1
0
mirror of https://github.com/stefanocasazza/ULib.git synced 2025-09-28 19:05:55 +08:00
ULib/tests/examples/nocat/firewall/nodog.fw
stefanocasazza 1517b842c4 sync
2019-05-07 19:08:34 +02:00

1017 lines
35 KiB
Bash

#!/bin/sh
# nodog.fw
networkMatchIface_do() {
awk -f - $* <<EOF
function ip2int(ip) {
for (ret=0,n=split(ip,a,"\."),x=1;x<=n;x++) ret=or(lshift(ret,8),a[x])
return ret
}
BEGIN {
slpos=index(ARGV[1],"/")
tipaddr=ip2int(substr(ARGV[1],0,slpos-1))
tnetmask=compl(2**(32-int(substr(ARGV[1],slpos+1)))-1)
tnetwork=and(tipaddr,tnetmask)
slpos=index(ARGV[2],"/")
if (slpos == 0) {
ipaddr=ip2int(ARGV[2])
netmask=ip2int(ARGV[3])
} else {
ipaddr=ip2int(substr(ARGV[2],0,slpos-1))
netmask=compl(2**(32-int(substr(ARGV[2],slpos+1)))-1)
}
network=and(ipaddr,netmask)
if (network == tnetwork)
exit(1)
m=and(tipaddr,netmask)
if (m == network)
exit(2)
m=and(ipaddr,tnetmask)
if (m == tnetwork)
exit(3)
exit(0)
}
EOF
}
networkMatchIface() {
iface=$1
net=$2
match=0
if which ip >/dev/null; then
#ip addr show dev $iface | awk '/inet/{print $2}' | while read ip; do
ip route show | grep "dev $iface " | awk '{print $1}' | while read ip; do
networkMatchIface_do $net $ip
match=$?
if [ $match -eq 1 -o $match -eq 2 ]; then
exit 1
fi
done
match=$?
else
#ifconfig $iface | awk '/inet/{i=$2;n=$4;gsub("^[^:]*:","",i);gsub("^[^:]*:","",n);print i" "n}' | while read ip nm; do
route | awk '{if($8=="$iface"){print $1" "$3}}' | while read ip nm; do
networkMatchIface_do $net $ip $nm
if [ $match -eq 1 -o $match -eq 2 ]; then
exit 1
fi
done
match=$?
fi
return $match
}
loadKernelModules() {
for module in $1; do
lsmod | grep $module >/dev/null 2>&1
if [ $? -ne 0 ]; then
insmod $module 2>/dev/null
fi
done
}
clearQoS() {
# 1 => Ip
# 2 => Netmask
for ifaceq in $IQdevice; do
tc -p filter show dev ${ifaceq} | awk -v "i=$1/$2" '
/^ /{ t=t $0; next }
{ if(t && index(t,i) && match(t," pref [0-9]+ ")){ print substr(t,RSTART+6,RLENGTH-7) }; t=$0 }
END { if(t && index(t,i) && match(t," pref [0-9]+ ")){ print substr(t,RSTART+6,RLENGTH-7) } }
' | while read UserClass; do
if [ -n "${UserClass}" ]; then
if [ ${UploadRate} -gt 0 ]; then
tc filter del dev ${ifaceq} parent 1: pref ${UserClass} protocol ip u32 match ip src $1/$2 classid 1:${UserClass}0
echo "${UserClass}:1:1:1:1:1" | awk \
-v device="${ifaceq}" \
-v linespeed="${UploadRate}" \
-f firewall/tcrules.awk \
| sed 's/ add / del /g' | sed 'x;1!H;$!d;x' | while read CMD; do $CMD; done
fi
for ifacein in $InternalDevice; do
tc filter del dev $ifacein parent 1: pref ${UserClass} protocol ip u32 match ip dst $1/$2 classid 1:${UserClass}0
echo "${UserClass}:1:1:1:1:1" | awk \
-v device="$ifacein" \
-v linespeed="${DownloadRate}" \
-f firewall/tcrules.awk \
| sed 's/ add / del /g' | sed 'x;1!H;$!d;x' | while read CMD; do $CMD; done
done
fi
done
done
}
checkDeviceUpload() {
if [ -z "$IMQdevice" ]; then
IMQdisabled=1
else
IMQdisabled=0
IQdevice=$IMQdevice
fi
if [ -z "$IFBdevice" ]; then
IFBdisabled=1
else
IFBdisabled=0
IQdevice=$IFBdevice
fi
if [ -z "$IQdevice" ]; then
IQdevice=$ExternalDevice
fi
}
#-----------------------------------
# START FUNCTION
#-----------------------------------
initialize_fw() {
#---------------------------------------------------------------
# Enable IP routing. Required if your firewall is protecting a
# network, NAT included
#---------------------------------------------------------------
echo "1" > /proc/sys/net/ipv4/ip_forward
#---------------------------------------------------------------
# Disable routing triangulation. Respond to queries out
# the same interface, not another. Helps to maintain state
# Also protects against IP spoofing
#---------------------------------------------------------------
