path: root/examples/var_service/fw/run (plain)
blob: 1fd71cc010eeb5f68493789a6a16468b45d25cd7

1	#!/bin/bash
2	# (using bashism: arrays)
3
4	user="root"
5	reset_all_netdevs=true
6	preferred_default_route_iface="if"
7	extif="if"
8	ext_open_tcp="22 80 88" # space-separated
9
10	# Make ourself one-shot
11	sv o .
12	# Debug
13	#date '+%Y-%m-%d %H:%M:%S' >>"$0.log"
14
15	service=`basename $PWD`
16	rundir="/var/run/service/$service"
17
18	### filter This is the default table (if no -t option is passed). It contains
19	### the built-in chains INPUT (for packets coming into the box itself),
20	### FORWARD (for packets being routed through the box), and OUTPUT (for
21	### locally-generated packets).
22	###
23	### nat This table is consulted when a packet that creates a new connection
24	### is encountered. It consists of three built-ins: PREROUTING (for
25	### altering packets as soon as they come in), OUTPUT (for altering
26	### locally-generated packets before routing), and POSTROUTING (for
27	### altering packets as they are about to go out).
28	###
29	### mangle It had two built-in chains: PREROUTING (for altering incoming
30	### packets before routing) and OUTPUT (for altering locally-generated
31	### packets before routing). Recently three other built-in
32	### chains are added: INPUT (for packets coming into the box
33	### itself), FORWARD (for altering packets being routed through the
34	### box), and POSTROUTING (for altering packets as they are about to go
35	### out).
36	###
37	### ...iface... ...iface...
38	### | ^
39	### v |
40	### -mangle,NAT- -mangle,filter- -mangle,NAT--
41	### |PREROUTING|-->[Routing]-->|FORWARD |-->|POSTROUTING|
42	### ------------ | ^ --------------- -------------
43	### | | ^
44	### | +--if NATed------------+ |
45	### v | |
46	### -mangle,filter- -mangle,NAT,filter-
47	### |INPUT | +->[Routing]->|OUTPUT |
48	### --------------- | -------------------
49	### | |
50	### v |
51	### ... Local Process...
52
53	doit() {
54	echo "# $*"
55	"$@"
56	}
57
58	#exec >/dev/null
59	exec >"$0.out"
60	exec 2>&1
61	exec </dev/null
62
63	umask 077
64
65	# Make sure rundir/ exists
66	mkdir -p "$rundir" 2>/dev/null
67	chown -R "$user": "$rundir"
68	chmod -R a=rX "$rundir"
69	rm -rf rundir 2>/dev/null
70	ln -s "$rundir" rundir
71
72	# Timestamping
73	date '+%Y-%m-%d %H:%M:%S'
74
75	echo; echo "* Reading IP config"
76	cfg=-1
77	# static cfg dhcp,zeroconf etc
78	for ipconf in conf/*.ipconf "$rundir"/*.ipconf; do
79	if test -f "$ipconf"; then
80	echo "+ $ipconf"
81	. "$ipconf"
82	fi
83	done
84
85	echo; echo "* Configuring hardware"
86	#doit ethtool -s if autoneg off speed 100 duplex full
87	#doit ethtool -K if rx off tx off sg off tso off
88
89	echo; echo "* Resetting address and routing info"
90	if $reset_all_netdevs; then
91	devs=`sed -n 's/ //g;s/:.*$//p' </proc/net/dev`
92	for iface in $devs; do
93	doit ip a f dev "$iface"
94	doit ip r f dev "$iface" root 0/0
95	done
96	else
97	doit ip a f dev lo
98	i=0; while test "${if[$i]}"; do
99	doit ip a f dev "${if[$i]}"
100	doit ip r f dev "${if[$i]}" root 0/0
101	let i++; done
102	fi
103
104	echo; echo "* Configuring addresses"
105	doit ip a a dev lo 127.0.0.1/8 scope host
106	doit ip a a dev lo ::1/128 scope host
107	i=0; while test "${if[$i]}"; do
108	if test "${ipmask[$i]}"; then
109	doit ip a a dev "${if[$i]}" "${ipmask[$i]}" brd +
110	doit ip l set dev "${if[$i]}" up
111	fi
112	let i++; done
113
114	echo; echo "* Configuring routes"
115	# If several ifaces are configured via DHCP, they often both have 0/0 route.
116	# They have no way of knowing that this route is offered on more than one iface.
117	# Often, it's desirable to prefer one iface: say, wired eth over wireless.
118	# if preferred_default_route_iface is not set, 0/0 route will be assigned randomly.
