From 1be6ebb92966edeea8a49f34a5e2e664f86c2946 Mon Sep 17 00:00:00 2001
From: Waldemar Brodkorb <wbx@openadk.org>
Date: Wed, 2 Dec 2009 19:48:18 +0100
Subject: finetune iptables, tinyproxy and dansguardian

---
 package/iptables/files/firewall.conf | 119 +++++++++++++++++++++++++++++++++++
 package/iptables/files/firewall.init |  35 +++++++++++
 2 files changed, 154 insertions(+)
 create mode 100644 package/iptables/files/firewall.conf
 create mode 100755 package/iptables/files/firewall.init

(limited to 'package/iptables')

diff --git a/package/iptables/files/firewall.conf b/package/iptables/files/firewall.conf
new file mode 100644
index 000000000..bc9a39c41
--- /dev/null
+++ b/package/iptables/files/firewall.conf
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+
+echo "configure /etc/firewall.conf first."
+exit 1
+
+### Interfaces
+WAN=ppp0
+LAN=br0
+WLAN=
+
+######################################################################
+### Default ruleset
+######################################################################
+
+### Create chains
+iptables -N input_rule
+iptables -N forwarding_rule
+iptables -t nat -N prerouting_rule
+iptables -t nat -N postrouting_rule
+
+### Default policy
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+
+### INPUT
+###  (connections with the router as destination)
+
+# base case
+iptables -A INPUT -m state --state INVALID -j DROP
+iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP
+
+# custom rules
+iptables -A INPUT -j input_rule
+
+# allow access from anything but WAN
+iptables -A INPUT ${WAN:+\! -i $WAN} -j ACCEPT
+# allow icmp messages
+iptables -A INPUT -p icmp -j ACCEPT
+
+# reject
+iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
+iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
+
+### OUTPUT
+###  (connections with the router as source)
+
+# base case
+iptables -A OUTPUT -m state --state INVALID -j DROP
+iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+### FORWARD
+###  (connections routed through the router)
+
+# base case
+iptables -A FORWARD -m state --state INVALID -j DROP
+iptables -A FORWARD -p tcp -o $WAN --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+# custom rules
+iptables -A FORWARD -j forwarding_rule
+iptables -t nat -A PREROUTING -j prerouting_rule
+iptables -t nat -A POSTROUTING -j postrouting_rule
+
+# allow LAN
+iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
+
+### MASQUERADING
+echo 1 > /proc/sys/net/ipv4/ip_dynaddr
+iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
+
+######################################################################
+### Default ruleset end
+######################################################################
+
+###
+### Connections to the router
+###
+
+# ssh
+#iptables -A input_rule -i $WAN -p tcp -s <a.b.c.d> --dport 22 -j ACCEPT
+
+# IPSec
+#iptables -A input_rule -i $WAN -p esp -s <a.b.c.d> -j ACCEPT
+#iptables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 500 -j ACCEPT
+
+# OpenVPN
+#iptables -A input_rule -i $WAN -p udp -s <a.b.c.d> --dport 1194 -j ACCEPT
+
+# PPTP
+#iptables -A input_rule -i $WAN -p gre -j ACCEPT
+#iptables -A input_rule -i $WAN -p tcp --dport 1723 -j ACCEPT
+
+###
+###  VPN traffic
+###
+
+# IPSec
+#iptables -A forwarding_rule -o ipsec+ -j ACCEPT
+#iptables -A forwarding_rule -i ipsec+ -j ACCEPT
+
+# OpenVPN
+#iptables -A forwarding_rule -o tun+ -j ACCEPT
+#iptables -A forwarding_rule -i tun+ -j ACCEPT
+
+###
+### Port forwardings to LAN
+###
+
+#iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 3389 -j DNAT --to 192.168.1.10
+#iptables -A forwarding_rule -i $WAN -p tcp --dport 3389 -d 192.168.1.10 -j ACCEPT
+
+# Transparent Bridging Proxy
+#ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 \
+#        --ip-destination-port 80 -j redirect --redirect-target ACCEPT
+#iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 \
+#        -j REDIRECT --to-port 8080
+
diff --git a/package/iptables/files/firewall.init b/package/iptables/files/firewall.init
new file mode 100755
index 000000000..b3ea698d6
--- /dev/null
+++ b/package/iptables/files/firewall.init
@@ -0,0 +1,35 @@
+#!/bin/sh
+#PKG iptables
+#INIT 45
+. /etc/rc.conf
+
+case $1 in
+autostop) ;;
+autostart)
+	test x"${firewall:-NO}" = x"NO" && exit 0
+	exec sh $0 start
+	;;
+start)
+	. /etc/firewall.conf
+	;;
+stop)
+	### Clear tables
+	iptables -F
+	iptables -X
+	iptables -t nat -F
+	iptables -t nat -X
+	iptables -P INPUT ACCEPT
+	iptables -P FORWARD ACCEPT
+	iptables -P OUTPUT ACCEPT
+	iptables -t nat -P PREROUTING ACCEPT
+	iptables -t nat -P POSTROUTING ACCEPT
+	;;
+restart)
+	sh $0 stop
+	sh $0 start
+	;;
+*)
+	echo "Usage: $0 {start | stop | restart}"
+	;;
+esac
+exit $?
-- 
cgit v1.2.3