change rules and location of rules for 'Allow forwarding (private) IPs'.
This commit is contained in:
parent
96b3e162fe
commit
c8b7e9b0f5
@ -307,8 +307,8 @@ esac
|
||||
# --- Pass through Devices Interfaces (not firewalled)
|
||||
# -------------
|
||||
|
||||
if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
|
||||
echononl "\tPass through Devices (not firewalled)"
|
||||
if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
|
||||
for _dev in ${unprotected_if_arr[@]} ; do
|
||||
if $log_unprotected || $log_all ; then
|
||||
$ip6t -A INPUT -i $_dev -j $LOG_TARGET $tag_log_prefix "$log_prefix Not firewalled ${_dev}: "
|
||||
@ -322,6 +322,24 @@ if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
|
||||
$ip6t -A FORWARD -o $_dev -j ACCEPT
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow Forwarding certain private Addresses
|
||||
# ---
|
||||
|
||||
echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
|
||||
if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip in ${forward_private_ip_arr[@]}; do
|
||||
$ip6t -t mangle -A PREROUTING -d $_ip -j ACCEPT
|
||||
$ip6t -t mangle -A PREROUTING-s $_ip -j ACCEPT
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
@ -497,26 +515,6 @@ else
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow Forwarding certain private Addresses
|
||||
# ---
|
||||
|
||||
if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
|
||||
echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
|
||||
for _ip in ${forward_private_ip_arr[@]}; do
|
||||
$ip6t -A OUTPUT -d $_ip -j ACCEPT
|
||||
$ip6t -A INPUT -s $_ip -j ACCEPT
|
||||
if $kernel_forward_between_interfaces ; then
|
||||
$ip6t -A FORWARD -d $_ip -j ACCEPT
|
||||
$ip6t -A FORWARD -s $_ip -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Protections against several attacks / unwanted packages
|
||||
|
||||
@ -183,6 +183,7 @@ fi
|
||||
# --- Adjust Kernel Parameters (Security/Tuning)
|
||||
# -------------
|
||||
|
||||
echo ""
|
||||
echononl "\tAdjust Kernel Parameters (Security/Tuning).."
|
||||
|
||||
if ! $host_is_vm ; then
|
||||
@ -366,8 +367,8 @@ esac
|
||||
# --- Pass through Devices Interfaces (not firewalled)
|
||||
# -------------
|
||||
|
||||
if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
|
||||
echononl "\tPass through Devices (not firewalled)"
|
||||
if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
|
||||
for _dev in ${unprotected_if_arr[@]} ; do
|
||||
if $log_unprotected || $log_all ; then
|
||||
$ipt -A INPUT -i $_dev -j $LOG_TARGET $tag_log_prefix "$log_prefix Not firewalled ${_dev}:"
|
||||
@ -381,9 +382,26 @@ if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
|
||||
$ipt -A FORWARD -o $_dev -j ACCEPT
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow Forwarding certain private Addresses
|
||||
# ---
|
||||
|
||||
echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
|
||||
if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip in ${forward_private_ip_arr[@]}; do
|
||||
$ipt -t mangle -A PREROUTING -d $_ip -j ACCEPT
|
||||
$ipt -t mangle -A PREROUTING -s $_ip -j ACCEPT
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Block IPs / Networks / Interfaces
|
||||
@ -622,26 +640,6 @@ else
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow Forwarding certain private Addresses
|
||||
# ---
|
||||
|
||||
if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
|
||||
echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
|
||||
for _ip in ${forward_private_ip_arr[@]}; do
|
||||
$ipt -A OUTPUT -d $_ip -j ACCEPT
|
||||
$ipt -A INPUT -s $_ip -j ACCEPT
|
||||
if $kernel_activate_forwarding ; then
|
||||
$ipt -A FORWARD -d $_ip -j ACCEPT
|
||||
$ipt -A FORWARD -s $_ip -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Protections against several attacks / unwanted packages
|
||||
@ -745,32 +743,32 @@ echo_done
|
||||
echononl "\tBlock spoofed (private/reserved) packets"
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
if $log_spoofed || $log_all ; then
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $class_d_multicast -j $LOG_TARGET $tag_log_prefix "$log_prefix Class D Multicast: "
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $link_local_rfc_5735 -j $LOG_TARGET $tag_log_prefix "$log_prefix link local block: "
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $priv_class_b -j $LOG_TARGET $tag_log_prefix "$log_prefix Class A private net: "
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $test_net_1_rfc_5735 -j $LOG_TARGET $tag_log_prefix "$log_prefix TEST-NET-1: "
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $priv_class_c -j $LOG_TARGET $tag_log_prefix "$log_prefix Class C private net: "
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $priv_class_a -j $LOG_TARGET $tag_log_prefix "$log_prefix Class A private net: "
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $this_net_rfc_5735 -j $LOG_TARGET $tag_log_prefix "$log_prefix THIS NET: "
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $class_e_reserved -j $LOG_TARGET $tag_log_prefix "$log_prefix Class E reserved: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $class_d_multicast -j $LOG_TARGET $tag_log_prefix "$log_prefix Class D Multicast: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $link_local_rfc_5735 -j $LOG_TARGET $tag_log_prefix "$log_prefix link local block: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $priv_class_b -j $LOG_TARGET $tag_log_prefix "$log_prefix Class A private net: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $test_net_1_rfc_5735 -j $LOG_TARGET $tag_log_prefix "$log_prefix TEST-NET-1: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $priv_class_c -j $LOG_TARGET $tag_log_prefix "$log_prefix Class C private net: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $priv_class_a -j $LOG_TARGET $tag_log_prefix "$log_prefix Class A private net: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $this_net_rfc_5735 -j $LOG_TARGET $tag_log_prefix "$log_prefix THIS NET: "
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $class_e_reserved -j $LOG_TARGET $tag_log_prefix "$log_prefix Class E reserved: "
|
||||
fi
|
||||
done
|
||||
|
||||
if $log_spoofed || $log_all ; then
|
||||
/sbin/iptables -t mangle -A PREROUTING -s $loopback_ipv4 ! -i lo -j $LOG_TARGET $tag_log_prefix "$log_prefix (loopback): "
|
||||
$ipt -t mangle -A PREROUTING -s $loopback_ipv4 ! -i lo -j $LOG_TARGET $tag_log_prefix "$log_prefix (loopback): "
|
||||
fi
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $class_d_multicast -j DROP
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $link_local_rfc_5735 -j DROP
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $priv_class_b -j DROP
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $test_net_1_rfc_5735 -j DROP
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $priv_class_c -j DROP
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $priv_class_a -j DROP
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $this_net_rfc_5735 -j DROP
|
||||
/sbin/iptables -t mangle -A PREROUTING -i $_dev -s $class_e_reserved -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $class_d_multicast -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $link_local_rfc_5735 -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $priv_class_b -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $test_net_1_rfc_5735 -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $priv_class_c -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $priv_class_a -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $this_net_rfc_5735 -j DROP
|
||||
$ipt -t mangle -A PREROUTING -i $_dev -s $class_e_reserved -j DROP
|
||||
done
|
||||
/sbin/iptables -t mangle -A PREROUTING -s $loopback_ipv4 ! -i lo -j DROP
|
||||
$ipt -t mangle -A PREROUTING -s $loopback_ipv4 ! -i lo -j DROP
|
||||
echo_done
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user