firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support or blocking UPnP traffic (in and out).

Browse Source
This commit is contained in:
Christoph 2019-07-09 20:17:53 +02:00
parent 39ec118374
commit 8e94cdcd3b
6 changed files with 126 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
conf/logging_ipv4.conf
View File

@ -27,7 +27,9 @@ log_spoofed=false
log_spoofed_out=false
log_to_lo=false
log_not_wanted=false
log_blocked=false
log_blocked_ip=false
log_blocked_if=false
log_upnp=false
log_unprotected=false
log_prohibited=false
log_voip=false

3
conf/logging_ipv6.conf
View File

@ -27,7 +27,8 @@ log_spoofed=false
log_spoofed_out=false
log_to_lo=false
log_not_wanted=false
log_blocked=false
log_blocked_ip=false
log_blocked_if=false
log_unprotected=false
log_prohibited=false
log_voip=false

18
conf/main_ipv4.conf.sample
View File

@ -29,6 +29,24 @@ blocked_ifs=""
# =============
# --- Block UPnP Ports
# =============
# - block_upnp_traffic_in
# -
# - Block UPnP traffic (extern) in
#
block_upnp_traffic_in=true
# - block_upnp_traffic_out
# -
# - Block UPnP traffic (extern) out
#
block_upnp_traffic_out=true
# =============
# --- Interfaces not firewalled
# =============

18
conf/main_ipv6.conf.sample
View File

@ -29,6 +29,24 @@ blocked_ifs=""
# =============
# --- Block UPnP Ports
# =============
# - block_upnp_traffic_in
# -
# - Block UPnP traffic (extern) in
#
block_upnp_traffic_in=true
# - block_upnp_traffic_out
# -
# - Block UPnP traffic (extern) out
#
block_upnp_traffic_out=true
# =============
# --- Interfaces not firewalled
# =============

43
ip6t-firewall-gateway
View File

@ -325,6 +325,49 @@ done
echo_done # Block IPs / Networks / Interfaces..
# ---
# - Block UPnP Ports
# ---
echononl "\tBlock UPnP Traffic (extern in).."
if $block_upnp_traffic_in ; then
for _dev in ${ext_if_arr[@]} ; do
if $log_upnp || $log_all ; then
$ip6t -A INPUT -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ip6t -A INPUT -i $_dev -p udp --dport 1900 -j DROP
if $kernel_activate_forwarding ; then
$ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j DROP
done
echo_done
else
echo_skipped
fi
echononl "\tBlock UPnP Traffic (extern out).."
if $block_upnp_traffic_out ; then
for _dev in ${ext_if_arr[@]} ; do
if $log_upnp || $log_all ; then
$ip6t -A OUTPUT -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ip6t -A OUTPUT -o $_dev -p udp --dport 1900 -j DROP
if $kernel_activate_forwarding ; then
$ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j DROP
done
echo_done
else
echo_skipped
fi
# ---
# - Allow Forwarding certain private Addresses
# ---

42
ipt-firewall-gateway
View File

@ -610,6 +610,48 @@ done
echo_done # Block IPs / Networks / Interfaces..
# ---
# - Block UPnP Ports
# ---
echononl "\tBlock UPnP Traffic (extern in).."
if $block_upnp_traffic_in ; then
for _dev in ${ext_if_arr[@]} ; do
if $log_upnp || $log_all ; then
$ipt -A INPUT -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ipt -A INPUT -i $_dev -p udp --dport 1900 -j DROP
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ipt -A FORWARD -i $_dev -p udp --dport 1900 -j DROP
done
echo_done
else
echo_skipped
fi
echononl "\tBlock UPnP Traffic (extern out).."
if $block_upnp_traffic_out ; then
for _dev in ${ext_if_arr[@]} ; do
if $log_upnp || $log_all ; then
$ipt -A OUTPUT -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ipt -A OUTPUT -o $_dev -p udp --dport 1900 -j DROP
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ipt -A FORWARD -o $_dev -p udp --dport 1900 -j DROP
done
echo_done
else
echo_skipped
fi
# ---
# - Block IPs/Netwoks reading from file 'ban_ipv4.list'"