firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ip6t-firewall-server: change name of created ftpdata list to ftp6date_

Browse Source
This commit is contained in:
Christoph 2019-03-02 21:11:12 +01:00
parent 45b3274c03
commit 39529f7f54
1 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
ip6t-firewall-server
View File

@ -1333,7 +1333,7 @@ echononl "\t\tFTP Server (using CT target)"
if [[ ${#ftp_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_ftp_server_ip_arr[@]} -gt 0 ]] ; then
# - Used for different ftpdata recent lists 'ftpdata_$i'
# - Used for different ftp6data recent lists 'ftp6data_$i'
# -
declare -i i=1
@ -1355,27 +1355,27 @@ if [[ ${#ftp_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_ftp_server_ip_arr[@]} -
# - ======================================================
# -
# - Workaround:
# - (1) add source ip to a 'recent list' named 'ftpdata_$i! if ftp control connections appear
# - (2) accept packets of the formaly created recent list 'ftpdata_$i!
# - (1) add source ip to a 'recent list' named 'ftp6data_$i! if ftp control connections appear
# - (2) accept packets of the formaly created recent list 'ftp6data_$i!
# -
# =====
# - (1)
# -
# - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftpdata_$i'.
# - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftp6data_$i'.
# -
$ip6t -A INPUT -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftpdata_$i --set -j ACCEPT
$ip6t -A INPUT -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftp6data_$i --set -j ACCEPT
# - (2)
# - - Accept packets if the source ip-address is in the 'ftpdata_$i' list (--update) and the
# - - Accept packets if the source ip-address is in the 'ftp6data_$i' list (--update) and the
# - source ip-address was seen within the last 1800 seconds (--seconds 1800).
# -
# - - If matched, the "last seen" timestamp of the source address will be updated (--update).
# -
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
# - - Entries in the ftp6data list not seen in the last 1800 will be removed (--reap).
# -
$ip6t -A INPUT -p tcp -m state --state NEW --sport 1024: -d $_ip --dport $ftp_passive_port_range \
-m recent --name ftpdata_$i --update --seconds 1800 --reap -j ACCEPT
-m recent --name ftp6data_$i --update --seconds 1800 --reap -j ACCEPT
# - Accept (helper ftp) related connections
# -
@ -1396,29 +1396,29 @@ if [[ ${#ftp_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_ftp_server_ip_arr[@]} -
# - ======================================================
# -
# - Workaround:
# - (1) add source ip to a 'recent list' named 'ftpdata_$i! if ftp control connections appear
# - (2) accept packets of the formaly created recent list 'ftpdata_$i!
# - (1) add source ip to a 'recent list' named 'ftp6data_$i! if ftp control connections appear
# - (2) accept packets of the formaly created recent list 'ftp6data_$i!
# -
# =====
# - (1)
# -
# - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftpdata_$i'.
# - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftp6data_$i'.
# -
$ip6t -A FORWARD -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftpdata_$i --set -j ACCEPT
$ip6t -A FORWARD -p tcp -m state --state NEW -d $_ip --dport 21 -m recent --name ftp6data_$i --set -j ACCEPT
# - (2)
# - - Accept packets if the source ip-address is in the 'ftpdata_$i' list (--update) and the
# - - Accept packets if the source ip-address is in the 'ftp6data_$i' list (--update) and the
# - source ip-address was seen within the last 1800 seconds (--seconds 1800).
# -
# - - If matched, the "last seen" timestamp of the source address will be updated (--update).
# -
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
# - - Entries in the ftp6data list not seen in the last 1800 will be removed (--reap).
# -
$ip6t -A FORWARD -p tcp -m state --state NEW --sport 1024: -d $_ip --dport $ftp_passive_port_range \
-m recent --name ftpdata_$i --update --seconds 1800 --reap -j ACCEPT
-m recent --name ftp6data_$i --update --seconds 1800 --reap -j ACCEPT
$ip6t -A FORWARD -p tcp -m state --state NEW --dport 1024: -s $_ip --sport $ftp_passive_port_range \
-m recent --name ftpdata_$i --update --seconds 1800 --reap -j ACCEPT
-m recent --name ftp6data_$i --update --seconds 1800 --reap -j ACCEPT
# - Accept (helper ftp) related connections
# -