|
Packit Service |
d1fe03 |
#!/bin/sh
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
$XT_MULTI iptables -w -L -n > /dev/null || exit 1
|
|
Packit Service |
d1fe03 |
$XT_MULTI iptables -w2 -L -n > /dev/null || exit 1
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
echo -n '#foo' | $XT_MULTI iptables-restore -w || exit 1
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
# table probing
|
|
Packit Service |
d1fe03 |
for table in security raw mangle nat filter;do
|
|
Packit Service |
d1fe03 |
$XT_MULTI iptables -w2 -t $table -L -n > /dev/null
|
|
Packit Service |
d1fe03 |
done
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
$XT_MULTI iptables -w2 -p icmp --help | grep -q 'Valid ICMP Types' || exit 1
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
cat <
|
|
Packit Service |
d1fe03 |
*nat
|
|
Packit Service |
d1fe03 |
-F
|
|
Packit Service |
d1fe03 |
-X
|
|
Packit Service |
d1fe03 |
-Z
|
|
Packit Service |
d1fe03 |
-N PREROUTING_direct
|
|
Packit Service |
d1fe03 |
-I PREROUTING 1 -j PREROUTING_direct
|
|
Packit Service |
d1fe03 |
-N PREROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-N PREROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-I PREROUTING 2 -j PREROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-I PREROUTING 3 -j PREROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-N POSTROUTING_direct
|
|
Packit Service |
d1fe03 |
-I POSTROUTING 1 -j POSTROUTING_direct
|
|
Packit Service |
d1fe03 |
-N POSTROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-N POSTROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-I POSTROUTING 2 -j POSTROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-I POSTROUTING 3 -j POSTROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-N OUTPUT_direct
|
|
Packit Service |
d1fe03 |
-I OUTPUT 1 -j OUTPUT_direct
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*mangle
|
|
Packit Service |
d1fe03 |
-F
|
|
Packit Service |
d1fe03 |
-X
|
|
Packit Service |
d1fe03 |
-Z
|
|
Packit Service |
d1fe03 |
-N PREROUTING_direct
|
|
Packit Service |
d1fe03 |
-I PREROUTING 1 -j PREROUTING_direct
|
|
Packit Service |
d1fe03 |
-N PREROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-N PREROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-I PREROUTING 2 -j PREROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-I PREROUTING 3 -j PREROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-N POSTROUTING_direct
|
|
Packit Service |
d1fe03 |
-I POSTROUTING 1 -j POSTROUTING_direct
|
|
Packit Service |
d1fe03 |
-N INPUT_direct
|
|
Packit Service |
d1fe03 |
-I INPUT 1 -j INPUT_direct
|
|
Packit Service |
d1fe03 |
-N OUTPUT_direct
|
|
Packit Service |
d1fe03 |
-I OUTPUT 1 -j OUTPUT_direct
|
|
Packit Service |
d1fe03 |
-N FORWARD_direct
|
|
Packit Service |
d1fe03 |
-I FORWARD 1 -j FORWARD_direct
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*raw
|
|
Packit Service |
d1fe03 |
-F
|
|
Packit Service |
d1fe03 |
-X
|
|
Packit Service |
d1fe03 |
-Z
|
|
Packit Service |
d1fe03 |
-N PREROUTING_direct
|
|
Packit Service |
d1fe03 |
-I PREROUTING 1 -j PREROUTING_direct
|
|
Packit Service |
d1fe03 |
-N PREROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-N PREROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-I PREROUTING 2 -j PREROUTING_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-I PREROUTING 3 -j PREROUTING_ZONES
|
|
Packit Service |
d1fe03 |
-N OUTPUT_direct
|
|
Packit Service |
d1fe03 |
-I OUTPUT 1 -j OUTPUT_direct
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*filter
|
|
Packit Service |
d1fe03 |
-F
|
|
