)
|
||||||
|
# -
|
||||||
|
$ipt -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 1024: -m state --state NEW \
|
||||||
|
-m recent --name ftpdata_dmz_$m --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||||
|
|
||||||
|
((m++))
|
||||||
|
|
||||||
|
# - Accept (helper ftp) related connections
|
||||||
# -
|
# -
|
||||||
if containsElement "${ftp_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
|
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
$ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 21 -j DNAT --to $_ip:21
|
-i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 1024: -j ACCEPT
|
||||||
$ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 20 -j DNAT --to $_ip:20
|
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
$ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport $ftp_passive_port_range -j DNAT --to $_ip:${ftp_passive_port_arr[0]}-${ftp_passive_port_arr[1]}
|
-o ${ftp_server_dmz_arr[$_ip]} -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
fi
|
|
||||||
|
# - Finally we have to Nat the connection
|
||||||
|
# -
|
||||||
|
$ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 21 -j DNAT --to $_ip:21
|
||||||
|
$ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 20 -j DNAT --to $_ip:20
|
||||||
|
$ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport $ftp_passive_port_range \
|
||||||
|
-j DNAT --to $_ip:${ftp_passive_port_arr[0]}-${ftp_passive_port_arr[1]}
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# - From intern
|
|
||||||
|
# ---
|
||||||
|
# - From intern
|
||||||
|
# ---
|
||||||
|
|
||||||
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||||
|
|
||||||
for _dev in ${local_if_arr[@]} ; do
|
for _dev in ${local_if_arr[@]} ; do
|
||||||
$ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
|
||||||
|
# - (1)
|
||||||
|
# -
|
||||||
|
$ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m state --state NEW \
|
||||||
|
-m recent --name ftpdata_dmz_$m --rdest --set -j ACCEPT
|
||||||
|
|
||||||
|
# - (2)
|
||||||
|
# -
|
||||||
|
$ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport 1024: -m state --state NEW \
|
||||||
|
-m recent --name ftpdata_dmz_$m --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||||
|
|
||||||
|
((m++))
|
||||||
|
|
||||||
|
# - Accept (helper ftp) related connections
|
||||||
|
# -
|
||||||
|
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
|
-i $_dev -p tcp -d $_ip --dport 1024: -j ACCEPT
|
||||||
|
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp \
|
||||||
|
-o $_dev -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# - Rule is needed if (local) interface aliases in use (like eth0:1)
|
|
||||||
# -
|
|
||||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
|
||||||
|
|
||||||
# - Control Port
|
|
||||||
$ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
$ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
# - Data Port activ
|
|
||||||
$ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
$ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
# - Data Port passiv
|
|
||||||
$ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $ftp_passive_port_range --tcp-flag ACK ACK -j ACCEPT
|
|
||||||
|
|
||||||
fi
|
|
||||||
done
|
done
|
||||||
|
|
||||||
if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
|
if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
|
||||||
@ -3110,6 +3195,72 @@ if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; th
|
|||||||
else
|
else
|
||||||
echo_skipped
|
echo_skipped
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
#echononl "\t\tFTP Service DMZ"
|
||||||
|
#unset no_if_for_ip_arr
|
||||||
|
#declare -a no_if_for_ip_arr
|
||||||
|
#
|
||||||
|
#if [[ ${#ftp_server_dmz_arr[@]} -gt 0 ]] && [[ -n $ftp_passive_port_range ]]; then
|
||||||
|
# IFS=':' read -a ftp_passive_port_arr <<< "${ftp_passive_port_range}"
|
||||||
|
# for _ip in "${!ftp_server_dmz_arr[@]}"; do
|
||||||
|
#
|
||||||
|
# # - Skip if no interface is given
|
||||||
|
# # -
|
||||||
|
# if [[ -z "${ftp_server_dmz_arr[$_ip]}" ]] ; then
|
||||||
|
# no_if_for_ip_arr+=("$_ip")
|
||||||
|
# continue
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
# $ipt -A OUTPUT -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||||
|
#
|
||||||
|
# # - From extern
|
||||||
|
# if $kernel_activate_forwarding ; then
|
||||||
|
# $ipt -A FORWARD -i ${ftp_server_dmz_arr[$_ip]} -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||||
|
#
|
||||||
|
# # - Nat if interface is on a dsl line
|
||||||
|
# # -
|
||||||
|
# #if containsElement "${ftp_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
|
||||||
|
# $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 21 -j DNAT --to $_ip:21
|
||||||
|
# $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport 20 -j DNAT --to $_ip:20
|
||||||
|
# $ipt -t nat -A PREROUTING -i ${ftp_server_dmz_arr[$_ip]} -p tcp --dport $ftp_passive_port_range -j DNAT --to $_ip:${ftp_passive_port_arr[0]}-${ftp_passive_port_arr[1]}
|
||||||
|
# #fi
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
# # - From intern
|
||||||
|
# if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||||
|
# for _dev in ${local_if_arr[@]} ; do
|
||||||
|
# $ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||||
|
# done
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
# # - Rule is needed if (local) interface aliases in use (like eth0:1)
|
||||||
|
# # -
|
||||||
|
# if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||||
|
#
|
||||||
|
# # - Control Port
|
||||||
|
# $ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# $ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# # - Data Port activ
|
||||||
|
# $ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# $ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
# # - Data Port passiv
|
||||||
|
# $ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $ftp_passive_port_range --tcp-flag ACK ACK -j ACCEPT
|
||||||
|
#
|
||||||
|
# fi
|
||||||
|
# done
|
||||||
|
#
|
||||||
|
# if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
|
||||||
|
# echo_warning
|
||||||
|
# for _ip in ${no_if_for_ip_arr[@]} ; do
|
||||||
|
# warn "No Interface given for ip '$_ip'"
|
||||||
|
# done
|
||||||
|
# else
|
||||||
|
# echo_done
|
||||||
|
# fi
|
||||||
|
#
|
||||||
|
#else
|
||||||
|
# echo_skipped
|
||||||
|
#fi
|
||||||
|
|
||||||
|
|
||||||
# ---
|
# ---
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user