From b005fff18fbd9c0e6cf5d49a8b831a665f637920 Mon Sep 17 00:00:00 2001 From: Christoph Date: Thu, 18 Mar 2021 20:32:18 +0100 Subject: [PATCH] Add support for 'Webex Meeting'. --- conf/default_ports.conf | 17 ++++++++++++ conf/main_ipv4.conf.sample | 23 ++++++++++++++++ conf/main_ipv6.conf.sample | 23 ++++++++++++++++ ip6t-firewall-gateway | 55 +++++++++++++++++++++++++++++++------- ipt-firewall-gateway | 42 ++++++++++++++++++++++++++--- 5 files changed, 148 insertions(+), 12 deletions(-) diff --git a/conf/default_ports.conf b/conf/default_ports.conf index bd6e37b..faa166e 100644 --- a/conf/default_ports.conf +++ b/conf/default_ports.conf @@ -65,6 +65,23 @@ standard_mailuser_ports="587,465,110,995,143,993" standard_bigbluebutton_tcp_ports="$standard_http_ports" standard_bigbluebutton_udp_port_range="16384:32768" +# - Webex Meeting +# - +# - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming) +# - +# - UDP 9000: Outbound (VoIP and RTP) +# - +# - --- +# - +# - TCP 5004: Fall-back ports for media connectivity when UDP port 9000 +# - is not open in the firewall +# - +standard_webex_tcp_ports="$standard_http_ports" +standard_webex_udp_ports="9000" + +standard_webex_tcp_fall_back_ports="5004" + + # - Jitsi Video Conference Service # - standard_jitsi_tcp_ports="$standard_http_ports" diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample index 54d3c15..458385a 100644 --- a/conf/main_ipv4.conf.sample +++ b/conf/main_ipv4.conf.sample @@ -890,6 +890,28 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" + +# ====== +# - Webex Meeting +# ====== + +# - Webex Meeting (Videokonferenz) +# - +# - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming) +# - +# - UDP 9000: Outbound (VoIP and RTP) +# - +# - --- +# - +# - TCP 5004: Fall-back ports for media connectivity when UDP port 9000 +# - is not open in the firewall +# - +webex_tcp_ports="$standard_webex_tcp_ports" +webex_udp_ports="$standard_webex_udp_ports" + +webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports" + + # ====== # - Jitsi Video Conference Service # ====== @@ -1409,6 +1431,7 @@ allow_ipmi_request_out=true allow_remote_console_request_out=true allow_mumble_request_out=true allow_bigbluebutton_video_conference_out=true +allow_webex_video_conference_out=true allow_jitsi_video_conference_out=true allow_alfaview_video_conference_out=true allow_nc_talk_out=true diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample index 449a1eb..a064bdf 100644 --- a/conf/main_ipv6.conf.sample +++ b/conf/main_ipv6.conf.sample @@ -861,6 +861,28 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" + +# ====== +# - Webex Meeting +# ====== + +# - Webex Meeting (Videokonferenz) +# - +# - TCP 80/443: Outbound Client Zugriffsport und Webes Events (Audiostreaming) +# - +# - UDP 9000: Outbound (VoIP and RTP) +# - +# - --- +# - +# - TCP 5004: Fall-back ports for media connectivity when UDP port 9000 +# - is not open in the firewall +# - +webex_tcp_ports="$standard_webex_tcp_ports" +webex_udp_ports="$standard_webex_udp_ports" + +webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports" + + # ====== # - Jitsi Video Conference Service # ====== @@ -1354,6 +1376,7 @@ allow_ipmi_request_out=true allow_remote_console_request_out=true allow_mumble_request_out=true allow_bigbluebutton_video_conference_out=true +allow_webex_video_conference_out=true allow_jitsi_video_conference_out=true allow_nc_talk_out=true diff --git a/ip6t-firewall-gateway b/ip6t-firewall-gateway index a5cd1be..4285692 100755 --- a/ip6t-firewall-gateway +++ b/ip6t-firewall-gateway @@ -352,7 +352,7 @@ if $block_upnp_traffic_in ; then fi $ip6t -A INPUT -i $_dev -p udp --dport 1900 -j DROP - if $kernel_activate_forwarding ; then + if $kernel_forward_between_interfaces ; then $ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: " fi $ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j DROP @@ -371,7 +371,7 @@ if $block_upnp_traffic_out ; then fi $ip6t -A OUTPUT -o $_dev -p udp --dport 1900 -j DROP - if $kernel_activate_forwarding ; then + if $kernel_forward_between_interfaces ; then $ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: " fi $ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j DROP @@ -928,7 +928,7 @@ if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \ continue fi - if $kernel_activate_forwarding ; then + if $kernel_forward_between_interfaces ; then # - Nat if interface is on a dsl line # - @@ -943,7 +943,7 @@ if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \ # - Rule is needed if (local) interface aliases in use (like eth0:1) # - - if $kernel_activate_forwarding && $local_alias_interfaces ; then + if $kernel_forward_between_interfaces && $local_alias_interfaces ; then $ip6t -A FORWARD -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT $ip6t -A FORWARD -p ${_val_arr[2]} -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT fi @@ -2996,7 +2996,7 @@ if $allow_bigbluebutton_video_conference_out ; then if [[ "$bigbluebutton_tcp_ports" != "$standard_http_ports" ]] ; then $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $bigbluebutton_tcp_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $bigbluebutton_tcp_ports -m conntrack --ctstate NEW -j ACCEPT fi fi @@ -3014,6 +3014,43 @@ else fi +# --- +# - Webex Meeting Video Conference Service out only +# --- + +echononl "\t\tWebex Meeting Video Conference Service out only" + +if $allow_webex_video_conference_out ; then + for _dev in ${ext_if_arr[@]} ; do + + if [[ "$webex_tcp_ports" != "$standard_http_ports" ]] ; then + $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT + fi + fi + + if [[ -n "$webex_tcp_fall_back_ports" ]] ; then + $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT + fi + fi + + $ip6t -A OUTPUT -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT + + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + $ip6t -A FORWARD -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT + fi + + done + echo_done +else + echo_skipped +fi + + + # --- # - Jitsi Video Conference Service out only # --- @@ -3025,7 +3062,7 @@ if $allow_jitsi_video_conference_out ; then if [[ "$jitsi_tcp_ports" != "$standard_http_ports" ]] ; then $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT fi fi @@ -3056,18 +3093,18 @@ if $allow_alfaview_video_conference_out && ! $permit_local_net_to_inet ; then # if ! $allow_http_request_out ; then $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding ; then + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT fi fi $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding ; then + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT fi $ip6t -A OUTPUT -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding ; then + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then $ip6t -A FORWARD -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT fi diff --git a/ipt-firewall-gateway b/ipt-firewall-gateway index 5353f75..0212933 100755 --- a/ipt-firewall-gateway +++ b/ipt-firewall-gateway @@ -3723,6 +3723,42 @@ else fi +# --- +# - Webex Meeting Video Conference Service out only +# --- + +echononl "\t\tWebex Meeting Video Conference Service out only" + +if $allow_webex_video_conference_out ; then + for _dev in ${ext_if_arr[@]} ; do + + if [[ "$webex_tcp_ports" != "$standard_http_ports" ]] ; then + $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT + fi + fi + + if [[ -n "$webex_tcp_fall_back_ports" ]] ; then + $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT + fi + fi + + $ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT + + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + $ipt -A FORWARD -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT + fi + + done + echo_done +else + echo_skipped +fi + + # --- # - Jitsi Video Conference Service out only # --- @@ -3765,18 +3801,18 @@ if $allow_alfaview_video_conference_out && ! $permit_local_net_to_inet ; then # if ! $allow_http_request_out ; then $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding ; then + if $kernel_activate_forwarding && ! $permit_local_net_to_inet; then $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT fi fi $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding ; then + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT fi $ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT - if $kernel_activate_forwarding ; then + if $kernel_activate_forwarding && ! $permit_local_net_to_inet; then $ipt -A FORWARD -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT fi