119	if test "$preferred_default_route_iface"; then
120	i=0; while test "${if[$i]}"; do
121	if test "${if[$i]}" = "$preferred_default_route_iface" \
122	&& test "${net[$i]}" = "0/0" \
123	&& test "${gw[$i]}"; then
124	echo "+ default route through ${if[$i]}, ${gw[$i]}:"
125	doit ip r a "${net[$i]}" via "${gw[$i]}"
126	fi
127	let i++; done
128	fi
129	i=0; while test "${if[$i]}"; do
130	#echo $i:"${if[$i]}"
131	if test "${net[$i]}" && test "${gw[$i]}"; then
132	doit ip r a "${net[$i]}" via "${gw[$i]}"
133	fi
134	let i++; done
135
136	echo; echo "* Recreating /etc/* files reflecting new network configuration:"
137	for i in etc/*; do
138	n=`basename "$i"`
139	echo "+ $n"
140	(. "$i") >"/etc/$n"
141	chmod 644 "/etc/$n"
142	done
143
144
145	# Usage: new_chain <chain> [<table>]
146	new_chain() {
147	local t=""
148	test x"$2" != x"" && t="-t $2"
149	doit iptables $t -N $1
150	ipt="iptables $t -A $1"
151	}
152
153	echo; echo "* Reset iptables"
154	doit iptables --flush
155	doit iptables --delete-chain
156	doit iptables --zero
157	doit iptables -t nat --flush
158	doit iptables -t nat --delete-chain
159	doit iptables -t nat --zero
160	doit iptables -t mangle --flush
161	doit iptables -t mangle --delete-chain
162	doit iptables -t mangle --zero
163
164	echo; echo "* Configure iptables"
165	doit modprobe nf_nat_ftp
166	doit modprobe nf_nat_tftp
167	doit modprobe nf_conntrack_ftp
168	doit modprobe nf_conntrack_tftp
169
170	# *** nat ***
171	# INCOMING TRAFFIC
172	ipt="iptables -t nat -A PREROUTING"
173	# nothing here
174
175	# LOCALLY ORIGINATED TRAFFIC
176	ipt="iptables -t nat -A OUTPUT"
177	# nothing here
178
179	# OUTGOING TRAFFIC
180	ipt="iptables -t nat -A POSTROUTING"
181	# Masquerade boxes on my private net
182	doit $ipt -s 192.168.0.0/24 -o $extif -j MASQUERADE
183
184	# *** mangle ***
185	### DEBUG
186	### ipt="iptables -t mangle -A PREROUTING"
187	### doit $ipt -s 192.168.0.0/24 -j RETURN
188	### ipt="iptables -t mangle -A FORWARD"
189	### doit $ipt -s 192.168.0.0/24 -j RETURN
190	### ipt="iptables -t mangle -A POSTROUTING"
191	### doit $ipt -s 192.168.0.0/24 -j RETURN
192	# nothing here
193
194	# *** filter ***
195	#
196	new_chain iext filter
197	#doit $ipt -s 203.177.104.72 -j DROP # Some idiot probes my ssh
198	#doit $ipt -d 203.177.104.72 -j DROP # Some idiot probes my ssh
199	doit $ipt -m state --state ESTABLISHED,RELATED -j RETURN # FTP data etc is ok
200	if test "$ext_open_tcp"; then
201	portlist="${ext_open_tcp// /,}"
202	doit $ipt -p tcp -m multiport --dports $portlist -j RETURN
203	fi
204	doit $ipt -p tcp -j REJECT # Anything else isn't ok. REJECT = irc opens faster
205	# (it probes proxy ports, DROP will incur timeout delays)
206	ipt="iptables -t filter -A INPUT"
207	doit $ipt -i $extif -j iext
208
209
210	echo; echo "* Enabling forwarding"
211	echo 1 >/proc/sys/net/ipv4/ip_forward
212	echo "/proc/sys/net/ipv4/ip_forward: `cat /proc/sys/net/ipv4/ip_forward`"
213
214
215	# Signal everybody that firewall is up
216	date '+%Y-%m-%d %H:%M:%S' >"$rundir/up"
217
218	# Ok, spew out gobs of info and disable ourself
219	echo; echo "* IP:"
220	ip a l
221	echo; echo "* Routing:"
222	ip r l
223	echo; echo "* Firewall:"
224	{
225	echo '---FILTER--';
226	iptables -v -L -x -n;
227	echo '---NAT-----';
228	iptables -t nat -v -L -x -n;
229	echo '---MANGLE--';
230	iptables -t mangle -v -L -x -n;
231	} \
232	| grep -v '^$' | grep -Fv 'bytes target'
233	echo
234
235	echo "* End of firewall configuration"
236