firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Adjust Rules concerning Unifi Controller. Add digfferent Parameters for block 'Protection against several attacks'.

Browse Source
This commit is contained in:
Christoph
2022-03-28 21:26:17 +02:00
parent 19bf795a99
commit 783be30197
5 changed files with 568 additions and 260 deletions
Download Patch File Download Diff File Expand all files Collapse all files

233
ip6t-firewall-gateway
View File

@ -162,7 +162,7 @@ echo_done
echononl "\tAdjust Kernel Parameters (Security/Tuning).."
if $adjust_kernel_parameters ; then
if $adjust6_kernel_parameters ; then
# ---
# - Deactivate Source Routed Packets
@ -474,27 +474,44 @@ fi
# -------------
# --- Protections against several attacks / unwanted packages
# -------------
echo
echononl "\tProtections against several attacks / unwanted packages.."
if $protect_against_several_attacks ; then
if $protect6_against_several_attacks ; then
echo
if $terminal ; then
echo -e "\033[37m\033[1m\tProtections against several attacks / unwanted packages....\033[m"
else
echo "Protections against several attacks / unwanted packages...."
fi
echo
# ---
# - Protection against syn-flooding
# ---
$ip6t -N syn-flood
$ip6t -A syn-flood -m limit --limit 1/second --limit-burst 3 -j RETURN
echononl "\t Protection against syn-flooding.."
if $drop6_syn_flood || $log_syn_flood ; then
$ip6t -N syn-flood
$ip6t -A INPUT -p tcp --syn -j syn_flood
$ip6t -A syn-flood -m limit --limit 1/second --limit-burst 3 -j RETURN
fi
if $log_syn_flood || $log_all ; then
$ip6t -A syn-flood -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN flood: "
fi
$ip6t -A syn-flood -j DROP
if $drop6_syn_flood ; then
$ip6t -A syn-flood -j DROP
echo_done
else
echo_skipped
fi
# ---
# - drop new packages without syn flag
# ---
echononl "\t Drop Packages new but not sync.."
if $log_new_not_sync || $log_all ; then
$ip6t -A INPUT -p tcp ! --syn -m state --state NEW -j $LOG_TARGET $tag_log_prefix "$log_prefix New but not SYN: "
$ip6t -A OUTPUT -p tcp ! --syn -m state --state NEW -j $LOG_TARGET $tag_log_prefix "$log_prefix New but not SYN: "
@ -502,10 +519,15 @@ if $protect_against_several_attacks ; then
$ip6t -A FORWARD -p tcp ! --syn -m state --state NEW -j $LOG_TARGET $tag_log_prefix "$log_prefix New but not SYN: "
fi
fi
$ip6t -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$ip6t -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
if $drop6_new_not_sync ; then
$ip6t -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$ip6t -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
fi
echo_done
else
echo_skipped
fi
@ -513,15 +535,22 @@ if $protect_against_several_attacks ; then
# - drop invalid packages
# ---
echononl "\t Drop invalid packages.."
if $log_invalid_state || $log_all ; then
$ip6t -A INPUT -m state --state INVALID -j $LOG_TARGET $tag_log_prefix "$log_prefix Invalid state: "
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -m state --state INVALID -j $LOG_TARGET $tag_log_prefix "$log_prefix Invalid state: "
fi
fi
$ip6t -A INPUT -m state --state INVALID -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -m state --state INVALID -j DROP
if $drop6_invalid_state ; then
$ip6t -A INPUT -m state --state INVALID -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -m state --state INVALID -j DROP
fi
echo_done
else
echo_skipped
fi
@ -529,8 +558,10 @@ if $protect_against_several_attacks ; then
# - ungewöhnliche Flags verwerfen
# ---
for _dev in ${ext_if_arr[@]} ; do
if $log_invalid_flags || $log_all ; then
echononl "\t Drop Packages with unusal flags .."
