firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- Add 'any_access_from_inet_networks'

Browse Source 
- Add 'allow_ext_net_to_local_service'
- Add 'allow_ext_net_to_local_net'
- Add 'block_all_ext_to_local_net'
This commit is contained in:
Christoph
2017-05-04 01:22:52 +02:00
parent 528b43ff11
commit a2fe7ce5ff
5 changed files with 430 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
ip6t-firewall-gateway
View File

@ -812,6 +812,86 @@ else
fi
echononl "\tAllow these local networks any access from the internet"
if [[ ${#any_access_from_inet_network_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _net in ${any_access_from_inet_network_arr[@]}; do
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A FORWARD -i $_dev -p ALL -d $_net -m conntrack --ctstate NEW -j ACCEPT
done
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local services from given extern networks
# ---
echononl "\tAllow local services from given extern networks"
if [[ ${#allow_ext_net_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in "${allow_ext_net_to_local_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A FORWARD -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
done
done
echo_done
else
echo_skipped
fi
# ---
# - Allow all traffic from extern address/network to local address/network
# ---
echononl "\tAllow all traffic from extern to local network/address"
if [[ ${#allow_ext_net_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in ${allow_ext_net_to_local_net_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A FORWARD -p ALL -i $_dev -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
done
done
echo_done
else
echo_skipped
fi
# ---
# - Block all extern traffic to (given) local network
# ---
echononl "\tBlock all extern traffic to (given) local network"
if [[ ${#block_all_ext_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _net in ${block_all_ext_to_local_net_arr[@]} ; do
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A FORWARD -p ALL -i $_dev -d $_net -m conntrack --ctstate NEW -j DROP
done
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local services from given local networks
@ -819,8 +899,7 @@ fi
echononl "\tAllow local services from given local networks"
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \
&& ! $permit_local_net_to_inet ; then
&& $kernel_forward_between_interfaces ; then
for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
@ -852,8 +931,7 @@ fi
echononl "\tAllow all traffic from local network to local ip-address"
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \
&& ! $permit_between_local_networks ; then
&& $kernel_forward_between_interfaces ; then
for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"
@ -882,8 +960,7 @@ fi
echononl "\tAllow all traffic from local ip-address to local network"
if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \
&& ! $permit_between_local_networks ; then
&& $kernel_forward_between_interfaces ; then
for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"
@ -912,8 +989,7 @@ fi
echononl "\tAllow all traffic from local network to (another) local network"
if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \
&& ! $permit_between_local_networks ; then
&& $kernel_forward_between_interfaces ; then
for _val in ${allow_local_net_to_local_net_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"
@ -942,8 +1018,7 @@ fi
echononl "\tAllow local ip address from given local interface"
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \
&& ! $permit_between_local_networks ; then
&& $kernel_forward_between_interfaces ; then
for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"