second script pitables

ici j'ai un second script iptables issu d'une version plus recente de openwrt, un peu modifié par mes soins. Mes modifs sont annotés #MQ.


wk ping.sh rc-reconfigure rc-reconfigure~
root@ap94:~# cat S45firewall-wr-rc4
#!/bin/sh

## Please make changes in /etc/firewall.user
${FAILSAFE:+exit}

export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/sbin

. /etc/functions.sh
WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)
WIFI=$(nvram get wifi_ifname)

IPT=/usr/sbin/iptables




drop_ip_olsr () {
ip=1ドル
iptables -A INPUT --source $ip -p udp --dport 698 -j DROP
iptables -A INPUT --destination $ip -p udp --dport 698 -j DROP
}


## CLEAR TABLES
for T in filter nat; do
iptables -t $T -F
iptables -t $T -X
done

iptables -N input_rule
iptables -N output_rule
iptables -N forwarding_rule

iptables -t nat -N prerouting_rule
iptables -t nat -N postrouting_rule

# MQ
for T in DROP ACCEPT REJECT ; do
$IPT -N LOG_${T}
$IPT -A LOG_${T} -j LOG --log-prefix "[IPTABLES $T] : "
$IPT -A LOG_${T} -j $T
done

$IPT -N LOG_P2P_DROP
$IPT -A LOG_P2P_DROP -j LOG --log-prefix "[IPTABLES P2P_DROP] : "
$IPT -A LOG_P2P_DROP -j DROP

# /MQ

### INPUT
### (connections with the router as destination)

# base case
iptables -P INPUT DROP
iptables -A INPUT -m state --state INVALID -j LOG_DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP

#
# insert accept rule or to jump to new accept-check table here
#
iptables -A INPUT -j input_rule

# drop_ip_olsr 169.254.0.51 # MQ pour test

# allow
iptables -A INPUT -i \! $WAN -j ACCEPT # allow from lan/wifi interfaces
iptables -A INPUT -p icmp -j ACCEPT # allow ICMP
# iptables -A INPUT -p gre -j ACCEPT # allow GRE # not supported

# reject (what to do with anything not allowed earlier)
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable

### OUTPUT
### (connections with the router as source)

# base case
iptables -P OUTPUT DROP
iptables -A OUTPUT -m state --state INVALID -j LOG_DROP
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#
# insert accept rule or to jump to new accept-check table here
#
iptables -A OUTPUT -j output_rule

# allow
iptables -A OUTPUT -j ACCEPT #allow everything out

# reject (what to do with anything not allowed earlier)
iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable

### FORWARDING
### (connections routed through the router)

# base case
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

#
# insert accept rule or to jump to new accept-check table here
#
iptables -A FORWARD -j forwarding_rule

# allow
iptables -A FORWARD -i br0 -o br0 -j ACCEPT
iptables -A FORWARD -i $LAN -o $WAN -j LOG_ACCEPT
iptables -A FORWARD -i $LAN -o $WIFI -j LOG_ACCEPT # MQ
iptables -A FORWARD -i $WIFI -o $WIFI -j LOG_ACCEPT # MQ

# reject (what to do with anything not allowed earlier)
# uses the default -P DROP

### MASQ
iptables -t nat -A PREROUTING -j prerouting_rule
iptables -t nat -A POSTROUTING -j postrouting_rule
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
iptables -t nat -A POSTROUTING -o $WIFI -j MASQUERADE # MQ

## USER RULES
# [ -f /etc/firewall.user ] && . /etc/firewall.user


iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule

### BIG FAT DISCLAIMER
### The "-i $WAN" literally means packets that came in over the $WAN interface;
### this WILL NOT MATCH packets sent from the LAN to the WAN address.

### Allow SSH on the WAN interface
# iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j ACCEPT
# iptables -A input_rule -i $WAN -p tcp --dport 22 -j ACCEPT

### Port forwarding
# iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 22 -j DNAT --to 192.168.1.2
# iptables -A forwarding_rule -i $WAN -p tcp --dport 22 -d 192.168.1.2 -j ACCEPT

### DMZ (should be placed after port forwarding / accept rules)
# iptables -t nat -A prerouting_rule -i $WAN -j DNAT --to 192.168.1.2
# iptables -A forwarding_rule -i $WAN -d 192.168.1.2 -j ACCEPT