if $log_invalid_flags || $log_all ; then
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j $LOG_TARGET $tag_log_prefix "$log_prefix Invalid flags: "
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j $LOG_TARGET $tag_log_prefix "$log_prefix Invalid flags: "
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j $LOG_TARGET $tag_log_prefix "$log_prefix Invalid flags: "
@ -539,22 +570,31 @@ if $protect_against_several_attacks ; then
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j $LOG_TARGET $tag_log_prefix "$log_prefix Invalid flags: "
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j $LOG_TARGET $tag_log_prefix "$log_prefix Invalid flags: "
fi
fi
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
fi
done
done
fi
if $drop6_invalid_flags; then
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$ip6t -A INPUT -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$ip6t -A FORWARD -i $_dev -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Refuse private addresses on extern interfaces
# ---
echononl "\t Refuse spoofed packets pretending to be from your IP address.."
# - Refuse spoofed packets pretending to be from your IP address.
if $log_spoofed || $log_all ; then
for _ip in ${ext_ip_arr[@]} ; do
@ -564,43 +604,56 @@ if $protect_against_several_attacks ; then
fi
done
fi
for _ip in ${ext_ip_arr[@]} ; do
$ip6t -A INPUT -i $_dev -s $_ip -d $_ip -j DROP
if $kernel_forward_between_interfaces ; then
$ipi6t -A FORWARD -s $_ip -d $_ip -j DROP
fi
done
if $drop6_from_own_ip ; then
for _ip in ${ext_ip_arr[@]} ; do
$ip6t -A INPUT -i $_dev -s $_ip -d $_ip -j DROP
if $kernel_forward_between_interfaces ; then
$ipi6t -A FORWARD -s $_ip -d $_ip -j DROP
fi
done
echo_done
else
echo_skipped
fi
echononl "\t Drop private addresses on extern interfaces.."
# - private Adressen auf externen interface verwerfen
for _dev in ${dsl_device_arr[@]} ; do
if $log_spoofed || $log_all ; then
if $log_spoofed || $log_all ; then
for _dev in ${dsl_device_arr[@]} ; do
$ip6t -A INPUT -i $_dev -s $ula_block -j $LOG_TARGET $tag_log_prefix "$log_prefix Private (ula_block): "
$ip6t -A INPUT -i $_dev -s $loopback_ipv6 -j $LOG_TARGET $tag_log_prefix "$log_prefix (loopback): "
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_dev -s $ula_block -j $LOG_TARGET $tag_log_prefix "$log_prefix Private (ula_block): "
$ip6t -A FORWARD -i $_dev -s $loopback_ipv6 -j $LOG_TARGET $tag_log_prefix "$log_prefix (loopback): "
fi
fi
$ip6t -A INPUT -i $_dev -s $ula_block -j DROP
$ip6t -A INPUT -i $_dev -s $loopback_ipv6 -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_dev -s $ula_block -j DROP
$ip6t -A FORWARD -i $_dev -s $loopback_ipv6 -j DROP
fi
done
fi
# Don't allow spoofing from that server
$ip6t -A OUTPUT -o $_dev -s $ula_block -j DROP
$ip6t -A OUTPUT -o $_dev -s $loopback_ipv6 -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -s $ula_block -j DROP
$ip6t -A FORWARD -o $_dev -s $loopback_ipv6 -j DROP
fi
done
echo_done
else
echo_skipped
fi
if $drop6_spoofed ; then
for _dev in ${dsl_device_arr[@]} ; do
$ip6t -A INPUT -i $_dev -s $ula_block -j DROP
$ip6t -A INPUT -i $_dev -s $loopback_ipv6 -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_dev -s $ula_block -j DROP
$ip6t -A FORWARD -i $_dev -s $loopback_ipv6 -j DROP
fi
# Don't allow spoofing from that server
$ip6t -A OUTPUT -o $_dev -s $ula_block -j DROP
$ip6t -A OUTPUT -o $_dev -s $loopback_ipv6 -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -s $ula_block -j DROP
$ip6t -A FORWARD -o $_dev -s $loopback_ipv6 -j DROP
fi
done
echo_done
else
echo_skipped
fi
fi # if $protect6_against_several_attacks ; then
# -------------
@ -4355,11 +4408,13 @@ fi
echononl "\t\tUbiquiti Unifi Controller Gateway IN"
if $local_unifi_controller_service ; then
for _dev in ${local_if_arr[@]} ; do
if $local_unifi_controller_service \
&& ( [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] || [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]] ) ; then
for _ip in ${unifi_ap_local_ip_arr[@]} ; do
$ip6t -A INPUT -p tcp -i $_dev -m multiport --dports $unifi_tcp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A INPUT -p udp -i $_dev -m multiport --dports $unifi_udp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A INPUT -p tcp -s $_ip -m multiport --dports $unifi_tcp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A INPUT -p udp -s $_ip -m multiport --dports $unifi_udp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
done