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
# Load all the kernel modules we need
loadKernelModules "ipt_TOS xt_mac ipt_ACCOUNT"
clear_fw
# Flush all user-defined chains
$IPTABLES -t filter -N NoCat 2>/dev/null
$IPTABLES -t filter -F NoCat
$IPTABLES -t filter -A NoCat -p tcp -m state --state INVALID -j DROP
for ifacein in $InternalDevice; do
for ifaceout in $ExternalDevice; do
$IPTABLES -t filter -D FORWARD -i $ifacein -o $ifaceout -j NoCat 2>/dev/null
$IPTABLES -t filter -D FORWARD -i $ifaceout -o $ifacein -j NoCat 2>/dev/null
$IPTABLES -t filter -A FORWARD -i $ifacein -o $ifaceout -j NoCat
$IPTABLES -t filter -A FORWARD -i $ifaceout -o $ifacein -j NoCat
done
done
if [ "$BlockRFC1918" = 1 ]; then
$IPTABLES -t filter -N NoCat_RFC1918 2>/dev/null
$IPTABLES -t filter -F NoCat_RFC1918
for net in $FullPrivateNetwork; do
$IPTABLES -t filter -A NoCat_RFC1918 -d $net -j ACCEPT
done
$IPTABLES -t filter -A NoCat_RFC1918 -d 10.0.0.0/8 -j RETURN
$IPTABLES -t filter -A NoCat_RFC1918 -d 172.16.0.0/12 -j RETURN
$IPTABLES -t filter -A NoCat_RFC1918 -d 192.168.0.0/16 -j RETURN
$IPTABLES -t filter -A NoCat_RFC1918 -d 127.0.0.0/8 -j RETURN
$IPTABLES -t filter -A NoCat_RFC1918 -j ACCEPT
fi
$IPTABLES -t filter -N NoCat_Ports 2>/dev/null
$IPTABLES -t filter -F NoCat_Ports
$IPTABLES -t filter -D NoCat -j NoCat_Ports 2>/dev/null
$IPTABLES -t filter -A NoCat -j NoCat_Ports
$IPTABLES -t filter -N NoCat_Inbound 2>/dev/null
$IPTABLES -t filter -F NoCat_Inbound
$IPTABLES -t filter -D NoCat -j NoCat_Inbound 2>/dev/null
$IPTABLES -t filter -A NoCat -j NoCat_Inbound
$IPTABLES -t nat -N NoCat_Capture 2>/dev/null
$IPTABLES -t nat -F NoCat_Capture
$IPTABLES -t nat -D PREROUTING -j NoCat_Capture 2>/dev/null
$IPTABLES -t nat -A PREROUTING -j NoCat_Capture
$IPTABLES -t nat -N NoCat_NAT 2>/dev/null
$IPTABLES -t nat -F NoCat_NAT
# Only nat if we're not routing
$IPTABLES -t nat -D POSTROUTING -j NoCat_NAT 2>/dev/null
[ $RouteOnly -gt 0 ] || $IPTABLES -t nat -A POSTROUTING -j NoCat_NAT
$IPTABLES -t mangle -N NoCat 2>/dev/null
$IPTABLES -t mangle -F NoCat
$IPTABLES -t mangle -N NoCat_Permit 2>/dev/null
$IPTABLES -t mangle -F NoCat_Permit
$IPTABLES -t mangle -D PREROUTING -j NoCat 2>/dev/null
$IPTABLES -t mangle -A PREROUTING -j NoCat
if [ $MembersOnly -gt 0 ]; then
classes="1 2"
else
classes="1 2 3"
fi
# Handle tagged traffic. The current service classes by fwmark are:
# -----------------------------------------------------------------
# 1: Owner
# 2: Co-op
# 3: Public
# 4: Free
# -----------------------------------------------------------------
for iface in $InternalDevice; do
ifaceinout=0
for ifaceout in $ExternalDevice; do
if [ "$iface" == "$ifaceout" ]; then
ifaceinout=1
fi
done
for net in $LocalNetwork; do
networkMatchIface $iface $net
[ $? -eq 1 ] || continue
# check se evitare il mascheramento del traffico verso portale autorizzativo
if [ "$AvoidMasqueradeAuthServiceIP" = "1" ]; then
for ifaceout in $MasqueradeDevice; do
$nat -o $ifaceout -s $net -d $AuthServiceIP -j RETURN
done
fi
for fwmark in $classes; do
# Only forward tagged traffic per class
if [ "$BlockRFC1918" = 1 ]; then
$fwd -i $iface -s $net -m mark --mark $fwmark -j NoCat_RFC1918
else
$fwd -i $iface -s $net -m mark --mark $fwmark -j ACCEPT
fi
# Masquerade permitted connections.
for ifaceout in $MasqueradeDevice; do
$nat -o $ifaceout -s $net -m mark --mark $fwmark -j MASQUERADE
done
done
if [ $MembersOnly -gt 0 ]; then
for ifaceout in $MasqueradeDevice; do
$nat -o $ifaceout -s $net -m mark --mark 3 -j MASQUERADE
done
fi
# Allow web traffic to the specified hosts, and don't capture connections intended for them
open_fw "$AuthServiceIP $1 $AllowedWebHosts"
# Accept forward and back traffic to/from DNSAddr
if [ "$DNSAddr" ]; then
dns_item=""
