summaryrefslogtreecommitdiff
path: root/package
diff options
context:
space:
mode:
authorWaldemar Brodkorb <wbx@openadk.org>2009-12-02 19:48:18 +0100
committerWaldemar Brodkorb <wbx@openadk.org>2009-12-02 19:48:18 +0100
commit1be6ebb92966edeea8a49f34a5e2e664f86c2946 (patch)
treeb65b2299475e820d335e96cc3c90125238873fc5 /package
parenteb10ac0e97c1e5e98ce73a1966c97a7cedb9d086 (diff)
finetune iptables, tinyproxy and dansguardian
Diffstat (limited to 'package')
-rw-r--r--package/dansguardian/files/dansguardian.postinst4
-rw-r--r--package/iptables/files/firewall.conf119
-rwxr-xr-xpackage/iptables/files/firewall.init35
-rw-r--r--package/tinyproxy/Makefile4
-rw-r--r--package/tinyproxy/files/tinyproxy.conf228
-rw-r--r--package/tinyproxy/files/tinyproxy.init1
-rw-r--r--package/tinyproxy/files/tinyproxy.postinst3
7 files changed, 390 insertions, 4 deletions
diff --git a/package/dansguardian/files/dansguardian.postinst b/package/dansguardian/files/dansguardian.postinst
index 80272f705..95f5fb639 100644
--- a/package/dansguardian/files/dansguardian.postinst
+++ b/package/dansguardian/files/dansguardian.postinst
@@ -1,6 +1,6 @@
#!/bin/sh
. $IPKG_INSTROOT/etc/functions.sh
gid=$(get_next_gid)
-add_user proxy $(get_next_uid) $gid /etc/dansguardian
-add_group proxy $gid
+add_user dansguardian $(get_next_uid) $gid /etc/dansguardian
+add_group dansguardian $gid
add_rcconf dansguardian dansguardian NO
diff --git a/package/iptables/files/firewall.conf b/package/iptables/files/firewall.conf
new file mode 100644
index 000000000..bc9a39c41
--- /dev/null
+++ b/package/iptables/files/firewall.conf
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+
+echo "configure /etc/firewall.conf first."
+exit 1
+
+### Interfaces
+WAN=ppp0
+LAN=br0
+WLAN=
+
+######################################################################
+### Default ruleset
+######################################################################
+
+### Create chains
+iptables -N input_rule
+iptables -N forwarding_rule
+iptables -t nat -N prerouting_rule
+iptables -t nat -N postrouting_rule
+
+### Default policy
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+
+### INPUT
+### (connections with the router as destination)
+
+# base case
+iptables -A INPUT -m state --state INVALID -j DROP
+iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP
+
+# custom rules
+iptables -A INPUT -j input_rule
+
+# allow access from anything but WAN
+iptables -A INPUT ${WAN:+\! -i $WAN} -j ACCEPT
+# allow icmp messages
+iptables -A INPUT -p icmp -j ACCEPT
+
+# reject
+iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
+iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
+
+### OUTPUT
+### (connections with the router as source)
+
+# base case
+iptables -A OUTPUT -m state --state INVALID -j DROP
+iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+### FORWARD
+### (connections routed through the router)
+
+# base case
+iptables -A FORWARD -m state --state INVALID -j DROP
+iptables -A FORWARD -p tcp -o $WAN --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# custom rules
+iptables -A FORWARD -j forwarding_rule
+iptables -t nat -A PREROUTING -j prerouting_rule
+iptables -t nat -A POSTROUTING -j postrouting_rule
+
+# allow LAN
+iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
+
+### MASQUERADING
+echo 1 > /proc/sys/net/ipv4/ip_dynaddr
+iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
+
+######################################################################
+### Default ruleset end
