From: Mark Wooding Date: Thu, 26 Mar 2015 16:33:26 +0000 (+0000) Subject: local.mk: We're only dealing with ourselves. X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/firewall/commitdiff_plain/b1a5b8b48fa727d122017cfc3a4b0a75e082ee62?hp=-c local.mk: We're only dealing with ourselves. We can delete all of the other hosts, and remove all of the internal details of the distorted.org.uk network. --- b1a5b8b48fa727d122017cfc3a4b0a75e082ee62 diff --git a/artist.m4 b/artist.m4 deleted file mode 100644 index 8b066a7..0000000 --- a/artist.m4 +++ /dev/null @@ -1,53 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for artist -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### artist-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - ftp ftp_data \ - http https \ - disorder \ - tor_public tor_directory i2p -allowservices inbound udp \ - i2p - -## Allow smb and nmb to untrusted hosts. -run iptables -A inbound -j ACCEPT \ - -s 172.29.198.0/24 \ - -p udp -m multiport --destination-ports \ - $port_netbios_ns,$port_netbios_dgm -run iptables -A inbound -j ACCEPT \ - -s 172.29.198.0/24 \ - -p tcp -m multiport --destination-ports \ - $port_netbios_ssn,$port_microsoft_ds - -## Other interesting things. -dnsresolver inbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/fender.m4 b/fender.m4 deleted file mode 100644 index dda96f8..0000000 --- a/fender.m4 +++ /dev/null @@ -1,66 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for fender actual -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### fender-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident - -## We have to provide NTP service. The guests sync to our clock. -ntpclient inbound $ntp_servers - -## Guaranteed black hole. Put this at the very front of the chain. -run iptables -I INPUT -d 212.13.198.78 -j DROP -run ip6tables -I INPUT -d 2001:ba8:0:1d9::ffff -j DROP - -## Ethernet bridge-level filtering for source addresses. -run ebtables -F -for c in bad-source-addr check-eth0; do - run ebtables -X $c >/dev/null 2>&1 || : -done -for i in log limit ip ip6; do run modprobe ebt-$i; done -run ebtables -N bad-source-addr -run ebtables -A bad-source-addr \ - --limit 20/second --limit-burst 100 \ - --log-prefix "fw: bad-source-addr(br) " --log-ip --log-ip6 -run ebtables -A bad-source-addr -j DROP -run ebtables -N check-eth0 -run ebtables -A check-eth0 -j RETURN -p ip --ip-source ! 212.13.198.64/28 -run ebtables -A check-eth0 -j RETURN -p ip6 --ip6-source 2001:ba8:0:1d9::1 -run ebtables -A check-eth0 -j bad-source-addr \ - -p ip6 --ip6-source 2001:ba8:1d9::/48 -run ebtables -A check-eth0 -j bad-source-addr \ - -p ip6 --ip6-source 2001:ba8:0:1d9::/64 -run ebtables -A check-eth0 -j RETURN -p ip6 -run ebtables -A check-eth0 -j RETURN -p ip --ip-source 212.13.198.64/30 -run ebtables -A check-eth0 -j RETURN -p ip --ip-source 212.13.198.68 -run ebtables -A check-eth0 -j bad-source-addr -p ip -run ebtables -A INPUT -j check-eth0 -i bond0 -run ebtables -A FORWARD -j check-eth0 -i bond0 - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/gibson.m4 b/gibson.m4 deleted file mode 100644 index 75b4607..0000000 --- a/gibson.m4 +++ /dev/null @@ -1,42 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for gibson -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### gibson-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - h323 -allowservices inbound udp \ - siplo:siphi - -## IMPI client hacking. -run ip46tables -A inbound -j ACCEPT \ - -m state --state ESTABLISHED \ - -p udp --source-port $port_ipmi - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/ibanez.m4 b/ibanez.m4 deleted file mode 100644 index 4d6d24e..0000000 --- a/ibanez.m4 +++ /dev/null @@ -1,47 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for ibanez -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### ibanez-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident -allowservices inbound udp \ - udpkey - -## We have to provide NTP service. The guests sync to our clock. -ntpclient inbound $ntp_servers - -## Provide NTP service to untrusted clients. -iptables -A inbound -p udp -j ACCEPT \ - --source-port 123 --destination-port 123 \ - -s 172.29.198.0/23 -ip6tables -A inbound -p udp -j ACCEPT \ - --source-port 123 --destination-port 123 \ - -s 2001:470:9740::/48 - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/jazz.m4 b/jazz.m4 deleted file mode 100644 index f77a251..0000000 --- a/jazz.m4 +++ /dev/null @@ -1,58 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for