for dns in $DNSAddr; do
$fwd -o $iface -d $net -s $dns -j ACCEPT
for prot in tcp udp; do
$fwd -i $iface -s $net -d $dns -p $prot --dport 53 -j ACCEPT
$nat -p $prot -s $net -d $dns --dport 53 -j MASQUERADE
# allow authenticated DNS traffic through this server.
$redirect -i $iface -m mark --mark 4 -p $prot --dport 53 -s $net -d $dns -j RETURN
done
dns_item=$dns
done
# Force unauthenticated DNS traffic through this server.
# Of course, only the first rule of this type will match.
# But it's easier to leave them all in ATM.
for prot in tcp udp; do
$redirect -i $iface -m mark --mark 4 -p $prot --dport 53 -s $net -j DNAT --to-destination $dns_item:53
done
else
for prot in tcp udp; do
$redirect -i $iface -m mark --mark 4 -p $prot --dport 53 -s $net -j REDIRECT --to-port 53
done
fi
for prot in tcp udp; do
$redirect -i $iface -d $FullPrivateNetwork -p $prot --dport 53 -s $net -j REDIRECT --to-port 53
done
if [ "$ifaceinout" == "1" ]; then
# Set packets from internal devices to fw mark 4, or 'denied', by default.
$mangle -i $iface -s $net -j MARK --set-mark 4
$mangle -i $iface -j NoCat_Permit
fi
done
if [ "$ifaceinout" != "1" ]; then
# Set packets from internal devices to fw mark 4, or 'denied', by default
$mangle -i $iface -j MARK --set-mark 4
$mangle -i $iface -j NoCat_Permit
fi
done
# Redirect outbound non-auth web traffic to the local gateway process except to windowsupdate.microsoft.com, which is broken.
# If MembersOnly is active, then redirect public class as well
#
#if [ $MembersOnly -gt 0 ]; then
# nonauth="3 4"
#else
nonauth="4"
#fi
for iface in $InternalDevice; do
for mark in $nonauth; do
$redirect -m mark --mark $mark -i $iface -p tcp --dport 80 -j REDIRECT --to-port $GatewayPort
done
done
# Lock down more ports for public users, if specified. Port restrictions are not applied to co-op and owner class users
#
# There are two philosophies in restricting access:
#
# That Which Is Not Specifically Permitted Is Denied
# That Which Is Not Specifically Denied Is Permitted
#
# If "IncludePorts" is defined, the default policy will be to deny all traffic, and only allow the ports mentioned
# If "ExcludePorts" is defined, the default policy will be to allow all traffic, except to the ports mentioned
#
# If both are defined, ExcludePorts will be ignored, and the default policy
# will be to deny all traffic, allowing everything in IncludePorts, and issue a warning
if [ "$IncludePorts" ]; then
if [ "$ExcludePorts" ]; then
echo "WARNING: ExcludePorts and IncludePorts are both defined"
echo "Ignoring 'ExcludePorts'. Please check your configuration"
fi
# Enable all ports in IncludePorts
for iface in $InternalDevice; do
for port in $IncludePorts; do
$ports -p tcp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
$ports -p udp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
done
# Always permit access to the GatewayPort (or we can't logout)
$ports -p tcp -i $iface --dport $GatewayPort -j ACCEPT
$ports -p udp -i $iface --dport $GatewayPort -j ACCEPT
# ...and disable access to the rest
$ports -p tcp -i $iface -m mark --mark 3 -j DROP
$ports -p udp -i $iface -m mark --mark 3 -j DROP
# supporto anti DoS sul captive portal
if [ $DosPrevention -gt 0 ]; then
$local -p tcp -i $iface --dport $GatewayPort -m state --state NEW -m recent --set --name NoCat
$local -p tcp -i $iface --dport $GatewayPort -m state --state NEW -m recent --update --name NoCat \
--seconds $DosTimeInterval --hitcount `expr $DosAllowTries + 1` -j DROP
fi
done
elif [ "$ExcludePorts" ]; then
# If ExcludePorts has entries, simply deny access to them
for iface in $InternalDevice; do
for port in $ExcludePorts; do
$ports -p tcp -i $iface --dport $port -m mark --mark 3 -j DROP
$ports -p udp -i $iface --dport $port -m mark --mark 3 -j DROP
done
done
fi
# Disable access on the external to GatewayPort from anything but the AuthServiceIP
for src in $AuthServiceIP; do
for ifaceout in $ExternalDevice; do
$fwd -i $ifaceout ! -s $src -p tcp --dport $GatewayPort -j DROP
done
done
# Filter policy
$fwd -j DROP
# --------------------------------------------------------------------------------------------------------------------------------------------------
# Automatically sets the proper value of MSS (Maximum Segment Size) of TCP SYN packets that the firewall sees of all outgoing packets.
# --------------------------------------------------------------------------------------------------------------------------------------------------
# The MSS value is used to control the maximum size of packets for specific connections. Under normal circumstances, this means the size of
# the MTU (Maximum Transfer Unit) value, minus 40 bytes. This is used to overcome some ISP's and servers that block ICMP fragmentation needed
# packets, which can result in really weird problems which can mainly be described such that everything works perfectly from your firewall/router,
# but your local hosts behind the firewall can't exchange large packets. This could mean such things as mail servers being able to send small mails,
# but not large ones, web browsers that connect but then hang with no data received, and ssh connecting properly, but scp hangs after the initial
# handshake. In other words, everything that uses any large packets will be unable to work.
# --------------------------------------------------------------------------------------------------------------------------------------------------
# Normal MTU for ethernet is 1500 bytes, therefore minus 40 bytes MSS is 1460 bytes. MSS only has to be set properly in the SYN packet.