+######################################################################
+
+###
+### Connections to the router
+###
+
+# ssh
+#iptables -A input_rule -i $WAN -p tcp -s <a.b.c.d> --dport 22 -j ACCEPT
+
+# IPSec
+#iptables -A input_rule -i $WAN -p esp -s <a.b.c.d> -j ACCEPT
+#iptables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 500 -j ACCEPT
+
+# OpenVPN
+#iptables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 1194 -j ACCEPT
+
+# PPTP
+#iptables -A input_rule -i $WAN -p gre -j ACCEPT
+#iptables -A input_rule -i $WAN -p tcp --dport 1723 -j ACCEPT
+
+###
+### VPN traffic
+###
+
+# IPSec
+#iptables -A forwarding_rule -o ipsec+ -j ACCEPT
+#iptables -A forwarding_rule -i ipsec+ -j ACCEPT
+
+# OpenVPN
+#iptables -A forwarding_rule -o tun+ -j ACCEPT
+#iptables -A forwarding_rule -i tun+ -j ACCEPT
+
+###
+### Port forwardings to LAN
+###
+
+#iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 3389 -j DNAT --to 192.168.1.10
+#iptables -A forwarding_rule -i $WAN -p tcp --dport 3389 -d 192.168.1.10 -j ACCEPT
+
+# Transparent Bridging Proxy
+#ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 \
+# --ip-destination-port 80 -j redirect --redirect-target ACCEPT
+#iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 \
+# -j REDIRECT --to-port 8080
+
diff --git a/package/iptables/files/firewall.init b/package/iptables/files/firewall.init
new file mode 100755
index 000000000..b3ea698d6
--- /dev/null
+++ b/package/iptables/files/firewall.init
@@ -0,0 +1,35 @@
+#!/bin/sh
+#PKG iptables
+#INIT 45
+. /etc/rc.conf
+
+case $1 in
+autostop) ;;
+autostart)
+ test x"${firewall:-NO}" = x"NO" && exit 0
+ exec sh $0 start
+ ;;
+start)
+ . /etc/firewall.conf
+ ;;
+stop)
+ ### Clear tables
+ iptables -F
+ iptables -X
+ iptables -t nat -F
+ iptables -t nat -X
+ iptables -P INPUT ACCEPT
+ iptables -P FORWARD ACCEPT
+ iptables -P OUTPUT ACCEPT
+ iptables -t nat -P PREROUTING ACCEPT
+ iptables -t nat -P POSTROUTING ACCEPT
+ ;;
+restart)
+ sh $0 stop
+ sh $0 start
+ ;;
+*)
+ echo "Usage: $0 {start | stop | restart}"
+ ;;
+esac
+exit $?
diff --git a/package/tinyproxy/Makefile b/package/tinyproxy/Makefile
index b359bbb75..5bf6a8af8 100644
--- a/package/tinyproxy/Makefile
+++ b/package/tinyproxy/Makefile
@@ -5,7 +5,7 @@ include ${TOPDIR}/rules.mk
PKG_NAME:= tinyproxy
PKG_VERSION:= 1.6.5
-PKG_RELEASE:= 1
+PKG_RELEASE:= 2
PKG_MD5SUM:= 2b2862ba33d2939e4572688d442ba415
PKG_DESCR:= Tinyproxy is a lightweight HTTP and HTTPS proxy.
PKG_SECTION:= net
@@ -37,9 +37,9 @@ post-install:
${INSTALL_DIR} ${IDIR_TINYPROXY}/usr/sbin \
${IDIR_TINYPROXY}/etc/tinyproxy \
${IDIR_TINYPROXY}/usr/share/tinyproxy
+ ${INSTALL_DATA} ./files/tinyproxy.conf ${IDIR_TINYPROXY}/etc/tinyproxy
${INSTALL_BIN} ${WRKINST}/usr/sbin/tinyproxy ${IDIR_TINYPROXY}/usr/sbin/
${INSTALL_DATA} ${WRKINST}/usr/share/tinyproxy/{debug,default,stats}.html ${IDIR_TINYPROXY}/usr/share/tinyproxy/
${INSTALL_DATA} ${WRKINST}/usr/share/tinyproxy/HTML_VARIABLES ${IDIR_TINYPROXY}/usr/share/tinyproxy/
- ${INSTALL_DATA} ${WRKINST}/etc/tinyproxy/tinyproxy.conf ${IDIR_TINYPROXY}/etc/tinyproxy/
include ${TOPDIR}/mk/pkg-bottom.mk
diff --git a/package/tinyproxy/files/tinyproxy.conf b/package/tinyproxy/files/tinyproxy.conf
new file mode 100644
index 000000000..6460a2c88
--- /dev/null
+++ b/package/tinyproxy/files/tinyproxy.conf
@@ -0,0 +1,228 @@
+##
+## tinyproxy.conf -- tinyproxy daemon configuration file
+##
+
+#
+# Name of the user the tinyproxy daemon should switch to after the port
+# has been bound.
