Changes to rocknet_iptables.sh
"Andreas V. Meier" <[email protected]>
| Newsgroups | gmane.linux.distributions.rock.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi,
I was missing advanced functionality in rocknet_iptables.sh and did not want
to fire up fwbuilder for just small tasks. Here is an explanation what came
out from my dance with the mentioned script:
1. New semantics for old stuff:
OLDRULE := BEHAVIOUR CONDITIONS
CONDITIONS := ICMPSPEC
| DIRSPEC PROTSPEC
| <empty>
ICMPSPEC := icm <icmp-type>
DIRSPEC := from | to
PROTSPEC := L4PROTSPEC <port-nr>
| ip <ip-address>
| all
L4PROTSPEC := tcp | udp
The main changes are:
- The "to" flag, which before was implicit if no direction was specified now
explicitly needs to be specified
- The direction needs to be specified before the protocol, not after as
before.
2. Masquerading now also parses conditions
This allows to masquerade only certain source ip's, or maybe just to certain
destinations. A complete example is attached (if I won't forget it).
3. Introduced logging
This allows to specifiy a rule with the logging target. This is an addition to
the basic module. Logging is also supported by the advanced firewall
manipulation command described next.
4. Introduce new firewall command "fw"
This command allows extensive specification of firewall rules, including the
creation of new chains and jumping around between them. I coded it because I
wanted a simple accounting, which needs 2 layers of chains to filter out the
necessary ip's. The command is valid in the interface section and in the main
section.
The syntax basically is in the interface section like:
FWRULEIF := fw TARGETSPEC IOSPEC CONDITIONS
And in the general section:
FWRULEGEN := fw TARGETSPEC CHAINSPEC CONDITIONS
| fw TARGETSPEC CHAINSPEC policy
ACTSPEC := forward IOSPEC | POLICYSPEC IOCHAINSPEC
| POLICYSPEC <chain-name> IOSPEC
IOSPEC := in | out
TARGETSPEC := accept | reject | drop | return | log | CHAINSPEC
CHAINSPEC := <chain-name>
The difference to the general section is that there are no directions needed,
but the chain needs to be explicitly stated. In the interface section the
chain is derived from the IOSPEC.
In the general section it is further possible to specify a general chain
policy using the special keyword "policy" as stated above.
So, I hope I have not messed something up in my description. Attached you will
find a config file as I use this all. Maybe you like it, if not, please give
constructive criticism!
Ciao
Andreas
--
May the source be with you!
_______________________________________________
rock-devel mailing list
[email protected]
http://www.rocklinux.net/mailman/listinfo/rock-devel
new.network.config
(text/plain, 2.4 KB)
### automatically set up interface eth0 on startup auto eth0 eth1 forward # general policy # fw drop incoming policy # accounting rules fw accept ACCOUNT from ip 172.16.0.1/32 fw accept ACCOUNT from ip 172.16.0.2/32 fw accept ACCOUNT from ip 172.16.0.3/32 fw accept ACCOUNT from ip 172.16.0.4/32 fw accept ACCOUNT to ip 172.16.0.1/32 fw accept ACCOUNT to ip 172.16.0.2/32 fw accept ACCOUNT to ip 172.16.0.3/32 fw accept ACCOUNT to ip 172.16.0.4/32 fw accept ACCOUNT to ip 123.123.123.123 fw accept ACCOUNT from ip 123.123.123.123 # prevent private subnets from being accounted fw accept PREACC from ip 192.168.0.0/16 fw accept PREACC to ip 192.168.0.0/16 fw accept PREACC from ip 10.0.0.0/8 fw accept PREACC to ip 10.0.0.0/8 fw accept PREACC from ip 123.123.123.123/19 fw accept PREACC to ip 123.123.123.123/19 fw ACCOUNT PREACC # fw accept PREACCOUT to ip 172.16.0.0/12 fw accept PREACCOUT to ip 192.168.0.0/16 fw accept PREACCOUT to ip 10.0.0.0/8 fw accept PREACCOUT to ip 123.123.123.123/19 fw ACCOUNT PREACCOUT # fw accept PREACCIN from ip 172.16.0.0/12 fw accept PREACCIN from ip 192.168.0.0/16 fw accept PREACCIN from ip 10.0.0.0/8 fw accept PREACCIN from ip 123.123.123.123/19 fw ACCOUNT PREACCIN ### interface eth1 is connected to the campus network interface eth1(43) run_down /root/account.pl address 00:0b:5d:0e:61:83 ip 123.123.123.123/26 gw 123.123.123.1 # nameserver 123.123.123.53 # firewall rules # account locally generated packets and incoming packets fw PREACCIN in fw PREACCOUT out fw accept out fw accept in to tcp ssh fw accept in icmp ping fw drop in from ip 0.0.0.0 to ip 255.255.255.255 to udp 67 from udp 68 fw log in fw log out masquerade from ip 172.16.0.2/32 masquerade from ip 172.16.0.3/32 masquerade from ip 172.16.0.4/32 ### interface eth0 is connected to the internal network interface eth0(43) address 01:23:45:67:89:AB ip 172.16.0.1/24 search dorms.spbu.ru nameserver 172.16.0.1 # netrunner fw PREACC forward in from ip 172.16.0.2/32 fw PREACC forward out to ip 172.16.0.2/32 # baton fw PREACC forward in from ip 172.16.0.3/32 fw PREACC forward out to ip 172.16.0.3/32 # lev fw PREACC forward in from ip 172.16.0.4/32 fw PREACC forward out to ip 172.16.0.4/32 # allow access from internal network fw accept in from ip 172.16.0.1 fw accept in from ip 172.16.0.2 fw accept in from ip 172.16.0.3 fw accept in from ip 172.16.0.4 fw reject in fw reject forward in
signature.asc
(application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) iD8DBQBDnK9W2A9/vRi9PS4RAjZ3AJ4nj7n+FWmUmV3/KyMBATdb/Q2I9wCePK7q vyvrbPbtgf6apASRJg1yoQk= =SMcQ -----END PGP SIGNATURE-----