# --------------------------------------------------------------------------------------------------------------------------------------------------
# The --clamp-mss-to-pmtu automatically sets the MSS to the proper value, hence you don't need to explicitly set it. It is automatically set to PMTU
# (Path Maximum Transfer Unit) minus 40 bytes, which should be a reasonable value for most applications.
# --------------------------------------------------------------------------------------------------------------------------------------------------
if [ $MaxSegmentSize -gt 0 ]; then
for iface in $ExternalDevice; do
$IPTABLES -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $iface -j TCPMSS --clamp-mss-to-pmtu
done
fi
# Account traffic
$IPTABLES -t mangle -N AccountIn 2>/dev/null
$IPTABLES -t mangle -F AccountIn
$IPTABLES -t mangle -N AccountOu 2>/dev/null
$IPTABLES -t mangle -F AccountOu
for iface in $InternalDevice; do
$IPTABLES -t mangle -D POSTROUTING -o $iface -j AccountIn 2>/dev/null
$IPTABLES -t mangle -A POSTROUTING -o $iface -j AccountIn
done
for iface in $ExternalDevice; do
$IPTABLES -t mangle -D POSTROUTING -o $iface -j AccountOu 2>/dev/null
$IPTABLES -t mangle -A POSTROUTING -o $iface -j AccountOu
done
for srv in "$AuthServiceIP"; do
$IPTABLES -t mangle -A AccountIn -s "$srv" -j RETURN
$IPTABLES -t mangle -A AccountOu -d "$srv" -j RETURN
done
for net in $LocalNetwork; do
$IPTABLES -t mangle -A AccountIn -s "$net" -j RETURN
$IPTABLES -t mangle -A AccountOu -d "$net" -j RETURN
$IPTABLES -t mangle -A AccountIn -j ACCOUNT --addr "$net" --tname "$net"
$IPTABLES -t mangle -A AccountOu -j ACCOUNT --addr "$net" --tname "$net"
done
# --------------------------------------------------------------------------
[ -S /tmp/evfwdsock ] && /usr/sbin/fwevhandler i
# Bandwidth limits
# --------------------------------------------------------------------------
[ $EnableBandwidthLimits -gt 0 ] || return
if [ $IMQdisabled -eq 0 ]; then
extra_modules=ipt_IMQ
fi
if [ $IFBdisabled -eq 0 ]; then
extra_modules="ifb em_u32 act_connmark act_mirred sch_ingress"
fi
loadKernelModules "xt_CONNMARK xt_CLASSIFY sch_red sch_sfq sch_hfsc cls_basic cls_fw cls_u32 $extra_modules"
if [ ${UploadRate} -gt 0 ]; then
for ifaceq in ${IQdevice}; do
[ $IMQdisabled -eq 0 -o $IFBdisabled -eq 0 ] && ifconfig ${ifaceq} up txqueuelen 5
tc qdisc del dev ${ifaceq} root
tc qdisc add dev ${ifaceq} root handle 1: hfsc default 10
tc class add dev ${ifaceq} parent 1: classid 1:1 hfsc sc rate ${UploadRate}kbit ul rate ${UploadRate}kbit
echo "${ReservedClass}:${ReservedPriority}:${ReservedAverageRate}:${ReservedPacketSize}:${ReservedDelay}:${ReservedRatio}" | awk \
-v device="${ifaceq}" \
-v linespeed="${UploadRate}" \
-f firewall/tcrules.awk \
| while read CMD; do $CMD; done
tc filter del dev ${ifaceq} parent 1: protocol ip pref 1 fw
done
fi
for ifacein in $InternalDevice; do
if [ ${UploadRate} -gt 0 ]; then
if [ $IMQdisabled -eq 0 ]; then
for ifaceq in ${IQdevice}; do
$IPTABLES -t mangle -D PREROUTING -i $ifacein -j IMQ --todev ${ifaceq:3:1}
$IPTABLES -t mangle -I PREROUTING 1 -i $ifacein -j IMQ --todev ${ifaceq:3:1}
done
fi
fi
ifconfig $ifacein up txqueuelen 5
tc qdisc del dev $ifacein root
tc qdisc add dev $ifacein root handle 1: hfsc default 10
tc class add dev $ifacein parent 1: classid 1:1 hfsc sc rate ${DownloadRate}kbit ul rate ${DownloadRate}kbit
echo "${ReservedClass}:${ReservedPriority}:${ReservedAverageRate}:${ReservedPacketSize}:${ReservedDelay}:${ReservedRatio}" | awk \
-v device="$ifacein" \
-v linespeed="${DownloadRate}" \
-f firewall/tcrules.awk \
| while read CMD; do $CMD; done
tc filter del dev $ifacein parent 1: protocol ip pref 1 fw
if [ ${UploadRate} -gt 0 ]; then
if [ $IFBdisabled -eq 0 ]; then
tc qdisc add dev $ifacein handle ffff: ingress
for ifaceq in ${IQdevice}; do
tc filter add dev $ifacein parent ffff: protocol ip prio 1 u32 \
match u32 0 0 flowid 1:1 \
action connmark \
action mirred egress redirect dev ${ifaceq}
done
fi
fi
done
# --------------------------------------------------------------------------
}
access_fw() {
cmd=$1
mac=$2
mac=`echo $2 | tr '[A-Z]' '[a-z]'`
ip=$3
class=$4
if [ -z "$class" ]; then
class=Public
fi
if [ "$class" = "Owner" ]; then
mark=1
elif [ "$class" = "Member" ]; then
mark=2
elif [ "$class" = "Public" ]; then
mark=3
else
echo "FATAL: Bad class: $class!"
