API tools faq
paste
Advertisement
Guest User

iptable script

a guest
Apr 20th, 2018
117
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.17 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. ### BEGIN INIT INFO
  3. # Provides: rc.firewall
  4. # Required-Start: $syslog
  5. # Required-Stop: $syslog
  6. # Default-Start: 2 3 4 5
  7. # Default-Stop: 0 1 6
  8. ### END INIT INFO
  9. #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
  10. # [---::NOM - VERSION - DATE::---]
  11. # rc.firewall.sh - 0.2 - 25/09/2012
  12. # JoShua Sign_
  13.  
  14. # [---::DESCRIPTIF::---]
  15. # Script de configuration automatique de firewall
  16. # Ce script est destine à mettre en place un firewall de base
  17.  
  18. # [---::PARAMETRES::---]
  19. # Ce script prend en parametres :
  20. # start
  21. # stop
  22. # restart
  23. # status
  24. #
  25.  
  26. # [---::RETOUR::---]
  27. # Ce script ne renvoit aucune valeur
  28. #
  29.  
  30. # [---::AMELIORATIONS::---]
  31. # plein ^^
  32.  
  33.  
  34. # PARAMETTRES :
  35. #
  36. # Nom des cartes :
  37. # Laisser vide si une carte n'est pas utilisee
  38. #
  39. # Cote LAN:
  40. LAN=eth1
  41. #
  42. # Cote WAN:
  43. WAN=eth0
  44.  
  45.  
  46. #
  47. # - Ouverture des ports
  48. #
  49. # Specifiez le port à ouvrir (tcp par defaut)
  50. # Facultativement vous pouvez specifier un protocole :
  51. # par exemple : 80 ou 53/tcp ou 53/udp
  52. #
  53. LAN_PORTS='22 443 80 3306 123/udp 137/udp 138/udp 139 445 8022 10000'
  54. WAN_PORTS='22 123/udp 4000'
  55.  
  56. #
  57. # La redirection des ports WAN
  58. #
  59. # Un connection entrant du WAN sur le port 6060 peut en fait etre
  60. # rediriger vers le LAN sur le poste 192.168.0.10 port 80
  61. # On defini donc : WAN_PORT/LAN_PC:LOCAL_PORT
  62. LAN_REDIRECT='8022/172.16.254.3:22'
  63. #WAN_REDIRECT='20/129.10.0.6:20 21/129.10.0.6:21 80/129.10.0.6:80 443/129.10.0.9:443 25/129.10.0.9:25 993/129.10.0.9:993 90/129.10.0.6:90 100/129.10.1.1:80'
  64. WAN_REDIRECT='4000/10.0.0.35:22'
  65.  
  66. # Nating spécifique :
  67. #NATING_LAN2WAN='10.0.0.30#172.16.254.0/24 10.0.0.20#172.16.254.0/24 10.0.0.10#172.16.254.0/24 10.0.0.22#172.16.254.0/24'
  68. #NATING_WAN2LAN='172.16.254.0/24#10.0.0.30 172.16.254.0/24#10.0.0.20 172.16.254.0/24#10.0.0.10 172.16.254.0/24#10.0.0.22'
  69. NATING_LAN2WAN='10.0.0.0/23#172.16.254.0/24'
  70. NATING_WAN2LAN='172.16.254.0/24#10.0.0.0/23'
  71.  
  72. #
  73. # Sous reseaux locaux auquels il faut repondre
  74. #
  75. # Indiquer sous la forme suivante
  76. #ROUTES="192.168.1.0/255.255.255.0/129.10.0.254 129.10.0.0/255.255.0.0/192.168.1.254"
  77. # reseau/masque/routeur
  78. # ainsi le forwarding est active entre le reseau local et les autres sous-reseaux
  79. # les routes sont crees vers les bon routeurs
  80. #ROUTES="192.168.1.0/255.255.255.0/129.10.200.254 192.168.2.0/255.255.255.0/129.10.200.254"
  81.  
  82. # Activation du forwarding (si il y a des route c'est implicite)
  83. FORWARDING="1"
  84.  
  85. #
  86. # Activation du masquerading pour utiliser comme passerelle
  87. # attention le FROWARDING est du coup automatiquement active
  88. #
  89. #LAN_MASQUERADE="1"
  90.  
  91. #
  92. # 1 = Activer les regles pour proxy transparent
  93. # 0 = Pas de proxy Tansparent
  94. #
  95. #
  96. #PROXY_HTTP="1"
  97.  