jazz -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### jazz-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - http https \ - tor_public tor_directory i2p -allowservices inbound udp \ - tripe \ - i2p - -## Other interesting things. -dnsresolver inbound -dnsserver inbound - -## Temporary NAT for iodine tunnel. -for i in PREROUTING OUTPUT POSTROUTING; do - run iptables -t nat -P $i ACCEPT 2>/dev/null || : - run iptables -t nat -F $i 2>/dev/null || : -done -run iptables -t nat -F -run iptables -t nat -X - -iptables -t nat -N outbound -run iptables -t nat -A outbound -j RETURN ! -i dns+ -run iptables -t nat -A outbound -j RETURN ! -s 172.29.198.128/28 -run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23 -run iptables -t nat -A outbound -j SNAT --to-source 212.13.198.77 -iptables -t nat -A POSTROUTING -j outbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/jem.m4 b/jem.m4 deleted file mode 100644 index 9ab3dad..0000000 --- a/jem.m4 +++ /dev/null @@ -1,55 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for jem -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### jem-specific rules. - -m4_divert(86)m4_dnl -## Set up the SAUCE sinbin. Unfortunately, ipset is a bit brittle. This -## isn't a completely critical part of the firewall security, so don't make -## this fail the entire script. -errorchain sauce REJECT -makeset sauce iphash || : -iptables -A inbound -g sauce -m set --match-set sauce src || : - -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - smtp submission \ - imaps \ - http https \ - git - -## Provide DNS resolution to local untrusted hosts. -for p in tcp udp; do - run iptables -A inbound -j ACCEPT \ - -s 172.29.198.0/24 \ - -p $p --destination-port $port_dns -done - -## Other interesting things. -dnsresolver inbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/local.m4 b/local.m4 index a50afd7..0618693 100644 --- a/local.m4 +++ b/local.m4 @@ -33,89 +33,9 @@ m4_divert(-1) ###-------------------------------------------------------------------------- ### Packet classification. -## IPv4 addressing. -## -## There are two small blocks of publicly routable IPv4 addresses, and a -## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN. -## The former are as follows. -## -## 62.49.204.144/28 -## House border network (dmz). We have all of these, but .145 -## is reserved for the router. -## -## 212.13.18.64/28 -## Jump colocated network (jump). .65--68 are used by Jump -## network infrastructure; we get the rest. -## -## The latter is the block 172.29.196.0/22. Currently the low half is -## unallocated (and may be returned to the G-RIN); the remaining addresses -## are allocated as follows. -## -## 172.29.198.0/24 Untrusted networks. -## .0/25 house wireless net -## .128/28 iodine (IP-over-DNS) network -## -## 172.29.199.0/24 Trusted networks. -## .0/25 house wired network -## .128/27 mobile VPN hosts -## .160/28 reserved, except .160/30 allocated for ITS -## .176/28 internal colocated network -## .192/27 house safe network -## .224/27 anycast services - -## IPv6 addressing. -## -## There are five blocks of publicly routable IPv6 addresses, though some of -## them aren't very interesting. The ranges are as follows. -## -## 2001:470:1f08:1b98::/64 -## Hurricane Electric tunnel network: only :1 (HE) and :2 -## (radius) are used. -## -## 2001:470:1f09:1b98::/64 -## House border network (dmz). -## -## 2001:470:9740::/48 -## Main house range. See below for allocation policy. -## -## 2001:ba8:0:1d9::/64 -## Jump border network (jump): :1 is the router (supplied by -## Jump); other addresses are ours. -## -## 2001:ba8:1d9::/48 -## Main colocated range. See below for allocation policy. -## -## Addresses in the /64 networks are simply allocated in ascending order. -## The /48s are split into /64s by appending a 16-bit network number. The -## top nibble of the network number classifies the network, as follows. -## -## 8xxx Untrusted -## 6xxx Virtual -## 4xxx Safe -## 0xxx Unsafe, trusted -## -## These have been chosen so that network properties can be deduced by -## inspecting bits of the network number: -## -## Bit 15 If set, the network is untrusted; otherwise it is trusted. -## Bit 14 If set, the network is safe; otherwise it is unsafe. -## -## Finally, the low-order nibbles identify the site. -## -## 0 No specific site: mobile VPN endpoints or anycast addresses. -## 1 House. -## 2 Jump colocation. -## -## Usually site-0 networks are allocated from the Jump range to improve -## expected performance from/to external sites which don't engage in our -## dynamic routing protocols. - ## Define the available network classes. m4_divert(42)m4_dnl -defnetclass untrusted untrusted trusted mcast -defnetclass trusted untrusted trusted safe noloop mcast -defnetclass safe trusted safe noloop mcast -defnetclass noloop trusted safe mcast +defnetclass untrusted untrusted mcast defnetclass link defnetclass mcast @@ -125,145 +45,12 @@ m4_divert(26)m4_dnl ###-------------------------------------------------------------------------- ### Network layout. -## House networks. -defnet dmz trusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - via unsafe untrusted -defnet unsafe trusted - addr 172.29.199.0/25 2001:470:9740:1::/64 - via househub -defnet safe safe - addr 172.29.199.192/27 2001:470:9740:4001::/64 - via househub -defnet untrusted untrusted - addr 172.29.198.0/25 2001:470:9740:8001::/64 - via househub - -defnet househub virtual - via housebdry dmz unsafe safe untrusted -defnet housebdry virtual - via househub hub - noxit dmz - -## House hosts. -defhost radius - hosttype router - iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth2 dmz unsafe safe untrusted vpn sgo colobdry - iface eth3 unsafe untrusted vpn default - iface ppp0 default - iface t6-he default - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost roadstar - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost jem - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost artist - hosttype router - iface eth0 dmz unsafe untrusted - iface eth1 dmz unsafe untrusted - iface eth3 unsafe untrusted -defhost vampire - hosttype router - iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry - iface eth0.7 unsafe untrusted vpn - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost ibanez - iface br-dmz dmz unsafe - iface br-unsafe unsafe -defhost orange - iface wlan0 untrusted - iface vpn-radius unsafe - -defhost gibson - hosttype client - iface eth0 unsafe - -## Colocated networks. -defnet jump trusted - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - via colohub -defnet colo trusted - addr 172.29.199.176/28 2001:ba8:1d9:2::/64 - via colohub -defnet colohub virtual - via colobdry jump colo -defnet colobdry virtual - via colohub hub - noxit jump -defnet iodine untrusted - addr 172.29.198.128/28 - via colohub +defnet default untrusted ## Colocated hosts. -defhost fender - iface br-jump jump colo - iface br-colo jump colo -defhost precision - hosttype router - iface eth0 jump colo vpn sgo - iface eth1 jump colo vpn sgo - iface vpn-mango binswood - iface vpn-radius housebdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost telecaster - iface eth0 jump colo - iface eth1 jump colo -defhost stratocaster - iface eth0 jump colo - iface eth1 jump colo defhost jaguar - iface eth0 jump -defhost jazz - hosttype router - iface eth0 jump colo vpn - iface eth1 jump colo vpn - iface dns0 iodine - iface vpn-+ vpn - -## Other networks. -defnet hub virtual - via housebdry colobdry -defnet sgo noloop - addr !172.29.198.0/23 - addr 10.0.0.0/8 - addr 172.16.0.0/12 - addr 192.168.0.0/16 - via househub colohub -defnet vpn safe - addr 172.29.199.128/27 2001:ba8:1d9:6000::/64 - via househub colohub - host crybaby 1 - host terror 2 - host orange 3 -defnet anycast trusted - addr 172.29.199.224/27 2001:ba8:1d9:0::/64 - via dmz unsafe safe untrusted jump colo vpn -defnet default untrusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - addr 2001:ba8:1d9::/48 #temporary - via dmz unsafe untrusted jump colo - -## Satellite networks. -defnet binswood noloop - addr 10.165.27.0/24 - via colohub - -defhost mango - hosttype router - iface eth0 binswood default - iface vpn-precision colo +defhost jaguar + iface eth0 default m4_divert(80)m4_dnl ###-------------------------------------------------------------------------- diff --git a/local.mk b/local.mk index f72be95..5361461 100644 --- a/local.mk +++ b/local.mk @@ -4,22 +4,4 @@ MAIN_M4_SOURCES += local.m4 ## The avaiable hosts. -HOSTS += vampire - -HOSTS += orange -HOSTS += mango - -HOSTS += ibanez -HOSTS += radius -HOSTS += roadstar -HOSTS += jem -HOSTS += artist - -HOSTS += fender -HOSTS += precision HOSTS += jaguar -HOSTS += telecaster -HOSTS += stratocaster -HOSTS += jazz - -HOSTS += gibson diff --git a/mango.m4 b/mango.m4 deleted file mode 100644 index 8f5874b..0000000 --- a/mango.m4 +++ /dev/null @@ -1,60 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for mango -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### mango-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh -allowservices inbound udp \ - tripe - -## Other interesting things. -dnsresolver inbound - -## Trust the surrounding environment. -run iptables -A INPUT -j ACCEPT -s 10.165.27.0/24 - -## NAT for remote administration. -for i in PREROUTING OUTPUT POSTROUTING; do - run iptables -t nat -P $i ACCEPT 2>/dev/null || : - run iptables -t nat -F $i 2>/dev/null || : -done -run iptables -t nat -F -run iptables -t nat -X - -run iptables -t nat -A POSTROUTING -j SNAT --to-source 10.165.27.3 \ - -s 172.29.198.0/23 -d 10.165.27.0/24 -o eth0 - -clearchain nat:portfwd -run iptables -t nat -A portfwd -j DNAT \ - -p tcp --dport 3128 --to-destination 172.29.199.228 -for c in OUTPUT PREROUTING; do - run iptables -t nat -A $c -j portfwd \ - -s 10.165.27.0/24 -d 10.165.27.3 -done - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/orange.m4 b/orange.m4 deleted file mode 100644 index 719dff0..0000000 --- a/orange.m4 +++ /dev/null @@ -1,41 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for orange -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### orange-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - http https \ - disorder -allowservices inbound udp \ - tripe - -## Other interesting things. -dnsresolver inbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/precision.m4 b/precision.m4 deleted file mode 100644 index 598a990..0000000 --- a/precision.m4 +++ /dev/null @@ -1,40 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for precision -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### precision-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ident \ - ssh -allowservices inbound udp \ - tripe - -## Other interesting things. -dnsresolver inbound -dnsserver inbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/radius.m4 b/radius.m4 deleted file mode 100644 index b8481bb..0000000 --- a/radius.m4 +++ /dev/null @@ -1,98 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for radius -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### radius-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ident \ - ssh -allowservices inbound udp \ - tripe - -## Provide syslog for evolution. -run iptables -A inbound -j ACCEPT \ - -s 172.29.198.2 \ - -p udp --destination-port $port_syslog - -## Other interesting things. -dnsresolver inbound -dnsserver inbound - -## IPv6 6-in-4 tunnel. -run iptables -A inbound -j ACCEPT \ - -p $proto_ipv6 -s 216.66.80.26 - -## Permitted special forwarding. -makeset fwd-allow-http nethash || : -iptables -A fwd-spec-nofrag -j ACCEPT \ - -m set --match-set fwd-allow-http dst \ - -p tcp --destination-port $port_http \ - -m mark --mark $to_untrusted/$MASK_TO -iptables -A fwd-spec-nofrag -j ACCEPT \ - -m set --match-set fwd-allow-http src \ - -p tcp --destination-port $port_http \ - -m mark --mark $from_untrusted/$MASK_FROM \ - -m state --state ESTABLISHED - -## NAT for RFC1918 addresses. -for i in PREROUTING OUTPUT POSTROUTING; do - run iptables -t nat -P $i ACCEPT 2>/dev/null || : - run iptables -t nat -F $i 2>/dev/null || : -done -run iptables -t nat -F -run iptables -t nat -X - -run iptables -t nat -N outbound -run iptables -t nat -A outbound -j RETURN ! -o ppp0 -run iptables -t nat -A outbound -j RETURN ! -s 172.29.198.0/23 -run iptables -t nat -A outbound -j RETURN -d 62.49.204.144/28 -run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23 -run iptables -t nat -A outbound -j SNAT --to-source 62.49.204.158 -run iptables -t nat -A POSTROUTING -j outbound - -## TCP MSS clamping to help given Demon's sluggish approach to fragmentation- -## needed errors. -run ip46tables -t mangle -A FORWARD -o ppp0 -p tcp --tcp-flags SYN,RST SYN \ - -j TCPMSS --clamp-mss-to-pmtu - -## Set up NAT protocol helpers. In particular, SIP needs some special -## twiddling. -run modprobe nf_conntrack_sip \ - ports=5060 \ - sip_direct_signalling=0 \ - sip_direct_media=0 -for p in ftp sip h323; do - run modprobe nf_nat_$p -done - -## Forbid anything complicated to the NAT address. Be sure to allow ident, -## though. -run iptables -A INPUT -d 62.49.204.158 -p tcp -j ACCEPT \ - -m multiport --destination-ports=113 -run iptables -A INPUT -d 62.49.204.158 ! -p icmp -j REJECT - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/roadstar.m4 b/roadstar.m4 deleted file mode 100644 index e35a4f1..0000000 --- a/roadstar.m4 +++ /dev/null @@ -1,47 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for