exit 1
fi
local action=""
if [ "$cmd" = "-A" ]; then
action="permit"
else
action="deny"
fi
# Bandwidth limits
# --------------------------------------------------------------------------
Ip=""
Netmask=""
UserUploadRatio=0
UserDownloadRatio=0
if [ $EnableBandwidthLimits -gt 0 ]; then
Ip=`echo $ip | sed 's!/.*!!'`
Netmask=`echo $ip | sed 's!^.*/!!'`
if [ "$Ip" = "$Netmask" ]; then
Netmask=32
fi
checkDeviceUpload
if [ "$action" = "permit" ]; then
if [ $5 -ne 0 ]; then
UserDownloadRate = $5
fi
if [ $6 -ne 0 ]; then
UserUploadRate = $6
fi
UserUploadRatio=$(( $UserUploadRate * 100 / ${UploadRate} ))
UserDownloadRatio=$(( $UserDownloadRate * 100 / ${DownloadRate} ))
if [ $UserUploadRatio -gt 100 ]; then
UserUploadRatio=100
fi
if [ $UserDownloadRatio -gt 100 ]; then
UserDownloadRatio=100
fi
fi
fi
if [ "$action" = "permit" ]; then
tFOUND=0
tDIRTY=0
tFOUNDMARK=""
# restituisce MAC + mark
$IPTABLES -t mangle -n -L NoCat_Permit | \
awk -v i=$ip '/[ \t]MAC /{if($4==i){print tolower($7) " " $10};next } {if($4==i){print "00:00:00:00:00:00 " $8 }}' | \
while read tMAC tMARK;
do
if [ "$tMAC" == "00:00:00:00:00:00" ]; then
if [ "$mac" == "00:00:00:00:00:00" ]; then
tFOUND=1
tFOUNDMARK=$tMARK
else
tDIRTY=1
$IPTABLES -t mangle -D NoCat_Permit -s $ip -j MARK --set-mark $tMARK
fi
else
if [ "$tMAC" == "$mac" ]; then
tFOUND=1
tFOUNDMARK=$tMARK
else
tDIRTY=1
$IPTABLES -t mangle -D NoCat_Permit -s $ip -m mac --mac-source $tMAC -j MARK --set-mark $tMARK
fi
fi
done
[ $tDIRTY -eq 0 -a $tFOUND -eq 1 ] && return
if [ $tFOUND -eq 1 ]; then
if [ "$mac" == "00:00:00:00:00:00" ]; then
$IPTABLES -t mangle -D NoCat_Permit -s $ip -j MARK --set-mark $tFOUNDMARK
else
$IPTABLES -t mangle -D NoCat_Permit -s $ip -m mac --mac-source $mac -j MARK --set-mark $tFOUNDMARK
fi
fi
# -----------------------------------------------------------------------------------------------------
# this command often give this message 'iptables: Bad rule (does a matching rule exist in that chain?)'
# -----------------------------------------------------------------------------------------------------
$IPTABLES -t filter -D NoCat_Inbound -d $ip -j ACCEPT 2>/dev/null
# -----------------------------------------------------------------------------------------------------
if [ $EnableBandwidthLimits -gt 0 ]; then
clearQoS $Ip $Netmask
fi
fi
# Mark outbound traffic from this node.
if [ "$mac" == "00:00:00:00:00:00" ]; then
if [ -z "$7" -o "$7" = "$ifacein" ]; then
$IPTABLES -t mangle $cmd NoCat_Permit -s $ip -j MARK --set-mark $mark
fi
else
if [ -z "$7" -o "$7" = "$ifacein" ]; then
$IPTABLES -t mangle $cmd NoCat_Permit -s $ip -m mac --mac-source $mac -j MARK --set-mark $mark
