firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipt-firewall-server/ip6t-firewall-server: change order for 'Restrict Service/Net to..'.

Browse Source
This commit is contained in:
Christoph
2021-08-20 01:33:47 +02:00
parent 5ec7c9bcea
commit c65e0102ae
2 changed files with 125 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
ipt-firewall-server
View File

@ -1060,61 +1060,8 @@ $ipt -A OUTPUT -o lo -j ACCEPT
echo_done
# ---
# - Already established connections
# ---
echononl "\tAccept already established connections.."
$ipt -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A OUTPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
fi
echo_done
# -------------
# --- Allow all outgoing traffic
# -------------
echononl "\tAllow all outgoing traffic.."
if [[ -n "$allow_all_outgoing_traffic" ]] && $allow_all_outgoing_traffic ; then
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# - unprotected_ifs
# -
# - Posiible values are 'true' and 'false'
# -
allow_all_outgoing_traffic=false
# ---
# - Permit all traffic through VPN lines
# ---
echononl "\tPermit all traffic through VPN lines.."
for _vpn_if in ${vpn_if_arr[@]} ; do
$ipt -A INPUT -i $_vpn_if -m state --state NEW -j ACCEPT
$ipt -A OUTPUT -o $_vpn_if -m state --state NEW -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -i $_vpn_if -m state --state NEW -j ACCEPT
$ipt -A FORWARD -o $_vpn_if -m state --state NEW -j ACCEPT
fi
done
echo_done
echo
# -------------
# ---- Restrict local Servive to given (extern) IP-Address/Network
# -------------
@ -1128,7 +1075,7 @@ if [[ ${#restrict_local_service_to_net_arr[@]} -gt 0 ]] ; then
IFS=':' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do
$ipt -A INPUT -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m state --state NEW -j ACCEPT
$ipt -A INPUT -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -j ACCEPT
if ! containsElement "${_dev}:${_val_arr[1]}:${_val_arr[2]}:${_val_arr[3]}" "${_deny_service_arr[@]}" ; then
_deny_service_arr+=("${_dev}:${_val_arr[1]}:${_val_arr[2]}:${_val_arr[3]}")
@ -1181,6 +1128,61 @@ else
echo_skipped
fi
echo
# ---
# - Already established connections
# ---
echononl "\tAccept already established connections.."
$ipt -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A OUTPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
fi
echo_done
# -------------
# --- Allow all outgoing traffic
# -------------
echononl "\tAllow all outgoing traffic.."
if [[ -n "$allow_all_outgoing_traffic" ]] && $allow_all_outgoing_traffic ; then
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# - unprotected_ifs
# -
# - Posiible values are 'true' and 'false'
# -
allow_all_outgoing_traffic=false
# ---
# - Permit all traffic through VPN lines
# ---
echononl "\tPermit all traffic through VPN lines.."
for _vpn_if in ${vpn_if_arr[@]} ; do
$ipt -A INPUT -i $_vpn_if -m state --state NEW -j ACCEPT
$ipt -A OUTPUT -o $_vpn_if -m state --state NEW -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -i $_vpn_if -m state --state NEW -j ACCEPT
$ipt -A FORWARD -o $_vpn_if -m state --state NEW -j ACCEPT
fi
done
echo_done
# -------------
# --- Services