  98. #
  99. # Precisez le port du proxy
  100. #
  101. # PROXY_PORT="8080"
  102.  
  103. #
  104. # DNS Serveurs
  105. #
  106. #OPEN_DNS="194.2.0.20 194.2.0.50"
  107.  
  108. #
  109. # Reponse au ping depuis le LAN oui / non
  110. #
  111. ICMP_RESPONSE_CARDS="$LAN $WAN"
  112.  
  113. #
  114. # Conserver les connexions existantes
  115. #
  116. KEEP_ACTIVES_CONN="1"
  117.  
  118. #
  119. # ====================
  120. # FIN DES PARAMETRES
  121. # ====================
  122. GRIS="\033[40m\033[1;30m"
  123. ROUG="\033[40m\033[1;31m"
  124. VERT="\033[40m\033[1;32m"
  125. JAUN="\033[40m\033[1;33m"
  126. BLEU="\033[40m\033[1;34m"
  127. FUSH="\033[40m\033[1;35m"
  128. CIAN="\033[40m\033[1;36m"
  129. BLAN="\033[40m\033[1;37m"
  130. FIN="\033[0m"
  131.  
  132.  
  133.  
  134. ## Liste des interface disponibles, sans la boucle locale:
  135. all_interfaces=$(ip a | grep -E "^[0-9]" | cut -d: -f2 | tr -d ' ' | grep -v "^lo$")
  136. for interface in $all_interfaces
  137. do
  138. ifconf=$(ifconfig $interface | grep -i -E "inet ad+r:")
  139.  
  140. if [ "$ifconf" != "" ]; then
  141.  
  142. address=$(ifconfig $interface | grep -i -E "inet ad+r:" | cut -d: -f2 | cut -d" " -f1)
  143. broadcast=$(ifconfig $interface | grep -i -E "inet ad+r:" | cut -d: -f3 | cut -d" " -f1)
  144. netmask=$(ifconfig $interface | grep -i -E "inet ad+r:" | cut -d: -f4 | cut -d" " -f1)
  145. gateway=$(netstat -rn | grep $interface | grep UG | awk '{print $2}')
  146. network=$(netstat -rn | grep $interface | grep -F "$netmask" | awk '{print $1}')
  147.  
  148. if [ "$interface" == "$LAN" ]; then
  149. LAN=$interface
  150. LAN_ADDRESS=$address
  151. LAN_NETMASK=$netmask
  152. LAN_GATEWAY=$gateway
  153. LAN_NETWORK=$network
  154. LAN_BRDCAST=$broadcast
  155. elif [ "$interface" == "$WAN" ]; then
  156. WAN=$interface
  157. WAN_ADDRESS=$address
  158. WAN_NETMASK=$netmask
  159. WAN_GATEWAY=$gateway
  160. WAN_NETWORK=$network
  161. WAN_BRDCAST=$broadcast
  162. fi
  163. fi
  164. done
  165.  
  166.  
  167. bandeau_start()
  168. {
  169. echo ""
  170. echo -e " $BLEU-------------------------------------------$FIN "
  171. echo -e " $VERT-------> Firewall script by JoSh_ <-------$FIN "
  172. echo -e " $BLEU-------------------------------------------$FIN "
  173. echo ""
  174. }
  175.  
  176. init_variables()
  177. {
  178. # Creation des variables locales !
  179. echo -e "\033[40m\033[1;33m -> Variables :$FIN"
  180.  
  181. if [ "$LAN" != "" ]
  182. then
  183. echo " - Carte LAN : $LAN"
  184. echo " IP : $LAN_ADDRESS"
  185. echo " Masque : $LAN_NETMASK"
  186. echo " Reseau : $LAN_NETWORK"
  187. echo " Broadcast : $LAN_BRDCAST"
  188. echo " Passerelle : $LAN_GATEWAY"
  189. fi
  190.  
  191. if [ "$WAN" != "" ]
  192. then
  193. echo " "
  194. echo " - Carte WAN : $WAN"
  195. echo " IP : $WAN_ADDRESS"
  196. echo " NetMask : $WAN_NETMASK"
  197. echo " Reseau : $WAN_NETWORK"
  198. echo " Broadcast : $WAN_BRDCAST"
  199. echo " Passerelle : $WAN_GATEWAY"
  200. fi
  201. echo " "
  202. }
  203.  