fi
fi
# Mark inbound traffic to this node.
$IPTABLES -t filter $cmd NoCat_Inbound -d $ip -j ACCEPT
if [ $EnableBandwidthLimits -gt 0 ]; then
if [ "$action" = "deny" ]; then
clearQoS $Ip $Netmask
else
for ifacein in $InternalDevice; do
UserClass=`tc filter show dev $ifacein | awk \
-v base=11 \
'BEGIN{
n=0
}
/ flowid /{
sub("^1:","",$NF)
sub("0$","",$NF)
a[n++]=$NF+0
}
END{
isort(a,j)
i=0
if(a[i]>base){
p = base
} else {
while(a[i]+1>=a[i+1]&&i<n-1){
i++
}
p=a[i]+1
if(p<base){ p=base }
}
print p
}
function isort(A,n,i,j,hold){
for(i=2;i<=n;i++){
j=i
hold=A[j]
while(A[j-1]>hold){
j--
A[j+1]=A[j]
}
A[j]=hold
}
}'`
break
done
if [ ${UserUploadRatio} -gt 0 ]; then
for ifaceq in ${IQdevice}; do
echo "${UserClass}:${UserPriority}:${UserAverageRate}:${UserPacketSize}:${UserDelay}:${UserUploadRatio}" | awk \
-v device="${ifaceq}" \
-v linespeed="${UploadRate}" \
-f firewall/tcrules.awk \
| while read CMD; do $CMD; done
tc filter del dev ${ifaceq} parent 1: protocol ip pref ${UserClass} fw
tc filter add dev ${ifaceq} parent 1: pref ${UserClass} protocol ip u32 match ip src $Ip/$Netmask classid 1:${UserClass}0
done
fi
if [ ${UserDownloadRatio} -gt 0 ]; then
for ifacein in $InternalDevice; do
echo "${UserClass}:${UserPriority}:${UserAverageRate}:${UserPacketSize}:${UserDelay}:${UserDownloadRatio}" | awk \
-v device="$ifacein" \
-v linespeed="${DownloadRate}" \
-f firewall/tcrules.awk \
| while read CMD; do $CMD; done
tc filter del dev $ifacein parent 1: protocol ip pref ${UserClass} fw
tc filter add dev $ifacein parent 1: pref ${UserClass} protocol ip u32 match ip dst $Ip/$Netmask classid 1:${UserClass}0
done
fi
fi
fi
[ -S /tmp/evfwdsock ] && /usr/sbin/fwevhandler "$action" "$mac" "$ip"
}
access_fw_check() {
# ------------------------------------------------------------
# (CMD) (MAC) (IP) (Class) (UserDownloadRate) (UserUploadRate)
# ------------------------------------------------------------
# cmd=$1
mac=`echo $2 | tr '[A-Z]' '[a-z]'`
ip=$3
# class=$4
# UserDownloadRate=$5
# UserUploadRate=$6
# ------------------------------------------------------------
local action=""
if [ "$1" = "-A" ]; then
action="permit"
else
action="deny"
fi
local i=1
while [ $i -le 2 ]
do
access_fw $1 $mac $ip $4 $5 $6
# check
fail=0
count=`$IPTABLES -t mangle -L NoCat_Permit -n | grep -c $ip`;
if [ $count -gt 0 ]; then
if [ "$action" = "deny" ]; then
fail=1
fi
else
if [ "$action" = "permit" ]; then
fail=1
fi
fi
if [ $fail -eq 0 ]; then
return
fi
i=`expr $i + 1`
done
echo "$ip $mac" > /tmp/nodog_fw.$action
}
clear_fw() {
#$IPTABLES -F
#$IPTABLES -t nat -F
#$IPTABLES -t mangle -F
#$IPTABLES -t filter -F
#$IPTABLES -t nat -X
#$IPTABLES -t mangle -X
#$IPTABLES -t filter -X
$IPTABLES -t filter -F FORWARD
$IPTABLES -t filter -F NoCat
$IPTABLES -t filter -F NoCat_RFC1918
$IPTABLES -t filter -F NoCat_Inbound
$IPTABLES -t filter -F NoCat_Ports
$IPTABLES -t filter -X NoCat
$IPTABLES -t filter -X NoCat_RFC1918
$IPTABLES -t filter -X NoCat_Inbound
$IPTABLES -t filter -X NoCat_Ports
$IPTABLES -t nat -D PREROUTING -j NoCat_Capture
$IPTABLES -t nat -D POSTROUTING -j NoCat_NAT
$IPTABLES -t nat -F NoCat_Capture
$IPTABLES -t nat -F NoCat_NAT
$IPTABLES -t nat -X NoCat_Capture
$IPTABLES -t nat -X NoCat_NAT
$IPTABLES -t mangle -D PREROUTING -j NoCat
$IPTABLES -t mangle -L POSTROUTING -v | awk '/Accoun/{system("'$IPTABLES' -t mangle -D POSTROUTING -o " $7 " -j " $3);}'
$IPTABLES -t mangle -L POSTROUTING -v | awk '/TCPMSS/{system("'$IPTABLES' -t mangle -D POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o " $7 " -j TCPMSS --clamp-mss-to-pmtu");}'
$IPTABLES -t mangle -F AccountIn
$IPTABLES -t mangle -F AccountOu
$IPTABLES -t mangle -F NoCat
$IPTABLES -t mangle -F NoCat_Permit
$IPTABLES -t mangle -X AccountIn
$IPTABLES -t mangle -X AccountOu
$IPTABLES -t mangle -X NoCat
$IPTABLES -t mangle -X NoCat_Permit
[ $EnableBandwidthLimits -gt 0 ] || return
if [ -f /etc/init.d/qos ]; then
/etc/init.d/qos enabled && /etc/init.d/qos stop
fi
checkDeviceUpload
if [ ${UploadRate} -gt 0 ]; then
tc qdisc del dev ${IQdevice} root
fi
for ifacein in $InternalDevice; do
tc qdisc del dev $ifacein root
done
if [ -f /etc/init.d/qos ]; then
/etc/init.d/qos enabled && /etc/init.d/qos start
fi
}
reset_fw() {
$IPTABLES -t filter -D FORWARD -j NoCat 2>/dev/null
$IPTABLES -t nat -D PREROUTING -j NoCat_Capture 2>/dev/null
if [ $RouteOnly -eq 0 ]; then
$IPTABLES -t nat -D POSTROUTING -j NoCat_NAT 2>/dev/null
fi
$IPTABLES -t mangle -D PREROUTING -j NoCat 2>/dev/null
}
open_fw() {
# $1 host list
if [ "$1" ]; then
for host in $1; do
for port in 80 443; do
for ifaceout in $MasqueradeDevice; do
$nat -o $ifaceout -s $net -d $host -p tcp --dport $port -j MASQUERADE
done
$redirect -s $net -d $host -p tcp --dport $port -j RETURN
$fwd -s $net -d $host -p tcp --dport $port -j ACCEPT
$fwd -d $net -s $host -p tcp --sport $port -j ACCEPT
done
done
fi
}
check_arp() {
for iface in $InternalDevice; do
arping -q -c 1 -I $iface $1
done
egrep -q "^$1 " /proc/$$/net/arp
exit $?
