blob: 403dfc8b201706a0a4e17eef0fc7662e7d4b0ebf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
#!/bin/bash
# **** License ****
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# This code was originally developed by Vyatta, Inc.
# Portions created by Vyatta are Copyright (C) 2007 Vyatta, Inc.
# All Rights Reserved.
#
# Author: Tom Grennan <tgrennan@vyatta.com>
# Description: firewall init
# this is an indirect init sub-script executed by ofr.init
#
# **** End License ****
prefix=@prefix@
exec_prefix=@exec_prefix@
bindir=@bindir@
sbindir=@sbindir@
export PATH=/usr/bin:/usr/sbin:/bin:/sbin:$bindir:$sbindir
. /lib/lsb/init-functions
ACTION=$1
declare -a modules=(
nf_conntrack
nf_conntrack_ftp
nf_conntrack_tftp
nf_nat
nf_nat_ftp
nf_nat_tftp
nf_nat_proto_gre
nf_nat_sip
nf_nat_h323
nf_nat_pptp)
## setup firewall & nat conntrack modules
start () {
for mod in ${modules[@]} ; do
modprobe --syslog $mod
done
# set up notrack chains/rules for IPv4
# by default, nothing is tracked.
iptables -t raw -N VYATTA_CT_PREROUTING_HOOK
iptables -t raw -A VYATTA_CT_PREROUTING_HOOK -j RETURN
iptables -t raw -A PREROUTING -j VYATTA_CT_PREROUTING_HOOK
iptables -t raw -A PREROUTING -j NOTRACK
iptables -t raw -N VYATTA_CT_OUTPUT_HOOK
iptables -t raw -A VYATTA_CT_OUTPUT_HOOK -j RETURN
iptables -t raw -A OUTPUT -j VYATTA_CT_OUTPUT_HOOK
iptables -t raw -A OUTPUT -j NOTRACK
if [ -d /proc/sys/net/ipv6 ] ; then
# set up notrack chains/rules for IPv6
ip6tables -t raw -N VYATTA_CT_PREROUTING_HOOK
ip6tables -t raw -A VYATTA_CT_PREROUTING_HOOK -j RETURN
ip6tables -t raw -A PREROUTING -j VYATTA_CT_PREROUTING_HOOK
ip6tables -t raw -A PREROUTING -j NOTRACK
ip6tables -t raw -N VYATTA_CT_OUTPUT_HOOK
ip6tables -t raw -A VYATTA_CT_OUTPUT_HOOK -j RETURN
ip6tables -t raw -A OUTPUT -j VYATTA_CT_OUTPUT_HOOK
ip6tables -t raw -A OUTPUT -j NOTRACK
# set up post-firewall hooks for IPv6
ip6tables -N VYATTA_POST_FW_IN_HOOK
ip6tables -N VYATTA_POST_FW_FWD_HOOK
ip6tables -N VYATTA_POST_FW_OUT_HOOK
ip6tables -A VYATTA_POST_FW_IN_HOOK -j ACCEPT
ip6tables -A VYATTA_POST_FW_FWD_HOOK -j ACCEPT
ip6tables -A VYATTA_POST_FW_OUT_HOOK -j ACCEPT
ip6tables -A INPUT -j VYATTA_POST_FW_IN_HOOK
ip6tables -A FORWARD -j VYATTA_POST_FW_FWD_HOOK
ip6tables -A OUTPUT -j VYATTA_POST_FW_OUT_HOOK
else
logger -t "Vyatta firewall init" -p warning "Kernel IPv6 support disabled. Not initializing IPv6 firewall"
fi
# set up post-firewall hooks for IPv4
iptables -N VYATTA_POST_FW_IN_HOOK
iptables -N VYATTA_POST_FW_FWD_HOOK
iptables -N VYATTA_POST_FW_OUT_HOOK
iptables -A VYATTA_POST_FW_IN_HOOK -j ACCEPT
iptables -A VYATTA_POST_FW_FWD_HOOK -j ACCEPT
iptables -A VYATTA_POST_FW_OUT_HOOK -j ACCEPT
iptables -A INPUT -j VYATTA_POST_FW_IN_HOOK
iptables -A FORWARD -j VYATTA_POST_FW_FWD_HOOK
iptables -A OUTPUT -j VYATTA_POST_FW_OUT_HOOK
# set up pre-DNAT hook
iptables -t nat -N VYATTA_PRE_DNAT_HOOK
iptables -t nat -A VYATTA_PRE_DNAT_HOOK -j RETURN
iptables -t nat -A PREROUTING -j VYATTA_PRE_DNAT_HOOK
# set up pre-SNAT hook
iptables -t nat -N VYATTA_PRE_SNAT_HOOK
iptables -t nat -A VYATTA_PRE_SNAT_HOOK -j RETURN
iptables -t nat -A POSTROUTING -j VYATTA_PRE_SNAT_HOOK
# Loosen the acceptability rules for TCP sequence and ACK numbers in
# conntrack. This allows TCP connections through NAT to survive certain
# cases of packet loss where conntrack can not accurately track the
# connection state
sysctl -q -w net.netfilter.nf_conntrack_tcp_be_liberal=1
# set conntrack table size
sysctl -q -w net.nf_conntrack_max=16384
# set conntrack expect table size
sysctl -q -w net.netfilter.nf_conntrack_expect_max=2048
}
case "$ACTION" in
start) start ;;
stop|restart|force-reload) true ;; # nothing to stop/restart
*) log_failure_msg "action unknown: $ACTION" ;
false ;;
esac
exit $?
# Local Variables:
# mode: shell-script
# sh-indentation: 4
# End:
|
