rc.firewall.local

Partly in response to a question posed by Kevin Wall in the thread
"Re: [IPCop-user] GNU C Library: Multiple vulnerabilities".

I offer this as a replacement rc.firewall.local

8< ----------------------------------------------------------------------------
#!/bin/sh
# Used for local firewall rules

eval $(/usr/local/bin/readhash /var/ipcop/ethernet/settings)
if [ -f /var/ipcop/red/iface ]; then
         REAL_RED=`cat /var/ipcop/red/iface`
fi

# -----------------------------------------------------------------------------
# Inserting rules at the top of a chain, they appear in the reverse order.
iptables_insert_rules()
{
cat - << EOF

EOF
}

# -----------------------------------------------------------------------------
# Appending rules to a chain, they appear in the listed order.
iptables_append_rules()
{
cat - << EOF
  CUSTOMINPUT -p udp -m udp --dport 53 -m length --length 513:65535 -j DROP
  CUSTOMINPUT -p tcp -m tcp --dport 53 -m length --length 1025:65535 -j DROP

EOF
}

# -----------------------------------------------------------------------------
handle_rules()
{
ACTION=$1

grep -v -e "^[   ]*#" -e "^[     ]*$" |
while read RULE
do
         /sbin/iptables ${ACTION} ${RULE} 2>&1
         if [ $? -ne 0 ]
         then
                 echo "/sbin/iptables ${ACTION} ${RULE}"
         fi
done
}

# -----------------------------------------------------------------------------
start()
{
echo "Loading local firewall rules"
# Flush the custom chains. Do not flush any other chains.
/sbin/iptables -F CUSTOMPREROUTING -t nat 2>&1
/sbin/iptables -F CUSTOMINPUT 2>&1
/sbin/iptables -F CUSTOMFORWARD 2>&1
/sbin/iptables -F CUSTOMOUTPUT 2>&1
/sbin/iptables -F CUSTOMPOSTROUTING -t nat 2>&1

iptables_append_rules | handle_rules -A
iptables_insert_rules | handle_rules -I
}

# -----------------------------------------------------------------------------
stop()
{
echo "Unloading local firewall rules"
iptables_append_rules | handle_rules -D
iptables_insert_rules | handle_rules -D
}

# =============================================================================
# See how we were called.
case "$1" in
   start)
         start
         ;;
   stop)
         stop
         ;;
   reload)
         stop
         start
         ;;
   *)
         echo "Usage: $0 {start|stop|reload}"
esac
8< ----------------------------------------------------------------------------

Rules are added to the "append" or "insert" functions in the form:
  <chain> <arguments>

for example:
  CUSTOMINPUT -p udp -m udp --dport 53 -m length --length 513:65535 -j DROP

the "iptables -A", "iptables -I" or "iptables -D" being prepended at runtime.

Rules can be commented out with a # at the beginning of the line.
#CUSTOMINPUT -p udp -m udp --dport 53 -m length --length 513:65535 -j DROP

The assumption is made that the CUSTOM* chains are only ever changed from this
script so the CUSTOM chains are flushed on start.

You can append or insert rules into other chains but do not "flush" any other
than the CUSTOM chains.

The script allows the appending/insertion/deletion of rules requiring only
one definition of the rule.

Hope others find this useful.
-- 
Regards
	Richard


------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user