  204. init_modules()
  205. {
  206. modprobe=/sbin/modprobe
  207. modules_liste="ipt_state ipt_LOG ip_conntrack ip_conntrack_ftp ip_nat_ftp"
  208. for module in $modules_liste
  209. do
  210. $modprobe $module || echo -e "$ROUGE -> Impossible de charger le module : $FIN $JAUN$module$FIN"
  211. done
  212. }
  213.  
  214. init_rules()
  215. {
  216. if [ "$1" == "ACCEPT" ]
  217. then
  218. COLOR=$VERT
  219. else
  220. COLOR=$ROUG
  221. fi
  222. echo -e "$JAUN -> Init des regles par default : $FIN $COLOR$1$FIN"
  223. iptables -F INPUT
  224. iptables -F FORWARD
  225. iptables -F OUTPUT
  226. iptables -t filter -F
  227. iptables -t filter -X
  228. iptables -t filter -P INPUT $1
  229. iptables -t filter -P FORWARD ACCEPT
  230. iptables -t filter -P OUTPUT ACCEPT
  231. iptables -t nat -F
  232. iptables -t nat -X
  233. iptables -t nat -P PREROUTING ACCEPT
  234. iptables -t nat -P OUTPUT ACCEPT
  235. iptables -t nat -P POSTROUTING ACCEPT
  236. iptables -t mangle -F
  237. iptables -t mangle -X
  238. iptables -t mangle -P PREROUTING ACCEPT
  239. iptables -t mangle -P INPUT ACCEPT
  240. iptables -t mangle -P FORWARD ACCEPT
  241. iptables -t mangle -P OUTPUT ACCEPT
  242. iptables -t mangle -P POSTROUTING ACCEPT
  243. echo -e "$JAUN -> Boucle Locale lo :$FIN$VERT ACCEPT$FIN"
  244. iptables -A INPUT -i lo -j ACCEPT
  245. iptables -A OUTPUT -o lo -j ACCEPT
  246. iptables -A FORWARD -i lo -j ACCEPT
  247. iptables -A FORWARD -o lo -j ACCEPT
  248. # permet de substituer SPARE par BDDAPP (si spare HS il faut activer cela, ça evite de changer tous les tableaux requeteurs)
  249. iptables -A PREROUTING -t nat -p tcp -i $LAN -s 0.0.0.0/0 -d 172.16.254.5 --dport 3306 -j DNAT --to 172.16.254.4
  250. }
  251.  
  252. open_ports()
  253. {
  254. if [ "$LAN" != "" ]; then
  255. echo -n -e "$JAUN -> Ouverture des ports pour : $FIN$ROUG $LAN$FIN :"
  256. #
  257. # OUVERTURE DES PORTS POUR LE LAN
  258. for portproto in $LAN_PORTS
  259. do
  260. port=`echo "$portproto" | cut -d "/" -f1`
  261. proto=`echo "$portproto" | cut -d "/" -f2 -s`
  262. if [ "$proto" = "" ]
  263. then
  264. proto="tcp"
  265. fi
  266. echo -n -e "$BLEU $port/$proto$FIN"
  267. iptables -A INPUT -i $LAN -p $proto --dport $port -j ACCEPT
  268. iptables -A OUTPUT -o $LAN -p $proto --sport $port -j ACCEPT
  269. done
  270. echo ""
  271. fi
  272.  
  273. if [ "$WAN" != "" ]; then
  274. echo -n -e "$JAUN -> Ouverture des ports pour : $FIN$ROUG $WAN$FIN :"
  275. for portproto in $WAN_PORTS
  276. do
  277. port=`echo "$portproto" | cut -d "/" -f1`
  278. proto=`echo "$portproto" | cut -d "/" -f2 -s`
  279. if [ "$proto" = "" ]
  280. then
  281. proto="tcp"
  282. fi
  283. echo -n -e "$BLEU $port/$proto$FIN"
  284. iptables -A INPUT -i $WAN -p $proto --dport $port -j ACCEPT
  285. iptables -A OUTPUT -o $WAN -p $proto --sport $port -j ACCEPT
  286. done
  287. echo ""
  288. fi
  289. }
  290.  
  291. fw_main()
  292. {
  293.  
