release/src/router/nocat/libexec/iptables/initialize.fw

   1 #!/bin/sh
   2 ##
   3 #
   4 # initialize.fw: setup the default firewall rules
   5 #
   6 # *** NOTE ***
   7 #
   8 # If you want to have local firewall rules in addition to what NoCat
   9 # provides, add them at the bottom of this file.  They will be recreated
  10 # each time gateway is restarted.
  11 #
  12 ##
  13 # The current service classes by fwmark are:
  14 #
  15 #  1: Owner
  16 #  2: Co-op
  17 #  3: Public
  18 #  4: Free
  19 #
  20 #NOTE: all NoCat Configuration items should be set in the environment before calling.
  21
  22
  23 export PATH=$FirewallPath:/tmp/sbin:/tmp/bin:/bin:/usr/bin:/sbin:/usr/sbin
  24
  25 # match rule numbers in the $1 table, chain $2
  26 rule_num() {
  27     NUM=`iptables -t $1 -L $2 -n | sed -e '1,2d' | grep -n $3 | head -n 1 | cut -d : -f 1`
  28     if [ -z "$NUM" ]; then echo "0"; else echo "$NUM"; fi
  29 }
  30
  31 #Special handling of linksys firewall:
  32 #we replace the FORWARD jump to lan2wan rule with jump to NoCat
  33 #in NoCat we will jump to lan2wan instead of accept for the accepted marked client packets
  34 #at the end we will not drop but return, so the port forwarding as defined in the linksys rules can be applied
  35 #after those rules we will remove the general acceptance (state NEW) of
  36 #any connections on non authorized clients and add a drop just to be sure
  37 #In case the initialization was already perfromed, first replace the NoCat rule
  38 #with the the lan2wan rule, only if the NoCat rule contains a lan2wan rule
  39 #Then, lan2wwan rule again witht the nocat rule ase described above
  40
  41 #Test for RE-initialization:
  42 NOCAT_RULE_NR=`rule_num filter FORWARD 'NoCat '`
  43 if [ $NOCAT_RULE_NR -gt 0 ]; then
  44     if [ $Verbosity -gt 4 ]; then logger "Previous NoCat initialization detected."; fi
  45     #yes, now check if this a linksys specific re-initialization
  46     TEST_NOCAT_LAN2WAN_IPTABLES_RESULT=`rule_num filter NoCat 'lan2wan'`
  47     if [ $Verbosity -gt 4 ]; then logger "TEST_NOCAT_LAN2WAN=$TEST_NOCAT_LAN2WAN_IPTABLES_RESULT."; fi
  48     if [ $TEST_NOCAT_LAN2WAN_IPTABLES_RESULT -gt 0 ]; then
  49         #yes, now put lan2wan back in the forward chain
  50         if [ $Verbosity -gt 4 ]; then logger "Ewrt: Replacing lan2wan at position: $NOCAT_RULE_NR in the FORWARD chain."; fi
  51         iptables -t filter -D FORWARD $NOCAT_RULE_NR
  52         iptables -t filter -I FORWARD $NOCAT_RULE_NR -j lan2wan
  53     fi
  54 fi
  55
  56 TARGET_ACCEPT="ACCEPT"
  57 TARGET_DROP="DROP"
  58
  59 #Check if this an Ewrt-specific initialization
  60 LAN2WAN_RULE_NR=`rule_num filter FORWARD lan2wan`
  61 if [ $LAN2WAN_RULE_NR -gt 0 ]; then
  62     if [ $Verbosity -gt 4 ]; then logger "Ewrt (WRT54G) firewall detected, preserving."; fi
  63
  64     # Set accept target to LOG ACCEPTed packets, if the nvram value log_level is set
  65     LOG_LEVEL=`/usr/sbin/nvram get log_level`
  66     if [ $Verbosity -gt 4 ]; then logger "Ewrt: log_level=$LOG_LEVEL"; fi