}
do_cmd() {
# Note: your PATH is inherited from the gateway process
if [ -x /usr/sbin/iptables ]; then
IPTABLES=/usr/sbin/iptables
else
IPTABLES="echo iptables"
fi
fwd="$IPTABLES -t filter -A NoCat"
ports="$IPTABLES -t filter -A NoCat_Ports"
local="$IPTABLES -t filter -A NoCat_LocalPorts"
nat="$IPTABLES -t nat -A NoCat_NAT"
redirect="$IPTABLES -t nat -A NoCat_Capture"
mangle="$IPTABLES -t mangle -A NoCat"
case "$1" in
arp) shift; check_arp "$@" ;; # (IP)
deny) shift; access_fw "-D" "$@" ;; # (CMD) (MAC) (IP) (Class)
# deny) shift; access_fw_check "-D" "$@" ;; # (CMD) (MAC) (IP) (Class)
clear) shift; clear_fw "$@" ;;
reset) shift; reset_fw "$@" ;;
permit) shift; access_fw "-A" "$@" ;; # (CMD) (MAC) (IP) (Class) (UserDownloadRate) (UserUploadRate)
# permit) shift; access_fw_check "-A" "$@" ;; # (CMD) (MAC) (IP) (Class) (UserDownloadRate) (UserUploadRate)
initialize) shift; initialize_fw "$1" ;;
openlist)
$IPTABLES -t mangle -L NoCat_Permit -n | awk '/MARK set 0x2/{printf("%s\n", $4)}' | sort -u;
# $IPTABLES -t mangle -L NoCat_Permit -n | awk '/MARK set 0x2/{printf("%s\n", $4)}' | sort -u | tee /tmp/nodog_fw.lst;
;;
esac
}
#-----------------------------------
# END FUNCTION
#-----------------------------------
export RouteOnly MasqueradeDevice DNSAddr IncludePorts ExcludePorts AllowedWebHosts ExternalDevice \
InternalDevice LocalNetwork GatewayPort AuthServiceIP MembersOnly MaxSegmentSize IPTABLES \
EnableBandwidthLimits IMQdevice IFBdevice UserDelay UserPriority UserUploadRate UserPacketSize \
UserAverageRate UserDownloadRate UploadRate DownloadRate ReservedRatio ReservedClass ReservedDelay \
ReservedPriority ReservedAverageRate ReservedPacketSize DosPrevention DosAllowTries DosTimeInterval \
IMQdisabled IFBdisabled IQdevice AvoidMasqueradeAuthServiceIP
# ------------------------------------------------------------
# load eventuale script configuration (NON piace a Ghivizzani)
# ------------------------------------------------------------
# if [ -n "$FW_CONF" -a -s "$FW_CONF" ]; then
# . $FW_CONF
# fi
# ------------------------------------------------------------
# ---------------------------------------------------------------------------------------------------------------------------------------------------
# RouteOnly Required only if you DO NOT want your gateway to act as a NAT. Give this only if you're running a strictly routed
# network, and don't need the gateway to enable NAT for you
#
# DNSAddr *If* you choose not to run DNS on your internal network, specify the address(es) of one or more domain name server
# on the Internet that wireless clients can use to get out. Should be the same DNS that your DHCP server hands out
#
# IncludePorts Specify TCP ports to allow access to when public class users login. All others will be denied
#
# ExcludePorts Specify TCP ports to denied access to when public class users login. All others will be allowed. Note that you should
# use either IncludePorts or ExcludePorts, but not both. If neither is specified, access is granted to all ports to public class users.
