Add support or blocking UPnP traffic (in and out).

conf/logging_ipv4.conf

@@ -27,7 +27,9 @@ log_spoofed=false
 log_spoofed_out=false
 log_to_lo=false
 log_not_wanted=false
-log_blocked=false
+log_blocked_ip=false
+log_blocked_if=false
+log_upnp=false
 log_unprotected=false
 log_prohibited=false
 log_voip=false

conf/logging_ipv6.conf

@@ -27,7 +27,8 @@ log_spoofed=false
 log_spoofed_out=false
 log_to_lo=false
 log_not_wanted=false
-log_blocked=false
+log_blocked_ip=false
+log_blocked_if=false
 log_unprotected=false
 log_prohibited=false
 log_voip=false

conf/main_ipv4.conf.sample

@@ -29,6 +29,24 @@ blocked_ifs=""
 
 
 
+# =============
+# --- Block UPnP Ports
+# =============
+
+# - block_upnp_traffic_in
+# -
+# - Block UPnP traffic (extern) in
+#
+block_upnp_traffic_in=true
+
+# - block_upnp_traffic_out
+# -
+# - Block UPnP traffic (extern) out
+#
+block_upnp_traffic_out=true
+
+
+
 # =============
 # --- Interfaces not firewalled
 # =============

conf/main_ipv6.conf.sample

@@ -29,6 +29,24 @@ blocked_ifs=""
 
 
 
+# =============
+# --- Block UPnP Ports
+# =============
+
+# - block_upnp_traffic_in
+# -
+# - Block UPnP traffic (extern) in
+#
+block_upnp_traffic_in=true
+
+# - block_upnp_traffic_out
+# -
+# - Block UPnP traffic (extern) out
+#
+block_upnp_traffic_out=true
+
+
+
 # =============
 # --- Interfaces not firewalled
 # =============

ip6t-firewall-gateway

@@ -325,6 +325,49 @@ done
 echo_done # Block IPs / Networks / Interfaces..
 
 
+# ---
+# - Block UPnP Ports
+# ---
+
+echononl "\tBlock UPnP Traffic (extern in).."
+
+if $block_upnp_traffic_in ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_upnp || $log_all ; then
+         $ip6t -A INPUT -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ip6t -A INPUT -i $_dev -p udp --dport 1900 -j DROP
+
+      if $kernel_activate_forwarding ; then
+         $ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j DROP
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+echononl "\tBlock UPnP Traffic (extern out).."
+
+if $block_upnp_traffic_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_upnp || $log_all ; then
+         $ip6t -A OUTPUT -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ip6t -A OUTPUT -o $_dev -p udp --dport 1900 -j DROP
+
+      if $kernel_activate_forwarding ; then
+         $ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j DROP
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
 # ---
 # - Allow Forwarding certain private Addresses
 # ---

ipt-firewall-gateway

@@ -610,6 +610,48 @@ done
 echo_done # Block IPs / Networks / Interfaces..
 
 
+# ---
+# - Block UPnP Ports
+# ---
+
+echononl "\tBlock UPnP Traffic (extern in).."
+
+if $block_upnp_traffic_in ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_upnp || $log_all ; then
+         $ipt -A INPUT -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ipt -A INPUT -i $_dev -p udp --dport 1900 -j DROP
+
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ipt -A FORWARD -i $_dev -p udp --dport 1900 -j DROP
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+echononl "\tBlock UPnP Traffic (extern out).."
+
+if $block_upnp_traffic_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      if $log_upnp || $log_all ; then
+         $ipt -A OUTPUT -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ipt -A OUTPUT -o $_dev -p udp --dport 1900 -j DROP
+
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
+      fi
+      $ipt -A FORWARD -o $_dev -p udp --dport 1900 -j DROP
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
 
 # ---
 # - Block IPs/Netwoks reading from file 'ban_ipv4.list'"