  67     if [ $LOG_LEVEL -gt 0 ]; then
  68         if [ $Verbosity -gt 4 ]; then logger "Ewrt: Logging DROPPED packets."; fi
  69         TARGET_DROP="logdrop"
  70         if [ $LOG_LEVEL -gt 1 ]; then
  71            if [ $Verbosity -gt 4 ]; then logger "Ewrt: Logging ACCEPTED packets."; fi
  72            TARGET_ACCEPT="logaccept"
  73         fi
  74     fi
  75 fi
  76
  77 if [ $Verbosity -gt 4 ]; then logger "Enabling IP-forwarding and rp_filter (to kill IP spoof attempts)"; fi
  78 echo "1" > /proc/sys/net/ipv4/ip_forward
  79 echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
  80
  81 if [ $Verbosity -gt 4 ]; then logger "Initializing NoCat chains in filter:FORWARD."; fi
  82 iptables -t filter -N NoCat 2>/dev/null
  83 iptables -t filter -F NoCat
  84 iptables -t filter -D FORWARD -j NoCat 2>/dev/null
  85 #Insert the NoCat chain, and the traffic counter chains
  86 if [ $LAN2WAN_RULE_NR -gt 0 ]; then
  87    #Replace lan2wan with jump to NoCat, will later filter ACCEPTED peers via a chain to lan2wan from the NoCat chain
  88    if [ $Verbosity -gt 4 ]; then logger "Ewrt: Inserting jump to NoCat chain, while chaining filters (lan2wan) to NoCat ACCEPTS"; fi
  89    # Get rule num again; deleting the NoCat rule in the FORWARD chain before may have changed the rule
  90    LAN2WAN_RULE_NR=`rule_num filter FORWARD 'lan2wan'`
  91    iptables -t filter -D FORWARD $LAN2WAN_RULE_NR
  92    iptables -t filter -I FORWARD $LAN2WAN_RULE_NR -j NoCat
  93
  94 else
  95    if [ $Verbosity -gt 4 ]; then logger "Inserting jump to NoCat chain at top of FORWARD chain"; fi
  96    iptables -t filter -I FORWARD -j NoCat
  97 fi
  98 #Add traffic counting chains to top of NoCat chain
  99 if [ $Verbosity -gt 4 ]; then logger "Inserting traffic counters (NoCat_Upload/Download) at top of NoCat chain."; fi
 100 iptables -t filter -N NoCat_Download 2>/dev/null
 101 iptables -t filter -F NoCat_Download
 102 iptables -t filter -D NoCat -j NoCat_Download 2>/dev/null
 103 iptables -t filter -I NoCat -j NoCat_Download
 104 iptables -t filter -N NoCat_Upload 2>/dev/null
 105 iptables -t filter -F NoCat_Upload
 106 iptables -t filter -D NoCat -j NoCat_Upload 2>/dev/null
 107 iptables -t filter -I NoCat -j NoCat_Upload
 108
 109 if [ $Verbosity -gt 6 ]; then logger "Appending NoCat_Ports (ExcludePorts|IncludePorts) chain in filter:NoCat."; fi
 110 iptables -t filter -N NoCat_Ports 2>/dev/null
 111 iptables -t filter -F NoCat_Ports
 112 iptables -t filter -D NoCat -j NoCat_Ports 2>/dev/null
 113 iptables -t filter -A NoCat -j NoCat_Ports
 114
 115 if [ $Verbosity -gt 6 ]; then logger "Appending NoCat_Inbound (ACCEPTS) chain in filter:NoCat."; fi
 116 iptables -t filter -N NoCat_Inbound 2>/dev/null
 117 iptables -t filter -F NoCat_Inbound
 118 iptables -t filter -D NoCat -j NoCat_Inbound 2>/dev/null
 119 iptables -t filter -A NoCat -j NoCat_Inbound
 120
 121 if [ $Verbosity -gt 6 ]; then logger "Appending NoCat_Capture chain to nat:PREROUTING."; fi
 122 iptables -t nat -N NoCat_Capture 2>/dev/null