# You should *always* exclude port 25, unless you want to run an portal for wanton spam sending. Users should have their
# own way of sending mail. It sucks, but that's the way it is. Comment this out *only if* you're using IncludePorts instead
#
# AllowedWebHosts List any domains that you would like to allow web access (TCP port 80 and 443) BEFORE logging in (this is the
# pre-'skip' stage, so be careful about what you allow
#
# ExternalDevice The interface connected to the Internet. Usually 'eth0' or 'eth1' under Linux, or maybe even 'ppp0' if you're running PPP or PPPoE
#
# InternalDevice Required if and only if your machine has more than two network interfaces. Must be set to the interface connected to your local
# network, normally your wireless card
#
# LocalNetwork Must be set to the network address and net mask of your internal network. You can use the number of bits in the netmask
# (e.g. /16, /24, etc.) or the full x.x.x.x specification
#
# GatewayPort The TCP port to bind the gateway service to. 5280 is de-facto standard for NoCatAuth. Change this only if you absolutely need to
#
# AuthServiceIP The address of your authentication service. You must use an IP address if DNS resolution isn't available at gateway startup
#
# MembersOnly Give this if you want to disable public access (i.e. unauthenticated 'skip' button access). You'll also want to
# point AuthServiceIP somewhere that doesn't include a skip button (likeat your own Auth server)
#
# MaxSegmentSize Give this if you want to reduce MTU
#
# MasqueradeDevice maschera il traffico verso il device
# AvoidMasqueradeAuthServiceIP evita di mascherare il traffico verso portale autorizzativo
# ---------------------------------------------------------------------------------------------------------------------------------------------------
RouteOnly=${RouteOnly:-0}
MembersOnly=${MembersOnly:-1}
GatewayPort=${GatewayPort:-5280}
MaxSegmentSize=${MaxSegmentSize:-1}
AvoidMasqueradeAuthServiceIP=${AvoidMasqueradeAuthServiceIP:-0}
# ---------------------------------------------------------------------------------------------------------------------------------------------------
# Gestione dei limiti sulla banda per gli utenti
# ---------------------------------------------------------------------------------------------------------------------------------------------------
# IMQdevice IMQ device per la gestione del bitrate in upload
# IFBdevice IFB device per la gestione del bitrate in upload
# UploadRate Upload bit rate per le interfacce interne (in Kbits)
# DownloadRate Download bit rate per le interfacce interne (in Kbits)
# UserDelay delay accettabile per il traffico utente (default 100, in millisecondi)
# UserPriority priorita' del traffico degli utenti (default 5)
# UserUploadRate Bit rate in upload di default per gli utenti (in Kbits)
# UserPacketSize dimensione massima del pacchetto sull'interfaccia (default 1500, in bytes)
# UserAverageRate rate medio per il traffico (default 10)
# UserDownloadRate Bit rate in download di default per gli utenti (in Kbits)
# ReservedRatio percentuale di banda riservata
# ReservedClass classId da utilizzare per il qos (default 1)
# ReservedDelay delay accettabile per il traffico riservato (default 200, in millisecondi)
# ReservedPriority priorita' per il traffico riservato (default 1, bassa priorita')
# ReservedPacketSize dimensione massima del pacchetto sull'interfaccia (default 1500, in bytes)
# ReservedAverageRate rate medio per il traffico riservato atto al dimensionamento dei parametri di coda (default 1)
# EnableBandwidthLimits abilita la gestione dei limiti sulla banda per gli utenti
# FullPrivateNetwork la rete privata utilizzata internamente
# BlockRFC1918 blocca il travvico verso le reti private
#
# DosPrevention abilita il supporto anti DoS sul captive portal (da impostare ad 1 per attivare il supporto)
# DosAllowTries numero massimo di connessioni consentite nella finestra temporale
# DosTimeInterval finestra temporale in cui osservare il numero di connessioni per IP
# ---------------------------------------------------------------------------------------------------------------------------------------------------
IFBdevice=${IFBdevice:-ifb0}
UploadRate=${UploadRate:-10240}
DownloadRate=${DownloadRate:-10240}
UserDelay=${UserDelay:-100}
UserPriority=${UserPriority:-5}
UserUploadRate=${UserUploadRate:-1024}
UserPacketSize=${UserPacketSize:-1500}
UserAverageRate=${UserAverageRate:-10}
UserDownloadRate=${UserDownloadRate:-10240}
ReservedRatio=${ReservedRatio:-10}
ReservedClass=${ReservedClass:-1}
ReservedDelay=${ReservedDelay:-200}
ReservedPriority=${ReservedPriority:-1}
ReservedPacketSize=${ReservedPacketSize:-1500}
ReservedAverageRate=${ReservedAverageRate:-1}
EnableBandwidthLimits=${EnableBandwidthLimits:-0}
FullPrivateNetwork=${FullPrivateNetwork:-192.168.0.0/16}
BlockRFC1918=${BlockRFC1918:-1}
DosPrevention=${DosPrevention:-0}
DosAllowTries=${DosAllowTries:-5}
DosTimeInterval=${DosTimeInterval:-60}
# (
# echo "ENVIRONMENT:"
# echo "-----------------------------------------------------------"
# env
# echo "-----------------------------------------------------------"
# echo "STDERR:"
# echo "-----------------------------------------------------------"
# set -x
do_cmd "$@"
# set +x
# echo "-----------------------------------------------------------"
# ) 2>/tmp/nodog_fw.$$ >&2