jegardai
/
scripts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

firewall: i've forgot to allow ESTABLISHED,… OUTPUT connections 

firewall: increase LOG limit-burst to 10
This commit is contained in:
Jeremy Gardais 2015-09-16 23:02:23 +02:00
parent c699ff9c4d
commit d7a819df4b
2 changed files with 12 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -5,7 +5,8 @@ Some useful scripts (for me) that can be added to $PATH :)
## List: ## List:
* bash_quote: Get a random quote from http://danstonchat.com * bash_quote: Get a random quote from http://danstonchat.com
* dynmotd/: scripts to update the motd (via the /etc/update-motd.d directory). * firewall: A script shell to set some iptables rules.
* update-dynmotd.d/: scripts to update the motd (via the /etc/update-motd.d directory).
* flac_to_mp3: convert all flac files of a directory into mp3. * flac_to_mp3: convert all flac files of a directory into mp3.
* snapsend.sh: Send a ZFS snapshot to a remote host. * snapsend.sh: Send a ZFS snapshot to a remote host.
* test_ssl3: Test if a website supportes the SSLV3 protocol. * test_ssl3: Test if a website supportes the SSLV3 protocol.

20
firewall
View File

@ -189,7 +189,7 @@ fw_start() {
## OUTPUT ## ## OUTPUT ##
############## ##############
#### Ne pas casser les connexions etablies #### Ne pas casser les connexions etablies
# $IPT -A OUTPUT -j ACCEPT -p all -o "${ILAN}" -s "${IPLAN}" -m state --state RELATED,ESTABLISHED,UNTRACKED $IPT -A OUTPUT -j ACCEPT -p all -o "${ILAN}" -s "${IPLAN}" -m state --state RELATED,ESTABLISHED,UNTRACKED
# #
# #### ICMP reply (Ping) # #### ICMP reply (Ping)
# #$IPT -A OUTPUT -j ACCEPT -p icmp -o "${ILAN}" --icmp-type 0 -s "${IPLAN}" -d 0/0 -m state --state ESTABLISHED,RELATED -m comment --comment "ICMP reply" # #$IPT -A OUTPUT -j ACCEPT -p icmp -o "${ILAN}" --icmp-type 0 -s "${IPLAN}" -d 0/0 -m state --state ESTABLISHED,RELATED -m comment --comment "ICMP reply"
@ -277,23 +277,23 @@ fw_log() {
# LOG INPUT DROP PAQUET # LOG INPUT DROP PAQUET
$IPT -N INPLOG $IPT -N INPLOG
$IPT -A INPUT -j INPLOG $IPT -A INPUT -j INPLOG
$IPT -A INPLOG -p tcp -m limit --limit 5/min -j LOG --log-prefix "Drop-IN [tcp]: " $IPT -A INPLOG -p tcp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-IN [tcp]: "
$IPT -A INPLOG -p udp -m limit --limit 5/min -j LOG --log-prefix "Drop-IN [udp]: " $IPT -A INPLOG -p udp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-IN [udp]: "
$IPT -A INPLOG -p icmp -m limit --limit 5/min -j LOG --log-prefix "Drop-IN [icmp]: " $IPT -A INPLOG -p icmp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-IN [icmp]: "
# LOG OUTPUT DROP PAQUET # LOG OUTPUT DROP PAQUET
$IPT -N OUTLOG $IPT -N OUTLOG
$IPT -A OUTPUT -j OUTLOG $IPT -A OUTPUT -j OUTLOG
$IPT -A OUTLOG -p tcp -m limit --limit 5/min -j LOG --log-prefix "Drop-OUT [tcp]: " $IPT -A OUTLOG -p tcp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-OUT [tcp]: "
$IPT -A OUTLOG -p udp -m limit --limit 5/min -j LOG --log-prefix "Drop-OUT [udp]: " $IPT -A OUTLOG -p udp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-OUT [udp]: "
$IPT -A OUTLOG -p icmp -m limit --limit 5/min -j LOG --log-prefix "Drop-OUT [icmp]: " $IPT -A OUTLOG -p icmp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-OUT [icmp]: "
# LOG FORWARD DROP PAQUET # LOG FORWARD DROP PAQUET
$IPT -N FORLOG $IPT -N FORLOG
$IPT -A FORWARD -j FORLOG $IPT -A FORWARD -j FORLOG
$IPT -A FORLOG -p tcp -m limit --limit 5/min -j LOG --log-prefix "Drop-FOR [tcp]: " $IPT -A FORLOG -p tcp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-FOR [tcp]: "
$IPT -A FORLOG -p udp -m limit --limit 5/min -j LOG --log-prefix "Drop-FOR [udp]: " $IPT -A FORLOG -p udp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-FOR [udp]: "
$IPT -A FORLOG -p icmp -m limit --limit 5/min -j LOG --log-prefix "Drop-FOR [icmp]: " $IPT -A FORLOG -p icmp -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "Drop-FOR [icmp]: "
} }