 123 iptables -t nat -F NoCat_Capture
 124 iptables -t nat -D PREROUTING -j NoCat_Capture 2>/dev/null
 125 iptables -t nat -A PREROUTING -j NoCat_Capture
 126
 127
 128 #
 129 # Only nat if we're not routing
 130 #
 131 iptables -t nat -D POSTROUTING -j NoCat_NAT 2>/dev/null
 132 if [ $RouteOnly -gt 0 ]; then
 133     if [ $Verbosity -gt 5 ]; then logger "Not using NoCat_NAT chain, NAT routing is not enabled. (RouteOnly=$RouteOnly)"; fi
 134 else
 135     if [ $Verbosity -gt 5 ]; then logger "Inserting NoCat_NAT chain in nat:POSTROUTING. (RouteOnly=$RouteOnly)"; fi
 136     iptables -t nat -N NoCat_NAT 2>/dev/null
 137     iptables -t nat -F NoCat_NAT
 138     iptables -t nat -I POSTROUTING -j NoCat_NAT
 139 fi
 140
 141 if [ $Verbosity -gt 6 ]; then logger "Inserting NoCat chain to mangle:PREROUTING."; fi
 142 iptables -t mangle -N NoCat 2>/dev/null
 143 iptables -t mangle -F NoCat
 144 iptables -t mangle -D PREROUTING -j NoCat 2>/dev/null
 145 iptables -t mangle -A PREROUTING -j NoCat
 146
 147 #Need to add a config var for SipProxy, or eg, AllowProxies to make this machine-independent
 148 #sip_enable=`/usr/sbin/nvram get sip_enable`
 149 #sip_listen_port=`/usr/sbin/nvram get sip_listen_port`
 150 #sip_rtp_port_low=`/usr/sbin/nvram get sip_rtp_port_low`
 151 #sip_rtp_port_high=`/usr/sbin/nvram get sip_rtp_port_high`
 152 #sip_if_inbound=$InternalDevice
 153 #sip_if_outbound=$ExternalDevice
 154 #sip_self_ip=$GatewayAddr
 155 #if [ "$SipProxy" -gt 0 ]; then
 156 #  if [ $Verbosity -gt 4 ]; then logger "SIP Proxy enabled: redirecting outgoing SIP traffic to siproxd (myself) at $sip_self_ip:$sip_listen_port"; fi
 157 #  iptables -t nat -A PREROUTING -m udp -p udp -i $sip_if_inbound --destination-port $sip_self_ip:$sip_listen_port -j REDIRECT
 158 #  if [ $Verbosity -gt 4 ]; then logger "allow incoming SIP and RTP traffic on $sip_if_outbound, SIP port: $sip_listen_port, RTP ports $sip_rtp_port_low:$sip_rtp_port_high"; fi
 159 #  iptables -A INPUT -m udp -p udp -i $sip_if_outbound --dport $sip_listen_port -j ACCEPT
 160 #  iptables -A INPUT -m udp -p udp -i $sip_if_outbound --dport $sip_rtp_port_low:$sip_rtp_port_high -j ACCEPT
 161 #else
 162   if [ $Verbosity -gt 6 ]; then logger "SIP Proxy not enabled"; fi
 163 #fi
 164
 165 #Define commands to add stuff to the NoCat chains
 166 fwd="iptables       -t filter -A NoCat"
 167 ports="iptables     -t filter -A NoCat_Ports"
 168 nat="iptables       -t nat    -A NoCat_NAT"
 169 redirect="iptables  -t nat    -A NoCat_Capture"
 170 mangle="iptables    -t mangle -A NoCat"
 171
 172 if [ "$MembersOnly" ]; then
 173   if [ $Verbosity -gt 4 ]; then logger "Allowing Members Only (No Public Access)."; fi
 174   classes="1 2"
 175 else
 176   if [ $Verbosity -gt 4 ]; then logger "Public Access is enabled."; fi
 177   classes="1 2 3"
 178 fi
 179
 180 if [ $Verbosity -gt 5 ]; then logger "Handle tagged traffic: ExternalDevice=$ExternalDevice, InternalDevice=$InternalDevice , LocalNetwork=$LocalNetwork , classes=$classes "; fi
 181 #
 182 # Handle tagged traffic.