  294. #
  295. # DNS Communication
  296. #
  297. if [ "$OPEN_DNS" != "" -a "$WAN" != "" ]
  298. then
  299. for srvdns in $OPEN_DNS
  300. do
  301. echo -e "$JAUN -> Activation du DNS sur WAN : $FIN$VERT$srvdns $FIN"
  302. iptables -A INPUT -i $WAN -p udp -s $srvdns --sport 53 -j ACCEPT
  303. iptables -A OUTPUT -o $WAN -p udp -d $srvdns --dport 53 -j ACCEPT
  304. done
  305. fi
  306.  
  307. if [ "$ROUTES" != "" ]
  308. then
  309. echo -e "$JAUN -> Activation du routage $FIN"
  310. for reseaux in $ROUTES
  311. do
  312. rezo=`echo "$reseaux" | cut -d "/" -f1`
  313. mask=`echo "$reseaux" | cut -d "/" -f2`
  314. gw=`echo "$reseaux" | cut -d "/" -f3 -s`
  315. echo -e " $VERT $LAN_NETWORK/$LAN_NETMASK $FIN$BLEU<- $gw ->$FIN$FUSH $rezo/$mask $FIN"
  316. route add -net $rezo netmask $mask gw $gw
  317. done
  318. FORWARDING="1"
  319. fi
  320.  
  321. # ACTIVATION DU PROXY TRENSPARENT POUR LES LANS
  322. if [ "$FORWARDING" = "1" ]
  323. then
  324. echo -e "$JAUN -> Activation du forwarding $FIN"
  325. echo "1" > /proc/sys/net/ipv4/ip_forward
  326. echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
  327. fi
  328.  
  329. #
  330. # ACTIVATION DU PROXY TRENSPARENT POUR LES LANS
  331. if [ "$PROXY_HTTP" = "1" ]
  332. then
  333. echo -n -e "\033[40m\033[1;33m -> Activation du Poxy HTTP Transparent sur $FIN$BLEU$LAN_ADDRESS:$PROXY_PORT$FIN$JAUNE pour $FIN$VERT$rezo/$mask $FIN"
  334. iptables -t nat -A PREROUTING -i $LAN -p tcp -d! $LAN_ADDRESS --dport 80 -j REDIRECT --to-port $PROXY_PORT
  335. echo ""
  336. fi
  337.  
  338.  
  339. #
  340. # MASQUERADING POUR LES LANS
  341. if [ "$LAN_MASQUERADE" = "1" ]
  342. then
  343. echo -n -e "\033[40m\033[1;33m -> Activation du MASQUERADE pour$FIN$VERT $WAN:$WAN_ADDRESS $FIN"
  344. # Si ip Publique non statique
  345. # iptables -t nat -A POSTROUTING -o $WAN -s $rezo/$mask -j MASQUERADE
  346. # Sinon si Ip publique statique plus performant:
  347. iptables -t nat -A POSTROUTING -o $WAN -j SNAT --to-source $WAN_ADDRESS
  348. echo ""
  349. fi
  350.  
  351.  
  352.  
  353. #
  354. # CONSERVATION DES CONNECTIONS ACTIVES
  355. # pratique pour maintenance en cours
  356. if [ "$KEEP_ACTIVES_CONN" = "1" ]
  357. then
  358. echo -e "$JAUN -> Conservation des connection Actives...$FIN"
  359. iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
  360. iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
  361. iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
  362. fi
  363.  
  364.  
  365. #
  366. # Redirection de ports
  367. #
  368. if [ "$WAN_REDIRECT" != "" ]
  369. then
  370. echo -e "$JAUN -> Redirection des ports sur :$FIN $ROUG $WAN $FIN"
  371. for redir in $WAN_REDIRECT
  372. do
  373. src=`echo "$redir" | cut -d "/" -f1`
  374. dest=`echo "$redir" | cut -d "/" -f2 -s`
  375. echo -e " $ROUG $WAN_ADDRESS:$src $FIN $BLEU vers $FIN $VERT $dest $FIN"
  376. iptables -A PREROUTING -t nat -p tcp -i $WAN -s 0.0.0.0/0 -d $WAN_ADDRESS --dport $src -j DNAT --to $dest
  377. done
  378. fi
  379.  