Packit Service |
d1fe03 |
-X
|
|
Packit Service |
d1fe03 |
-Z
|
|
Packit Service |
d1fe03 |
-N INPUT_direct
|
|
Packit Service |
d1fe03 |
-N INPUT_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-N INPUT_ZONES
|
|
Packit Service |
d1fe03 |
-I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
Packit Service |
d1fe03 |
-I INPUT 2 -i lo -j ACCEPT
|
|
Packit Service |
d1fe03 |
-I INPUT 3 -j INPUT_direct
|
|
Packit Service |
d1fe03 |
-I INPUT 4 -j INPUT_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-I INPUT 5 -j INPUT_ZONES
|
|
Packit Service |
d1fe03 |
-I INPUT 6 -m conntrack --ctstate INVALID -j DROP
|
|
Packit Service |
d1fe03 |
-I INPUT 7 -j REJECT --reject-with icmp-host-prohibited
|
|
Packit Service |
d1fe03 |
-N FORWARD_direct
|
|
Packit Service |
d1fe03 |
-N FORWARD_IN_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-N FORWARD_IN_ZONES
|
|
Packit Service |
d1fe03 |
-N FORWARD_OUT_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-N FORWARD_OUT_ZONES
|
|
Packit Service |
d1fe03 |
-I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
Packit Service |
d1fe03 |
-I FORWARD 2 -i lo -j ACCEPT
|
|
Packit Service |
d1fe03 |
-I FORWARD 3 -j FORWARD_direct
|
|
Packit Service |
d1fe03 |
-I FORWARD 4 -j FORWARD_IN_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-I FORWARD 5 -j FORWARD_IN_ZONES
|
|
Packit Service |
d1fe03 |
-I FORWARD 6 -j FORWARD_OUT_ZONES_SOURCE
|
|
Packit Service |
d1fe03 |
-I FORWARD 7 -j FORWARD_OUT_ZONES
|
|
Packit Service |
d1fe03 |
-I FORWARD 8 -m conntrack --ctstate INVALID -j DROP
|
|
Packit Service |
d1fe03 |
-I FORWARD 9 -j REJECT --reject-with icmp-host-prohibited
|
|
Packit Service |
d1fe03 |
-N OUTPUT_direct
|
|
Packit Service |
d1fe03 |
-I OUTPUT 1 -j OUTPUT_direct
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
EOF
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if [ $? -ne 0 ]; then
|
|
Packit Service |
d1fe03 |
echo "Error during first iptables-restore"
|
|
Packit Service |
d1fe03 |
exit 1
|
|
Packit Service |
d1fe03 |
fi
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
cat <
|
|
Packit Service |
d1fe03 |
*raw
|
|
Packit Service |
d1fe03 |
-N PRE_public
|
|
Packit Service |
d1fe03 |
-N PRE_public_log
|
|
Packit Service |
d1fe03 |
-N PRE_public_deny
|
|
Packit Service |
d1fe03 |
-N PRE_public_allow
|
|
Packit Service |
d1fe03 |
-I PRE_public 1 -j PRE_public_log
|
|
Packit Service |
d1fe03 |
-I PRE_public 2 -j PRE_public_deny
|
|
Packit Service |
d1fe03 |
-I PRE_public 3 -j PRE_public_allow
|
|
Packit Service |
d1fe03 |
-A PREROUTING_ZONES -i + -g PRE_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*filter
|
|
Packit Service |
d1fe03 |
-N IN_public
|
|
Packit Service |
d1fe03 |
-N IN_public_log
|
|
Packit Service |
d1fe03 |
-N IN_public_deny
|
|
Packit Service |
d1fe03 |
-N IN_public_allow
|
|
Packit Service |
d1fe03 |
-I IN_public 1 -j IN_public_log
|
|
Packit Service |
d1fe03 |
-I IN_public 2 -j IN_public_deny
|
|
Packit Service |
d1fe03 |
-I IN_public 3 -j IN_public_allow
|
|
Packit Service |
d1fe03 |
-A IN_public_allow -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
|
|
Packit Service |
d1fe03 |
-A IN_public_allow -p udp --dport 5353 -d 224.0.0.251 -m conntrack --ctstate NEW -j ACCEPT
|
|
Packit Service |
d1fe03 |
-N FWDI_public
|
|
Packit Service |
d1fe03 |
-N FWDI_public_log
|
|
Packit Service |
d1fe03 |
-N FWDI_public_deny
|
|
Packit Service |
d1fe03 |
-N FWDI_public_allow
|
|
Packit Service |
d1fe03 |
-I FWDI_public 1 -j FWDI_public_log
|
|
Packit Service |
d1fe03 |
-I FWDI_public 2 -j FWDI_public_deny
|
|
