2015-09-13 20:13:05 +02:00
|
|
|
# Configuration for minifirewall : https://forge.evolix.org/projects/minifirewall
|
|
|
|
# For fun, we keep last change from first CVS repository:
|
2009-08-10 19:02:09 +02:00
|
|
|
# version 0.1 - 12 juillet 2007 $Id: firewall.rc,v 1.2 2007/07/12 19:08:59 reg Exp $
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Main interface
|
2009-08-10 19:02:09 +02:00
|
|
|
INT='eth0'
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# IPv6
|
2011-11-11 15:47:37 +01:00
|
|
|
IPV6=on
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Trusted IPv4 local network
|
|
|
|
# ...will be often IP/32 if you don't trust anything
|
2009-08-12 13:21:53 +02:00
|
|
|
INTLAN='192.168.0.2/32'
|
2009-08-10 19:02:09 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Trusted IPv4 addresses for private and semi-public services
|
2015-12-07 17:19:35 +01:00
|
|
|
TRUSTEDIPS='62.212.121.90 88.179.18.233 31.170.8.4 31.170.9.129'
|
2009-08-10 19:02:09 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Privilegied IPv4 addresses for semi-public services
|
|
|
|
# (no need to add again TRUSTEDIPS)
|
2009-08-10 19:02:09 +02:00
|
|
|
PRIVILEGIEDIPS=''
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
|
|
|
|
# Local services IPv4/IPv6 restrictions
|
|
|
|
#######################################
|
|
|
|
|
|
|
|
# Protected services
|
|
|
|
# (add also in Public services if needed)
|
|
|
|
SERVICESTCP1p='22'
|
2009-08-12 13:21:53 +02:00
|
|
|
SERVICESUDP1p=''
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Public services (IPv4/IPv6)
|
|
|
|
SERVICESTCP1='25 53 443 993 995 2222'
|
2009-08-10 19:02:09 +02:00
|
|
|
SERVICESUDP1='53'
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Semi-public services (IPv4)
|
|
|
|
SERVICESTCP2='20 21 22 80 110 143'
|
2009-08-10 19:02:09 +02:00
|
|
|
SERVICESUDP2=''
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Private services (IPv4)
|
2009-08-12 13:21:53 +02:00
|
|
|
SERVICESTCP3='5666'
|
2009-08-10 19:02:09 +02:00
|
|
|
SERVICESUDP3=''
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Standard output IPv4 access restrictions
|
|
|
|
##########################################
|
2009-08-10 19:02:09 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# DNS authorizations
|
|
|
|
# (if you have local DNS server, set 0.0.0.0/0)
|
2011-04-19 15:51:15 +02:00
|
|
|
DNSSERVEURS='0.0.0.0/0'
|
2009-08-10 19:02:09 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# HTTP authorizations
|
|
|
|
# (you can use DNS names but set cron to reload minifirewall regularly)
|
|
|
|
# (if you have HTTP proxy, set 0.0.0.0/0)
|
2017-05-16 09:58:16 +02:00
|
|
|
HTTPSITES='security.debian.org pub.evolix.net volatile.debian.org mirror.evolix.org backports.debian.org hwraid.le-vert.net antispam00.evolix.org spamassassin.apache.org sa-update.space-pro.be sa-update.secnap.net www.sa-update.pccc.com sa-update.dnswl.org ocsp.int-x3.letsencrypt.org'
|
2009-08-10 19:02:09 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# HTTPS authorizations
|
2011-04-02 11:48:19 +02:00
|
|
|
HTTPSSITES='0.0.0.0/0'
|
2009-08-10 19:02:09 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# FTP authorizations
|
2009-08-10 19:02:09 +02:00
|
|
|
FTPSITES=''
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# SSH authorizations
|
2009-08-10 19:02:09 +02:00
|
|
|
SSHOK='0.0.0.0/0'
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# SMTP authorizations
|
2009-08-10 19:02:09 +02:00
|
|
|
SMTPOK='0.0.0.0/0'
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# SMTP secure authorizations (ports TCP/465 and TCP/587)
|
2011-06-03 11:53:51 +02:00
|
|
|
SMTPSECUREOK=''
|
2011-03-25 19:02:45 +01:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# NTP authorizations
|
2011-07-14 15:23:04 +02:00
|
|
|
NTPOK='0.0.0.0/0'
|
2009-08-10 19:02:09 +02:00
|
|
|
|
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# IPv6 Specific rules
|
|
|
|
#####################
|
|
|
|
|
|
|
|
# Example: allow input HTTP/HTTPS/SMTP/DNS traffic
|
2012-08-22 16:21:28 +02:00
|
|
|
/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 80 --match state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 443 --match state --state ESTABLISHED,RELATED -j ACCEPT
|
2012-11-14 00:55:35 +01:00
|
|
|
/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 25 --match state --state ESTABLISHED,RELATED -j ACCEPT
|
2015-03-13 01:55:13 +01:00
|
|
|
/sbin/ip6tables -A INPUT -i $INT -p udp --sport 53 --match state --state ESTABLISHED,RELATED -j ACCEPT
|
2014-07-25 14:21:42 +02:00
|
|
|
/sbin/ip6tables -A INPUT -i $INT -p tcp --sport 53 --match state --state ESTABLISHED,RELATED -j ACCEPT
|
2011-10-21 02:10:24 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Example: allow output DNS, NTP and traceroute traffic
|
2012-11-14 00:55:35 +01:00
|
|
|
/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 53 --match state --state NEW -j ACCEPT
|
|
|
|
/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 123 --match state --state NEW -j ACCEPT
|
2014-09-11 23:33:33 +02:00
|
|
|
#/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 33434:33523 --match state --state NEW -j ACCEPT
|
2011-10-21 02:10:24 +02:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# Example: allow DHCPv6
|
2015-01-12 20:54:17 +01:00
|
|
|
/sbin/ip6tables -A INPUT -i $INT -p udp --dport 546 -d fe80::/64 -j ACCEPT
|
|
|
|
/sbin/ip6tables -A OUTPUT -o $INT -p udp --dport 547 -j ACCEPT
|
2013-12-13 11:22:27 +01:00
|
|
|
|
2015-09-13 20:13:05 +02:00
|
|
|
# IPv4 Specific rules
|
|
|
|
#####################
|
|
|
|
|
2012-11-09 10:05:34 +01:00
|
|
|
# /sbin/iptables ...
|