safebox/firewall_containers
7
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Completing firewall scripts.

Browse Source
This commit is contained in:
Gyorgy Berenyi
2022-02-11 15:28:49 +00:00
parent 20ffe596b6
commit d1eb707cec
1 changed files with 58 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
firewall/firewall-add
View File

@@ -8,7 +8,7 @@ debug() {
} }
# Task type variables # Task type variables
NSENTER=$NSENTER ROUTE=$ROUTE
PREROUTING=$PREROUTING PREROUTING=$PREROUTING
POSTROUTING=$POSTROUTING POSTROUTING=$POSTROUTING
@@ -38,31 +38,44 @@ IPTABLES=/sbin/iptables-legacy
############################### ###############################
prerouting() { prerouting() {
LINES=$($iptables --line-number -n | grep $COMMENT | grep PREROUTING |awk '{print $1}'| tac) LINES=$($IPTABLES --line-number -n | grep $COMMENT | grep PREROUTING |awk '{print $1}'| tac)
# DELETE UNECESSARY LINES FROM PREVIOUS RULES # DELETE UNECESSARY LINES FROM PREVIOUS RULES
if [ -n "$LINES" ] ; then if [ -n "$LINES" ] ; then
for i in $LINES; do for i in $LINES; do
$iptables -D $i $IPTABLES -D $i
sleep 0.1 sleep 0.1
done done
fi fi
$iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT $IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
} }
postrouting() { postrouting() {
LINES=$($iptables --line-number -n | grep $COMMENT | grep POSTROUTING | awk '{print $1}'| tac) LINES=$($IPTABLES --line-number -n | grep $COMMENT | grep POSTROUTING | awk '{print $1}'| tac)
# DELETE UNECESSARY LINES FROM PREVIOUS RULES # DELETE UNECESSARY LINES FROM PREVIOUS RULES
if [ -n "$LINES" ] ; then if [ -n "$LINES" ] ; then
for i in $LINES; do for i in $LINES; do
$iptables -D $i $IPTABLES -D $i
sleep 0.1 sleep 0.1
done done
fi fi
$iptables -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE $IPTABLES -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE
}
ip_route() {
COUNT_NETWORK=$(set |grep NETWORK |wc -l)
for network_index in $(seq 1 $COUNT_NETWORK) ; do
if set |grep NETWORK_ ; then
NETWORK=$(eval "echo \${"NETWORK_$network_index"}")
GATEWAY=$(eval "echo \${"GATEWAY_$network_index"}")
fi
$IP_ROUTE add $NETWORK/24 via $GATEWAY
done
} }
COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l) COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l)
@@ -92,35 +105,24 @@ for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
############################# #############################
# NSENTER Specific settings # # NSENTER Specific settings #
if [[ "$NSENTER" == "true" ]] ; then
if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] ; then if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] ; then
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat"; NS_IPTABLES="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat";
debug "iptables: "$IPTABLES; debug "iptables: "$NS_IPTABLES;
if [[ "$PREROUTING" == "true" ]] ; then if [[ "$PREROUTING" == "true" ]] ; then
prerouting; prerouting;
elif [[ "$POSTROUTING" == "true" ]] ; then elif [[ "$POSTROUTING" == "true" ]] ; then
postrouting; postrouting;
fi; fi;
else
ip_route="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";
fi
else else
if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] ; then
if [[ "$PREROUTING" == "true" ]] ; then
prerouting;
elif [[ "$POSTROUTING" == "true" ]] ; then ############################
postrouting; # Host firewall settings ###
fi;
else
if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
echo "nothing to do"; echo "nothing to do";
@@ -142,7 +144,6 @@ else
$IPTABLES -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT $IPTABLES -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT
############################# #############################
fi
fi fi
done # target_port done # target_port
@@ -151,3 +152,9 @@ fi
done # source_ip done # source_ip
if [[ "$ROUTE" == "true" ]] ; then
IP_ROUTE="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";
debug "ip_route: "$IP_ROUTE;
ip_route;
fi