 183 #
 184 for iface in $InternalDevice; do
 185     for net in $LocalNetwork; do
 186         for fwmark in $classes; do
 187             # Only forward tagged traffic per class
 188             if [ $Verbosity -gt 6 ]; then logger "filter::NoCat: Allowing traffic tagged with class: $fwmark from network: $net inbound on interface: $iface."; fi
 189             if [ $LAN2WAN_RULE_NR -gt 0 ]; then
 190                 # Use lan2wan rule to chain filter rules onto the firewall access when we are running on EWRT
 191                 $fwd -i $iface -s $net -m mark --mark $fwmark -j lan2wan
 192                 # This is added in case lan2wan simply RETURNS instead of REJECT, DROP or ACCEPT, which is the case if no policy is activated
 193                 $fwd -i $iface -s $net -m mark --mark $fwmark -j $TARGET_ACCEPT
 194             else
 195                 $fwd -i $iface -s $net -m mark --mark $fwmark -j ACCEPT
 196 #               $fwd -o $iface -d $net -m mark --mark $fwmark -j ACCEPT
 197             fi
 198
 199             # Masquerade permitted connections.
 200             if [ $RouteOnly -eq 0 ]; then
 201                 if [ $Verbosity -gt 5 ]; then logger "nat::NoCat - Traffic tagged with class: $fwmark from network: $net will MASQUERADE on outbound interface: $ExternalDevice."; fi
 202                 $nat -o $ExternalDevice -s $net -m mark --mark $fwmark -j MASQUERADE
 203             fi
 204         done
 205
 206         # Allow (i.e. forward & NAT enabled) all traffic to those on the MACWhiteList, and don't capture
 207         # connections initially.  NOTE: these are completely bypassed from NoCat's
 208         # AUTH mechanism, and internal peers-database. Excellent for infrastructure
 209         # routing or serving over an otherwise captive portal.
 210         # NOTE: we may want to watch out for mac/arp-spoofing attempts
 211         if [ "$MACWhiteList" ]; then
 212             for mac in $MACWhiteList; do
 213                 if [ $Verbosity -gt 5 ]; then logger "nat::NoCat_Capture: Bypassing all traffic to/from whitelisted MAC: $mac"; fi
 214                 $redirect -s $net -m mac --mac-source $mac -j RETURN
 215                 $fwd -s $net -m mac --mac-source $mac -j ACCEPT
 216                 $fwd -d $net -m mac --mac-source $mac -j ACCEPT
 217                 $nat      -s $net -m mac --mac-source $mac -j MASQUERADE
 218             done
 219         fi
 220
 221         # Allow web traffic to the specified hosts, and don't capture
 222         # connections intended for them.