  380. if [ "$LAN_REDIRECT" != "" ]
  381. then
  382. echo -e "$JAUN -> Redirection des ports :$FIN $VERT $LAN $FIN"
  383. for redir in $LAN_REDIRECT
  384. do
  385. src=`echo "$redir" | cut -d "/" -f1`
  386. dest=`echo "$redir" | cut -d "/" -f2 -s`
  387. echo -e " $ROUG $LAN_ADDRESS:$src $FIN $BLEU vers $FIN $VERT $dest $FIN"
  388. iptables -A PREROUTING -t nat -p tcp -i $LAN -s 0.0.0.0/0 -d $LAN_ADDRESS --dport $src -j DNAT --to $dest
  389. done
  390. fi
  391.  
  392. # Nating du LAN vers le WAN
  393. # NATING_LAN2WAN=10.0.0.30#172.16.254.0/24
  394. # NATING_WAN2LAN=172.16.254.0/24#10.0.0.30
  395. # TODO ajouter la prise en charge du port spécifique
  396. if [ "$NATING_LAN2WAN" != "" ]
  397. then
  398. echo -e "$JAUN -> Nating sur la pate : $FIN $ROUG $WAN $FIN"
  399. for redir in $NATING_LAN2WAN
  400. do
  401. src=`echo "$redir" | cut -d "#" -f1`
  402. dest=`echo "$redir" | cut -d "#" -f2 -s`
  403. echo -e " $ROUG ($WAN_ADDRESS)$src $FIN $BLEU --> $FIN $VERT $dest $FIN"
  404. iptables -t nat -A POSTROUTING -o $WAN -s $src -d $dest -j SNAT --to-source $WAN_ADDRESS
  405. done
  406. fi
  407. # Nating du WAN vers le LAN
  408. if [ "$NATING_WAN2LAN" != "" ]
  409. then
  410. echo -e "$JAUN -> Nating sur la pate : $FIN $VERT $LAN $FIN"
  411. for redir in $NATING_WAN2LAN
  412. do
  413. src=`echo "$redir" | cut -d "#" -f1`
  414. dest=`echo "$redir" | cut -d "#" -f2 -s`
  415. echo -e " $ROUG ($LAN_ADDRESS)$src $FIN $BLEU --> $FIN $VERT $dest $FIN"
  416. iptables -t nat -A POSTROUTING -o $LAN -s $src -d $dest -j SNAT --to-source $LAN_ADDRESS
  417. done
  418. fi
  419.  
  420.  
  421. if [ "$ICMP_RESPONSE_CARDS" != "" ]
  422. then
  423. echo -n -e "$JAUN -> Reponse au ping sur : $FIN"
  424. for carte in $ICMP_RESPONSE_CARDS
  425. do
  426. echo -e -n "$BLEU $carte $FIN"
  427. for type in 0 8 11
  428. do
  429. iptables -A INPUT -i $carte -p ICMP --icmp-type $type -j ACCEPT
  430. iptables -A OUTPUT -o $carte -p ICMP --icmp-type $type -j ACCEPT
  431. done
  432. done
  433. echo ""
  434. fi
  435.  
  436.  
  437. iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  438. iptables -A OUTPUT -j ACCEPT
  439.  
  440. }
  441.  
  442. kernel_tweaks()
  443. {
  444. echo -e "$JAUN -> Set kernel networking tweaks $FIN"
  445. echo "1" > /proc/sys/net/ipv4/ip_dynaddr
  446. echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
  447. echo "0" > /proc/sys/net/ipv4/tcp_timestamps
  448. echo "1" > /proc/sys/net/ipv4/tcp_syncookies
  449. echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
  450. echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  451. echo "8192" > /proc/sys/net/ipv4/ip_conntrack_max
  452. echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
  453. echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
  454. echo "2400" > /proc/sys/net/ipv4/tcp_keepalive_time
  455. echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
  456. echo "0" > /proc/sys/kernel/printk
  457.  
  458. if [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]; then
  459. echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  460. fi
  461.  
  462. if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then
  463. echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  464. fi
  465.  
  466. }
  467.  
  468. dos_protect()
  469. {
  470. echo -e "$JAUN -> Enabling reduction of the DoS'ing ability $FIN"
  471. echo "10" > /proc/sys/net/ipv4/tcp_fin_timeout
  472. echo "1800" > /proc/sys/net/ipv4/tcp_keepalive_time
  473. echo "0" > /proc/sys/net/ipv4/tcp_window_scaling
  474. echo "0" > /proc/sys/net/ipv4/tcp_sack
  475. echo "64" > /proc/sys/net/ipv4/ip_default_ttl
  476. #echo "2048" > /proc/sys/net/ipv4/ip_queue_maxlen
  477.  
