You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
65 lines
1.4 KiB
65 lines
1.4 KiB
|
|
iptables_init_if() {
|
|
if isfirst "iptables_$if"; then
|
|
addcode up 1 1 "iptables -N firewall_$if"
|
|
addcode up 1 2 "iptables -A INPUT -i $if -j firewall_$if"
|
|
addcode up 1 3 "iptables -A firewall_$if `
|
|
`-m state --state ESTABLISHED,RELATED -j ACCEPT"
|
|
|
|
addcode down 1 3 "iptables -F firewall_$if"
|
|
addcode down 1 2 "iptables -D INPUT -i $if -j firewall_$if"
|
|
addcode down 1 1 "iptables -X firewall_$if"
|
|
fi
|
|
}
|
|
|
|
iptables_parse_conditions() {
|
|
iptables_cond=""
|
|
while [ -n "$1" ]
|
|
do
|
|
case "$1" in
|
|
all)
|
|
shift
|
|
;;
|
|
tcp|udp)
|
|
iptables_cond="$iptables_cond -p $1 --dport $2"
|
|
shift; shift
|
|
;;
|
|
ip)
|
|
iptables_cond="$iptables_cond -s $2"
|
|
shift; shift
|
|
;;
|
|
*)
|
|
error "Unkown accept/reject/drop condition: $1"
|
|
shift
|
|
esac
|
|
done
|
|
}
|
|
|
|
public_accept() {
|
|
iptables_parse_conditions "$@"
|
|
addcode up 1 5 "iptables -A firewall_$if $iptables_cond -j ACCEPT"
|
|
iptables_init_if
|
|
}
|
|
|
|
public_reject() {
|
|
iptables_parse_conditions "$@"
|
|
addcode up 1 5 "iptables -A firewall_$if $iptables_cond -j REJECT"
|
|
iptables_init_if
|
|
}
|
|
|
|
public_drop() {
|
|
iptables_parse_conditions "$@"
|
|
addcode up 1 5 "iptables -A firewall_$if $iptables_cond -j DROP"
|
|
iptables_init_if
|
|
}
|
|
|
|
public_clamp_mtu() {
|
|
addcode up 1 6 "iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN \
|
|
-j TCPMSS --clamp-mss-to-pmtu"
|
|
}
|
|
|
|
public_masquerade() {
|
|
addcode up 1 6 "iptables -t nat -A POSTROUTING -o $if \
|
|
-j MASQUERADE"
|
|
}
|
|
|