@ -4381,30 +4436,26 @@ else
fi
echononl "\t\tUbiquiti Unifi Controller Gateway - OUT (to Unifi APs)"
echononl "\t\tUbiquiti Unifi Controller Gateway OUT (unrestricted)"
if $local_unifi_controller_service \
&& ( [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] || [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]] ) ; then
if [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] ; then
$ip6t -A OUTPUT -p tcp -m multiport --dports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A OUTPUT -p udp -m multiport --dports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
for _ip_ap in ${unifi_ap_local_ip_arr[@]} ; do
$ip6t -A INPUT -p tcp -m multiport --sports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A INPUT -p udp -m multiport --sports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A OUTPUT -p tcp -d $_ip_ap -m multiport --sports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A OUTPUT -p udp -d $_ip_ap -m multiport --sports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
done
fi
if [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]] ; then
for _ip_ap in ${unifi_ap_local_ip_arr[@]} ; do
$ip6t -A OUTPUT -p tcp -d $_ip_ap -m multiport --sports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A OUTPUT -p udp -d $_ip_ap -m multiport --sports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
done
if $kernel_activate_forwarding ; then
$ip6t -A FORWARD -p tcp -m multiport --dports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -p tcp -m multiport --sports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -p udp -m multiport --dports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -p udp -m multiport --sports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
if $local_alias_interfaces ; then
$ip6t -A FORWARD -p tcp -m multiport --dports $unifi_tcp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -m multiport --sports $unifi_tcp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
fi
fi
echo_done
@ -4426,14 +4477,12 @@ if [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] \
for _ip_ctl in ${unify_controller_local_net_ip_arr[@]} ; do
for _dev in ${local_if_arr[@]} ; do
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $unifi_tcp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -i $_dev -p udp -d $_ip_ctl -m multiport --dports $unifi_udp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -i $_dev -p tcp -s $_ip_ctl -m multiport --dports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -i $_dev -p udp -s $_ip_ctl -m multiport --dports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $unifi_tcp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -i $_dev -p udp -d $_ip_ctl -m multiport --dports $unifi_udp_ctrl_in_ports -m conntrack --ctstate NEW -j ACCEPT
done
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
@ -4441,19 +4490,25 @@ if [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] \
if $local_alias_interfaces ; then
$ip6t -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $unifi_tcp_ctrl_in_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $unifi_tcp_ctrl_in_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $unifi_tcp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $unifi_tcp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p udp -d $_ip_ctl -m multiport --dports $unifi_udp_ctrl_in_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p udp -s $_ip_ctl -m multiport --sports $unifi_udp_ctrl_in_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p udp -d $_ip_ctl -m multiport --dports $unifi_udp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p udp -s $_ip_ctl -m multiport --sports $unifi_udp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
fi
done
# Rules already exists if 'local_unifi_controller_service = true'
#
if ! $local_unifi_controller_service ; then
$ip6t -A FORWARD -p tcp -m multiport --dports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -p udp -m multiport --dports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -p tcp -m multiport --sports $unifi_tcp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -p udp -m multiport --sports $unifi_udp_ctrl_out_ports -m conntrack --ctstate NEW -j ACCEPT
if $local_alias_interfaces ; then
$ip6t -A FORWARD -p tcp -m multiport --dports $unifi_tcp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -m multiport --sports $unifi_tcp_ctrl_out_ports --tcp-flag ACK ACK -j ACCEPT
fi
fi
echo_done
else
echo_skipped