 223         #
 224         if [ $Verbosity -gt 5 ]; then logger "nat::NoCat_Capture: Allowing HTTP traffic to hosts: LocalPortal=$LocalPortal AuthServiceAddr=$AuthServiceAddr AllowedWebHosts=$AllowedWebHosts"; fi
 225         if [ "$LocalPortal" -o "$AuthServiceAddr" -o "$AllowedWebHosts" ]; then
 226             for host in $LocalPortal $AuthServiceAddr $AllowedWebHosts; do
 227                 for port in 80 443; do
 228                     $redirect -s $net -d $host -p tcp --dport $port -j RETURN
 229                     $fwd -s $net -d $host -p tcp --dport $port -j ACCEPT
 230                     $nat      -s $net -d $host -p tcp --dport $port -j MASQUERADE
 231                 done
 232             done
 233         fi
 234
 235         # Accept forward and back traffic to/from DNSAddr
 236         if [ $AnyDNS -gt 0 ]; then
 237             if [ $Verbosity -gt 4 ]; then logger "Allowing traffic to/from all DNS servers."; fi
 238             for prot in tcp udp; do
 239                 $fwd -o $iface -d $net -p $prot --sport 53 -j ACCEPT
 240                 $fwd -i $iface -s $net -p $prot --dport 53 -j ACCEPT
 241                 if [ $RouteOnly -eq 0 ]; then $nat -p $prot -s $net --dport 53 -j MASQUERADE; fi
 242             done
 243         elif [ "$DNSAddr" ]; then
 244             for dns in $DNSAddr; do
 245                 if [ $Verbosity -gt 4 ]; then logger "Allowing traffic to/from DNS server: $dns."; fi
 246                 for prot in tcp udp; do
 247                     $fwd -o $iface -s $dns -d $net -p $prot --sport 53 -j ACCEPT
 248                     $fwd -i $iface -s $net -d $dns -p $prot --dport 53 -j ACCEPT
 249                     $nat -p $prot -s $net -d $dns --dport 53 -j MASQUERADE
 250
 251                     # Force unauthenticated DNS traffic through our DNS server.
 252                     # Of course, only the first rule of this type will match.
 253                     # But it's easier to leave them all in ATM.
 254                     $redirect -i $InternalDevice -m mark --mark 4 -p $prot \
 255                         --dport 53 -j DNAT --to-destination $dns:53
 256                 done
 257             done
 258         fi
 259     done
 260
 261     # Set packets from internal devices to fw mark 4, or 'denied', by default.
 262     if [ $Verbosity -gt 4 ]; then logger "mangle::NoCat: Deny packets from interface: $iface by default (i.e. give them class: 4)"; fi
 263     $mangle -i $iface -j MARK --set-mark 4
 264 done
 265
 266 # Redirect outbound non-auth web traffic to the local gateway process
 267 #
 268 # If MembersOnly is active, then redirect public class as well
 269 #
 270 if [ "$MembersOnly" ]; then
 271     nonauth="3 4"
 272 else
 273     nonauth="4"
 274 fi
 275 #for port in 80 443; do
 276 for port in 80; do
 277     if [ $Verbosity -gt 4 ]; then logger "nat::Nocat_Capture: REDIRECTING outbound, unauthenticated, traffic on port: $port to the local gateway"; fi
 278     for mark in $nonauth; do
 279         $redirect -m mark --mark $mark -p tcp --dport $port  -j DNAT \
 280             --to-destination $GatewayAddr:$GatewayPort
 281     done
 282 done
 283
 284 # Lock down more ports for public users, if specified. Port restrictions
 285 # are not applied to co-op and owner class users.
 286 #
 287 # There are two philosophies in restricting access:  That Which Is Not
 288 # Specifically Permitted Is Denied, and That Which Is Not Specifically
 289 # Denied Is Permitted.
 290 #
 291 # If "IncludePorts" is defined, the default policy will be to deny all
 292 # traffic, and only allow the ports mentioned.
 293 #
 294 # If "ExcludePorts" is defined, the default policy will be to allow all
 295 # traffic, except to the ports mentioned.
 296 #
 297 # If both are defined, ExcludePorts will be ignored, and the default policy
 298 # will be to deny all traffic, allowing everything in IncludePorts, and
 299 # issue a warning.
 300 #
 301 if [ $Verbosity -gt 4 ]; then logger "Lock down more ports for public users IncludePorts=$IncludePorts , ExcludePorts=$ExcludePorts"; fi
 302 if [ "$IncludePorts" ]; then
 303   if [ "$ExcludePorts" ]; then
 304     if [ $Verbosity -gt 4 ]; then
 305         logger "Warning: ExcludePorts and IncludePorts are both defined."
