116 lines
2.8 KiB
Plaintext
116 lines
2.8 KiB
Plaintext
|
|
# ---
|
|
# - Install scripts
|
|
# ---
|
|
|
|
# - Copy firewall scripts to /usr/local/sbin
|
|
# -
|
|
cp -a /usr/local/src/ipt-server/ipt-firewall-server /usr/local/sbin/
|
|
cp -a /usr/local/src/ipt-server/ip6t-firewall-server /usr/local/sbin/
|
|
|
|
|
|
|
|
# ---
|
|
# - Configuration
|
|
# ---
|
|
|
|
# - Copy Configuration files to /etc/ipt-firewall
|
|
# -
|
|
mkdir /etc/ipt-firewall
|
|
|
|
cp /usr/local/src/ipt-server/conf/default_ports.conf \
|
|
/usr/local/src/ipt-server/conf/include_functions.conf \
|
|
/usr/local/src/ipt-server/conf/load_modules_ipv4.conf \
|
|
/usr/local/src/ipt-server/conf/load_modules_ipv6.conf \
|
|
/usr/local/src/ipt-server/conf/logging_ipv4.conf \
|
|
/usr/local/src/ipt-server/conf/logging_ipv6.conf \
|
|
/usr/local/src/ipt-server/conf/post_decalrations.conf /etc/ipt-firewall/
|
|
|
|
cp -a /usr/local/src/ipt-server/conf/ban_ipv4.list.sample /etc/ipt-firewall/ban_ipv4.list
|
|
cp -a /usr/local/src/ipt-server/conf/ban_ipv6.list.sample /etc/ipt-firewall/ban_ipv6.list
|
|
|
|
# - IPv4
|
|
# -
|
|
# - At least adjust files
|
|
# - /etc/ipt-firewall/interfaces_ipv4.conf
|
|
# - /etc/ipt-firewall/main_ipv4.conf
|
|
# -
|
|
cp /usr/local/src/ipt-server/conf/interfaces_ipv4.conf.sample /etc/ipt-firewall/interfaces_ipv4.conf
|
|
cp /usr/local/src/ipt-server/conf/main_ipv4.conf.sample /etc/ipt-firewall/main_ipv4.conf
|
|
|
|
vim /etc/ipt-firewall/interfaces_ipv4.conf
|
|
vim /etc/ipt-firewall/main_ipv4.conf
|
|
|
|
# - IPv6
|
|
# -
|
|
# - At least adjust files
|
|
# - /etc/ipt-firewall/interfaces_ipv6.conf
|
|
# - /etc/ipt-firewall/main_ipv6.conf
|
|
# -
|
|
cp /usr/local/src/ipt-server/conf/interfaces_ipv6.conf.sample /etc/ipt-firewall/interfaces_ipv6.conf
|
|
cp /usr/local/src/ipt-server/conf/main_ipv6.conf.sample /etc/ipt-firewall/main_ipv6.conf
|
|
|
|
vim /etc/ipt-firewall/interfaces_ipv6.conf
|
|
vim /etc/ipt-firewall/main_ipv6.conf
|
|
|
|
|
|
# IPv4
|
|
#
|
|
cat <<EOF > /etc/systemd/system/ipt-firewall.service
|
|
[Unit]
|
|
Description=IPv4 Firewall with iptables
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/ipt-firewall-server start
|
|
ExecStop=/usr/local/sbin/ipt-firewall-server stop
|
|
User=root
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
# IPv6
|
|
#
|
|
cat <<EOF > /etc/systemd/system/ip6t-firewall.service
|
|
[Unit]
|
|
Description=IPv6 Firewall with ip6tables
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/ip6t-firewall-server start
|
|
ExecStop=/usr/local/sbin/ip6t-firewall-server stop
|
|
User=root
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
|
|
## - Eanable script (for autostart at boot time)
|
|
## -
|
|
systemctl enable ipt-firewall.service
|
|
systemctl enable ip6t-firewall.service
|
|
|
|
## - Reload systemd configuration
|
|
## -
|
|
systemctl daemon-reload
|
|
|
|
|
|
## - Start Services
|
|
## -
|
|
systemctl start ipt-firewall
|
|
systemctl start ip6t-firewall
|
|
|
|
|
|
## - Add to /etc/rc.local
|
|
## -
|
|
## - sleep 2
|
|
## - systemctl restart ipt-firewall || /bin/true
|
|
## - systemctl restart ip6t-firewall || /bin/true
|
|
|