firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Drop traffic on extern interfaces iinto private networks.

Browse Source
This commit is contained in:
Christoph 2021-09-02 12:07:25 +02:00
parent c65e0102ae
commit c78edd01be
4 changed files with 55 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
conf/logging_ipv4.conf
View File

@ -30,6 +30,7 @@ log_invalid_state=false
log_invalid_flags=false log_invalid_flags=false
log_spoofed=false log_spoofed=false
log_spoofed_out=false log_spoofed_out=false
log_private_network_out=false
log_to_lo=false log_to_lo=false
log_not_wanted=false log_not_wanted=false
log_blocked=false log_blocked=false

1
conf/logging_ipv6.conf
View File

@ -30,6 +30,7 @@ log_invalid_state=false
log_invalid_flags=false log_invalid_flags=false
log_spoofed=false log_spoofed=false
log_spoofed_out=false log_spoofed_out=false
log_private_network_out=false
log_to_lo=false log_to_lo=false
log_not_wanted=false log_not_wanted=false
log_blocked=false log_blocked=false

24
ip6t-firewall-server
View File

@ -1023,6 +1023,30 @@ done
echo_done echo_done
# ---
# - Don't allow traffik into Unique local network (ULA)
# ---
echo ""
echononl "\tDon't allow traffic into Unique local network (ULA)"
if $log_private_network_out || $log_all ; then
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -d $ula_block -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofing Out: "
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -d $ula_block -j $LOG_TARGET $tag_log_prefix "$log_prefix Spoofing Out: "
fi
done
fi
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -d $ula_block -j DROP
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -d $ula_block -j DROP
fi
done
echo_done
# ------------- # -------------
# --- Services # --- Services
# ------------- # -------------

29
ipt-firewall-server
View File

@ -1184,6 +1184,35 @@ done
echo_done echo_done
# ---
# - Don't allow traffic into private networks
# ---
echo ""
echononl "\tDon't allow traffic into private anetworks"
for _dev in ${ext_if_arr[@]} ; do
if $log_private_network_out || $log_all ; then
$ipt -A OUTPUT -o $_dev -d $priv_class_a -j $LOG_TARGET $tag_log_prefix "$log_prefix out to priv Class A:"
$ipt -A OUTPUT -o $_dev -d $priv_class_b -j $LOG_TARGET $tag_log_prefix "$log_prefix out to priv Class B:"
$ipt -A OUTPUT -o $_dev -d $priv_class_c -j $LOG_TARGET $tag_log_prefix "$log_prefix out to priv Class C:"
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -d $priv_class_a -j $LOG_TARGET $tag_log_prefix "$log_prefix out to priv Class A:"
$ipt -A FORWARD -o $_dev -d $priv_class_b -j $LOG_TARGET $tag_log_prefix "$log_prefix out to priv Class B:"
$ipt -A FORWARD -o $_dev -d $priv_class_c -j $LOG_TARGET $tag_log_prefix "$log_prefix out to priv Class C:"
fi
fi
$ipt -A OUTPUT -o $_dev -d $priv_class_a -j DROP
$ipt -A OUTPUT -o $_dev -d $priv_class_b -j DROP
$ipt -A OUTPUT -o $_dev -d $priv_class_c -j DROP
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -d $priv_class_a -j DROP
$ipt -A FORWARD -o $_dev -d $priv_class_b -j DROP
$ipt -A FORWARD -o $_dev -d $priv_class_c -j DROP
fi
done
echo_done
# ------------- # -------------
# --- Services # --- Services
# ------------- # -------------