+#
+User tinyproxy
+Group tinyproxy
+
+#
+# Port to listen on.
+#
+Port 8888
+
+#
+# If you have multiple interfaces this allows you to bind to only one. If
+# this is commented out, tinyproxy will bind to all interfaces present.
+#
+#Listen 192.168.0.1
+
+#
+# The Bind directive allows you to bind the outgoing connections to a
+# particular IP address.
+#
+#Bind 192.168.0.1
+
+#
+# Timeout: The number of seconds of inactivity a connection is allowed to
+# have before it closed by tinyproxy.
+#
+Timeout 600
+
+#
+# ErrorFile: Defines the HTML file to send when a given HTTP error
+# occurs. You will probably need to customize the location to your
+# particular install. The usual locations to check are:
+# /usr/local/share/tinyproxy
+# /usr/share/tinyproxy
+# /etc/tinyproxy
+#
+# ErrorFile 404 "/usr/share/tinyproxy/404.html"
+# ErrorFile 400 "/usr/share/tinyproxy/400.html"
+# ErrorFile 503 "/usr/share/tinyproxy/503.html"
+# ErrorFile 403 "/usr/share/tinyproxy/403.html"
+# ErrorFile 408 "/usr/share/tinyproxy/408.html"
+
+#
+# DefaultErrorFile: The HTML file that gets sent if there is no
+# HTML file defined with an ErrorFile keyword for the HTTP error
+# that has occured.
+#
+DefaultErrorFile "/usr/share/tinyproxy/default.html"
+
+#
+# StatFile: The HTML file that gets sent when a request is made
+# for the stathost. If this file doesn't exist a basic page is
+# hardcoded in tinyproxy.
+#
+StatFile "/usr/share/tinyproxy/stats.html"
+
+#
+# Where to log the information. Either LogFile or Syslog should be set,
+# but not both.
+#
+Logfile "/var/log/tinyproxy.log"
+# Syslog On
+
+#
+# Set the logging level. Allowed settings are:
+# Critical (least verbose)
+# Error
+# Warning
+# Notice
+# Connect (to log connections without Info's noise)
+# Info (most verbose)
+# The LogLevel logs from the set level and above. For example, if the LogLevel
+# was set to Warning, than all log messages from Warning to Critical would be
+# output, but Notice and below would be suppressed.
+#
+LogLevel Critical
+
+#
+# PidFile: Write the PID of the main tinyproxy thread to this file so it
+# can be used for signalling purposes.
+#
+PidFile "/var/run/tinyproxy.pid"
+
+#
+# Include the X-Tinyproxy header, which has the client's IP address when
+# connecting to the sites listed.
+#
+#XTinyproxy mydomain.com
+
+#
+# Turns on upstream proxy support.
+#
+# The upstream rules allow you to selectively route upstream connections
+# based on the host/domain of the site being accessed.
+#
+# For example:
+# # connection to test domain goes through testproxy
+# upstream testproxy:8008 ".test.domain.invalid"
+# upstream testproxy:8008 ".our_testbed.example.com"
+# upstream testproxy:8008 "192.168.128.0/255.255.254.0"
+#
+# # no upstream proxy for internal websites and unqualified hosts
+# no upstream ".internal.example.com"
+# no upstream "www.example.com"
+# no upstream "10.0.0.0/8"
+# no upstream "192.168.0.0/255.255.254.0"
+# no upstream "."