 306         logger "Ignoring 'ExcludePorts'.  Please check your nocat.conf."
 307     fi
 308   fi
 309
 310   # Enable all ports in IncludePorts
 311   for iface in $InternalDevice; do
 312     for port in $IncludePorts; do
 313       $ports -p tcp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
 314       $ports -p udp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
 315     done
 316
 317     # Always permit access to the GatewayPort (or we can't logout)
 318     $ports -p tcp -i $iface --dport $GatewayPort -j ACCEPT
 319     $ports -p udp -i $iface --dport $GatewayPort -j ACCEPT
 320
 321     # ...and disable access to the rest.
 322     $ports -p tcp -i $iface -m mark --mark 3 -j DROP
 323     $ports -p udp -i $iface -m mark --mark 3 -j DROP
 324   done
 325
 326 elif [ "$ExcludePorts" ]; then
 327   # If ExcludePorts has entries, simply deny access to them.
 328   for iface in $InternalDevice; do
 329     for port in $ExcludePorts; do
 330         $ports -p tcp -i $iface --dport $port -m mark --mark 3 -j DROP
 331         $ports -p udp -i $iface --dport $port -m mark --mark 3 -j DROP
 332     done
 333   done
 334 fi
 335
 336 #
 337 # Disable access on the external to GatewayPort from anything but the AuthServiceAddr
 338 #
 339 if [ $LAN2WAN_RULE_NR -gt 0 ]; then
 340     if [ $Verbosity -gt 4 ]; then logger "Ewrt: Removing default ACCEPT of locally FORWARDED, NEW outgoing connections"; fi
 341     ACCEPT_NEW_RULE_NR=`rule_num filter FORWARD NEW`
 342     if [ $ACCEPT_NEW_RULE_NR -gt 0 ]; then
 343         iptables -t filter -D FORWARD $ACCEPT_NEW_RULE_NR
 344         #just to be sure - HUH?? -TJ
 345         #iptables -t filter -I FORWARD $ACCEPT_NEW_RULE_NR -j DROP
 346     fi
 347 else
 348     # Filter policy.
 349     if [ $Verbosity -gt 4 ]; then logger "Set filter::FORWARD to DROP anything else"; fi
 350     $fwd -i $iface -j DROP
 351     $fwd -o $iface -j DROP
 352 fi
 353
 354 if [ "$AuthServiceAddr" ]; then
 355     if [ $Verbosity -gt 4 ]; then logger "Disable external access to port: $GatewayPort from all but: AuthServiceAddr=$AuthServiceAddr"; fi
 356     for addr in $AuthServiceAddr; do
 357         iptables -D INPUT -i $ExternalDevice -s ! $addr -p tcp --dport $GatewayPort -j DROP
 358         iptables -I INPUT -i $ExternalDevice -s ! $addr -p tcp --dport $GatewayPort -j DROP
 359     done
 360 fi
 361 #
 362 # Call the bandwidth throttle rules.
 363 #
 364 # Note: This feature is *highly* experimental.
 365 #
 366 # This functionality requires the 'tc' advanced router tool,
 367 # part of the iproute2 package, available at:
 368 # ftp://ftp.inr.ac.ru/ip-routing/
 369 #
 370 # To use bandwidth throttling, edit the upload and download
 371 # bandwidth thresholds at the top of the throttle.fw file,
 372 # and make throttle.fw executable.  Try something like this:
 373 #
 374 # chmod +x throttle.fw
 375 #
 376 #logger "Calling the bandwidth throttle rules..."
 377 #[ -x throttle.fw ] && throttle.fw
 378
 379 ##
 380 # Add any other local firewall rules below.
 381 ##
 382 iptables -A NoCat -j lan2wan
 383
 384 #
 385 # Ende
 386 #