|
@@ -55,7 +55,6 @@ IFS=$'\n'
|
|
|
for line in $(sort -r -n -k 2 -t \' $rules); do
|
|
for line in $(sort -r -n -k 2 -t \' $rules); do
|
|
|
eval $line
|
|
eval $line
|
|
|
if [ "$SUSPENDED" = 'no' ]; then
|
|
if [ "$SUSPENDED" = 'no' ]; then
|
|
|
- chain="-A INPUT"
|
|
|
|
|
proto="-p $PROTOCOL"
|
|
proto="-p $PROTOCOL"
|
|
|
port="--dport $PORT"
|
|
port="--dport $PORT"
|
|
|
ip="-s $IP"
|
|
ip="-s $IP"
|
|
@@ -83,22 +82,22 @@ for line in $(sort -r -n -k 2 -t \' $rules); do
|
|
|
fi
|
|
fi
|
|
|
|
|
|
|
|
# Adding firewall rule
|
|
# Adding firewall rule
|
|
|
- echo "$iptables $chain $proto $port $ip $state $action" >> $tmp
|
|
|
|
|
|
|
+ echo "$iptables -A INPUT $proto $port $ip $state $action" >> $tmp
|
|
|
fi
|
|
fi
|
|
|
done
|
|
done
|
|
|
|
|
|
|
|
-# Handling DNS replies
|
|
|
|
|
-proto="-p udp"
|
|
|
|
|
-port="--sport 53"
|
|
|
|
|
-action="-j ACCEPT"
|
|
|
|
|
-echo "$iptables $chain $proto $port $state $action" >> $tmp
|
|
|
|
|
|
|
+# Handling local traffic
|
|
|
|
|
+echo "$iptables -A INPUT -p udp --sport 53 -j ACCEPT" >> $tmp
|
|
|
|
|
+echo "$iptables -A INPUT -s 127.0.0.1 -j ACCEPT" >> $tmp
|
|
|
|
|
+for ip in $(ls $VESTA/data/ips); do
|
|
|
|
|
+ echo "$iptables -A INPUT -s $ip -j ACCEPT" >> $tmp
|
|
|
|
|
+done
|
|
|
|
|
|
|
|
# Enabling stateful firewall
|
|
# Enabling stateful firewall
|
|
|
if [ "$stateful" != 'no' ]; then
|
|
if [ "$stateful" != 'no' ]; then
|
|
|
- proto="-p tcp"
|
|
|
|
|
- state="-m state --state ESTABLISHED,RELATED"
|
|
|
|
|
- action="-j ACCEPT"
|
|
|
|
|
- echo "$iptables $chain $proto $state $action" >> $tmp
|
|
|
|
|
|
|
+ str="$iptables -A INPUT -p tcp -m state"
|
|
|
|
|
+ str="$str --state ESTABLISHED,RELATED -j ACCEPT"
|
|
|
|
|
+ echo "$str" >> $tmp
|
|
|
fi
|
|
fi
|
|
|
|
|
|
|
|
# Switching chain policy to DROP
|
|
# Switching chain policy to DROP
|
|
@@ -107,6 +106,9 @@ echo "$iptables -P INPUT DROP" >> $tmp
|
|
|
# Applying rules
|
|
# Applying rules
|
|
|
bash $tmp
|
|
bash $tmp
|
|
|
|
|
|
|
|
|
|
+# Deleting temporary file
|
|
|
|
|
+rm -f $tmp
|
|
|
|
|
+
|
|
|
# Saving rules to the master iptables file
|
|
# Saving rules to the master iptables file
|
|
|
if [ -e "/etc/redhat-release" ]; then
|
|
if [ -e "/etc/redhat-release" ]; then
|
|
|
/sbin/iptables-save > /etc/sysconfig/iptables
|
|
/sbin/iptables-save > /etc/sysconfig/iptables
|