+#
+# # connection to these boxes go through their DMZ firewalls
+# upstream cust1_firewall:8008 "testbed_for_cust1"
+# upstream cust2_firewall:8008 "testbed_for_cust2"
+#
+# # default upstream is internet firewall
+# upstream firewall.internal.example.com:80
+#
+# The LAST matching rule wins the route decision. As you can see, you
+# can use a host, or a domain:
+# name matches host exactly
+# .name matches any host in domain "name"
+# . matches any host with no domain (in 'empty' domain)
+# IP/bits matches network/mask
+# IP/mask matches network/mask
+#
+#Upstream some.remote.proxy:port
+
+#
+# This is the absolute highest number of threads which will be created. In
+# other words, only MaxClients number of clients can be connected at the
+# same time.
+#
+MaxClients 100
+
+#
+# These settings set the upper and lower limit for the number of
+# spare servers which should be available. If the number of spare servers
+# falls below MinSpareServers then new ones will be created. If the number
+# of servers exceeds MaxSpareServers then the extras will be killed off.
+#
+MinSpareServers 5
+MaxSpareServers 20
+
+#
+# Number of servers to start initially.
+#
+StartServers 10
+
+#
+# MaxRequestsPerChild is the number of connections a thread will handle
+# before it is killed. In practise this should be set to 0, which disables
+# thread reaping. If you do notice problems with memory leakage, then set
+# this to something like 10000
+#
+MaxRequestsPerChild 0
+
+#
+# The following is the authorization controls. If there are any access
+# control keywords then the default action is to DENY. Otherwise, the
+# default action is ALLOW.
+#
+# Also the order of the controls are important. The incoming connections
+# are tested against the controls based on order.
+#
+Allow 127.0.0.1
+Allow 192.168.1.0/25
+
+#
+# The "Via" header is required by the HTTP RFC, but using the real host name
+# is a security concern. If the following directive is enabled, the string
+# supplied will be used as the host name in the Via header; otherwise, the
+# server's host name will be used.
+#
+ViaProxyName "tinyproxy"
+
+#
+# The location of the filter file.
+#
+#Filter "/etc/tinyproxy/filter"
+
+#
+# Filter based on URLs rather than domains.
+#
+#FilterURLs On
+
+#
+# Use POSIX Extended regular expressions rather than basic.
+#
+#FilterExtended On
+
+#
+# Use case sensitive regular expressions.
+#
+#FilterCaseSensitive On
+
+#
+# Change the default policy of the filtering system. If this directive is
+# commented out, or is set to "No" then the default policy is to allow
+# everything which is not specifically denied by the filter file.
+#
+# However, by setting this directive to "Yes" the default policy becomes to
+# deny everything which is _not_ specifically allowed by the filter file.
+#
+#FilterDefaultDeny Yes
+
+#
+# If an Anonymous keyword is present, then anonymous proxying is enabled.
+# The headers listed are allowed through, while all others are denied. If
+# no Anonymous keyword is present, then all header are allowed through.
+# You must include quotes around the headers.
+#
+#Anonymous "Host"
+#Anonymous "Authorization"
+
+#
+# This is a list of ports allowed by tinyproxy when the CONNECT method
+# is used. To disable the CONNECT method altogether, set the value to 0.
+# If no ConnectPort line is found, all ports are allowed (which is not
+# very secure.)
+#
+# The following two ports are used by SSL.
+#
+ConnectPort 443
+ConnectPort 563
diff --git a/package/tinyproxy/files/tinyproxy.init b/package/tinyproxy/files/tinyproxy.init
index 26bd7c0df..cdf86e049 100644
--- a/package/tinyproxy/files/tinyproxy.init
+++ b/package/tinyproxy/files/tinyproxy.init
@@ -15,6 +15,7 @@ start)
;;
stop)
pkill tinyproxy
+ rm /var/run/tinyproxy.pid
;;
restart)
sh $0 stop
diff --git a/package/tinyproxy/files/tinyproxy.postinst b/package/tinyproxy/files/tinyproxy.postinst
index 4965f625d..903927e49 100644
--- a/package/tinyproxy/files/tinyproxy.postinst
+++ b/package/tinyproxy/files/tinyproxy.postinst
@@ -1,3 +1,6 @@
#!/bin/sh
. $IPKG_INSTROOT/etc/functions.sh
+gid=$(get_next_gid)
+add_user tinyproxy $(get_next_uid) $gid /etc/tinyproxy
+add_group tinyproxy $gid
add_rcconf tinyproxy tinyproxy NO