  478. if [ -e /proc/sys/net/ipv4/tcp_ecn ]; then
  479. echo -e "$JAUN -> Enabling ECN (Explicit Congestion Notification) $FIN"
  480. echo "0" > /proc/sys/net/ipv4/tcp_ecn
  481. fi
  482.  
  483.  
  484. }
  485.  
  486. if [ -e /proc/sys/net/ipv4/ip_masq_udp_dloose ]; then
  487. # if [ "$LOOSE_UDP_PATCH" == "1" ]; then
  488. # echo -e "$JAUN -> Enabling the LOOSE_UDP_PATCH (for some games, less secure!) $FIN"
  489. # echo "1" > /proc/sys/net/ipv4/ip_masq_udp_dloose
  490. # else
  491. echo -e "$JAUN -> Disabling the LOOSE_UDP_PATCH (more secure) $FIN"
  492. echo "0" > /proc/sys/net/ipv4/ip_masq_udp_dloose
  493. # fi
  494. fi
  495.  
  496. #if [ -e /proc/sys/net/ipv4/ip_local_port_range ]; then
  497. #echo "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range
  498. #fi
  499.  
  500.  
  501. #echo "0" > /proc/sys/net/ipv4/conf/eth0/accept_source_route
  502. #echo "0" > /proc/sys/net/ipv4/conf/eth0/send_redirects
  503. #echo "1" > /proc/sys/net/ipv4/conf/eth0/rp_filter
  504. #echo "0" > /proc/sys/net/ipv4/tcp_window_scaling
  505. #echo "0" > /proc/sys/net/ipv4/tcp_sack
  506.  
  507.  
  508.  
  509.  
  510. route_remover()
  511. {
  512. echo -e "$JAUN -> Destruction des routes : $FIN "
  513. for reseaux in $ROUTES
  514. do
  515. rezo=`echo "$reseaux" | cut -d "/" -f1`
  516. mask=`echo "$reseaux" | cut -d "/" -f2`
  517. gw=`echo "$reseaux" | cut -d "/" -f3 -s`
  518. echo -e " $ROUG $rezo/$mask : $gw $FIN"
  519. route del -net $rezo netmask $mask gw $gw
  520. done
  521. }
  522.  
  523. bandeau_fin()
  524. {
  525. echo ""
  526. echo -e " \033[40m\033[1;34m---------------------------------------\033[0m "
  527. echo -e " \033[40m\033[1;32m---------> Firewall $1 <---------\033[0m "
  528. echo -e " \033[40m\033[1;34m---------------------------------------\033[0m "
  529. echo ""
  530. }
  531.  
  532. case "$1" in
  533.  
  534. start)
  535. bandeau_start
  536. init_variables
  537. init_modules
  538. init_rules DROP
  539. open_ports
  540. fw_main
  541. iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  542. iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
  543. iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  544. bandeau_fin $1
  545. ;;
  546.  
  547. stop)
  548. bandeau_start
  549. init_variables
  550. init_rules ACCEPT
  551. route_remover
  552. bandeau_fin $1
  553. ;;
  554.  
  555. restart)
  556. sh $0 stop
  557. sleep 1
  558. sh $0 start
  559. ;;
  560.  
  561. status)
  562. STATUS=""
  563. i=0
  564. COUL[1]=$FUSH
  565. COUL[2]=$JAUN
  566. COUL[3]=$VERT
  567. clear
  568. init_variables
  569. sleep 3
  570. for table in nat filter mangle
  571. do
  572. i=$(( $i + 1 ))
  573. ST1=`echo "\r\n $BLAN==========================================================================================================$FIN \r\n $BLAN=============>$FIN $ROUG Table $i : $table $FIN $BLAN<=============$FIN \r\n "`
  574. ST2=`iptables -L -n -v -t $table`
  575. STATUS=`echo "$STATUS \r\n $ST1 \n\r ${COUL[$i]} $ST2 $FIN"`
  576. done
  577. echo -e "$STATUS" | more
  578. echo -e "\r\n $BLAN==========================================================================================================$FIN \r\n"
  579. ;;
  580.  
  581. *)
  582. bandeau_start
  583. init_variables
  584. echo "
  585. Usage : $0 {start|stop|restart|status}
  586.  
  587. Si les variables affichees ci dessus sont correcte vous pouvez lancer votre firewall.
  588. Faites vi $0 pour editer la configuration.
  589. "
  590. ;;
  591. esac
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!