roadstar -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### roadstar-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - ftp ftp_data \ - rsync \ - http https squid - -## Provide DNS resolution to local untrusted hosts. -for p in tcp udp; do - run iptables -A inbound -j ACCEPT \ - -s 172.29.198.0/24 \ - -p $p --destination-port $port_dns -done - -## Other interesting things. -dnsresolver inbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/stratocaster.m4 b/stratocaster.m4 deleted file mode 100644 index a063fc2..0000000 --- a/stratocaster.m4 +++ /dev/null @@ -1,49 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for stratocaster -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### stratocaster-specific rules. - -m4_divert(86)m4_dnl -## Set up the SAUCE sinbin. Unfortunately, ipset is a bit brittle. This -## isn't a completely critical part of the firewall security, so don't make -## this fail the entire script. -errorchain sauce REJECT -makeset sauce iphash || : -iptables -A inbound -g sauce -m set --match-set sauce src || : - -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - smtp submission \ - imaps \ - http https \ - rsync \ - git - -## Other interesting things. -dnsresolver inbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/telecaster.m4 b/telecaster.m4 deleted file mode 100644 index dd278b8..0000000 --- a/telecaster.m4 +++ /dev/null @@ -1,44 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for telecaster -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### telecaster-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - ssh \ - ident \ - ftp ftp_data \ - rsync \ - http https squid - -run iptables -A inbound -j ACCEPT \ - -p udp --destination-port $port_icp \ - -m limit --limit 10/second --limit-burst 100 - -## Other interesting things. -dnsresolver inbound - -m4_divert(-1) -###----- That's all, folks -------------------------------------------------- diff --git a/vampire.m4 b/vampire.m4 deleted file mode 100644 index e016358..0000000 --- a/vampire.m4 +++ /dev/null @@ -1,82 +0,0 @@ -### -*-sh-*- -### -### Firewall configuration for vampire -### -### (c) 2008 Mark Wooding -### - -###----- Licensing notice --------------------------------------------------- -### -### This program is free software; you can redistribute it and/or modify -### it under the terms of the GNU General Public License as published by -### the Free Software Foundation; either version 2 of the License, or -### (at your option) any later version. -### -### This program is distributed in the hope that it will be useful, -### but WITHOUT ANY WARRANTY; without even the implied warranty of -### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -### GNU General Public License for more details. -### -### You should have received a copy of the GNU General Public License -### along with this program; if not, write to the Free Software Foundation, -### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - -###-------------------------------------------------------------------------- -### vampire-specific rules. - -m4_divert(86)m4_dnl -## Externally visible services. -allowservices inbound tcp \ - finger ident \ - ssh \ - smtp submission \ - gnutella_svc \ - ftp ftp_data \ - rsync \ - imaps \ - disorder mpd \ - http https squid \ - git \ - tor_public tor_directory i2p -allowservices inbound udp \ - tripe \ - gnutella_svc \ - i2p - -## Extend some services to local untrusted hosts. -clearchain inbound-untrusted -run iptables -A inbound -j inbound-untrusted -s $net_inet_untrusted -run ip6tables -A inbound -j inbound-untrusted -s $net_inet6_untrusted - -allowservices inbound-untrusted tcp \ - dns \ - lpd \ - netbios_ssn microsoft_ds -allowservices inbound-untrusted udp \ - dns \ - tftp - -## Provide syslog for evolution. -run iptables -A inbound -j ACCEPT \ - -s 172.29.198.2 \ - -p udp --destination-port $port_syslog - -## Watch outgoing Tor usage. -run iptables -A OUTPUT -m multiport \ - -p tcp --source-ports $port_tor_public,$port_tor_directory - -## Other interesting things. -dnsresolver inbound -dnsserver inbound -ntpclient inbound $ntp_servers - -## Provide NTP service to untrusted clients. -iptables -A inbound -p udp -j ACCEPT \ - --source-port 123 --destination-port 123 \ - -s 172.29.198.0/23 -ip6tables -A inbound -p udp -j ACCEPT \ - --source-port 123 --destination-port 123 \ - -s 2001:470:9740::/48 - -m4_divert(-1) -###----- That's all, folks --------------------------------------------------