Packit Service |
d1fe03 |
-I FWDI_public 3 -j FWDI_public_allow
|
|
Packit Service |
d1fe03 |
-I IN_public 4 -p icmp -j ACCEPT
|
|
Packit Service |
d1fe03 |
-I FWDI_public 4 -p icmp -j ACCEPT
|
|
Packit Service |
d1fe03 |
-A INPUT_ZONES -i + -g IN_public
|
|
Packit Service |
d1fe03 |
-A FORWARD_IN_ZONES -i + -g FWDI_public
|
|
Packit Service |
d1fe03 |
-N FWDO_public
|
|
Packit Service |
d1fe03 |
-N FWDO_public_log
|
|
Packit Service |
d1fe03 |
-N FWDO_public_deny
|
|
Packit Service |
d1fe03 |
-N FWDO_public_allow
|
|
Packit Service |
d1fe03 |
-I FWDO_public 1 -j FWDO_public_log
|
|
Packit Service |
d1fe03 |
-I FWDO_public 2 -j FWDO_public_deny
|
|
Packit Service |
d1fe03 |
-I FWDO_public 3 -j FWDO_public_allow
|
|
Packit Service |
d1fe03 |
-A FORWARD_OUT_ZONES -o + -g FWDO_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*nat
|
|
Packit Service |
d1fe03 |
-N PRE_public
|
|
Packit Service |
d1fe03 |
-N PRE_public_log
|
|
Packit Service |
d1fe03 |
-N PRE_public_deny
|
|
Packit Service |
d1fe03 |
-N PRE_public_allow
|
|
Packit Service |
d1fe03 |
-I PRE_public 1 -j PRE_public_log
|
|
Packit Service |
d1fe03 |
-I PRE_public 2 -j PRE_public_deny
|
|
Packit Service |
d1fe03 |
-I PRE_public 3 -j PRE_public_allow
|
|
Packit Service |
d1fe03 |
-A PREROUTING_ZONES -i + -g PRE_public
|
|
Packit Service |
d1fe03 |
-N POST_public
|
|
Packit Service |
d1fe03 |
-N POST_public_log
|
|
Packit Service |
d1fe03 |
-N POST_public_deny
|
|
Packit Service |
d1fe03 |
-N POST_public_allow
|
|
Packit Service |
d1fe03 |
-I POST_public 1 -j POST_public_log
|
|
Packit Service |
d1fe03 |
-I POST_public 2 -j POST_public_deny
|
|
Packit Service |
d1fe03 |
-I POST_public 3 -j POST_public_allow
|
|
Packit Service |
d1fe03 |
-A POSTROUTING_ZONES -o + -g POST_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*mangle
|
|
Packit Service |
d1fe03 |
-N PRE_public
|
|
Packit Service |
d1fe03 |
-N PRE_public_log
|
|
Packit Service |
d1fe03 |
-N PRE_public_deny
|
|
Packit Service |
d1fe03 |
-N PRE_public_allow
|
|
Packit Service |
d1fe03 |
-I PRE_public 1 -j PRE_public_log
|
|
Packit Service |
d1fe03 |
-I PRE_public 2 -j PRE_public_deny
|
|
Packit Service |
d1fe03 |
-I PRE_public 3 -j PRE_public_allow
|
|
Packit Service |
d1fe03 |
-A PREROUTING_ZONES -i + -g PRE_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
EOF
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if [ $? -ne 0 ]; then
|
|
Packit Service |
d1fe03 |
echo "Error during 2nd iptables-restore"
|
|
Packit Service |
d1fe03 |
exit 1
|
|
Packit Service |
d1fe03 |
fi
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
cat <
|
|
Packit Service |
d1fe03 |
*mangle
|
|
Packit Service |
d1fe03 |
-P PREROUTING ACCEPT
|
|
Packit Service |
d1fe03 |
-P POSTROUTING ACCEPT
|
|
Packit Service |
d1fe03 |
-P INPUT ACCEPT
|
|
Packit Service |
d1fe03 |
-P OUTPUT ACCEPT
|
|
Packit Service |
d1fe03 |
-P FORWARD ACCEPT
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*raw
|
|
Packit Service |
d1fe03 |
-P PREROUTING ACCEPT
|
|
Packit Service |
d1fe03 |
-P OUTPUT ACCEPT
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*filter
|
|
Packit Service |
d1fe03 |
-P INPUT ACCEPT
|
|
Packit Service |
d1fe03 |
-P OUTPUT ACCEPT
|
|
Packit Service |
d1fe03 |
-P FORWARD ACCEPT
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
EOF
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if [ $? -ne 0 ]; then
|
|
Packit Service |
d1fe03 |
echo "Error during 3rd iptables-restore"
|
|
Packit Service |
d1fe03 |
exit 1
|
|
Packit Service |
d1fe03 |
fi
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
cat <
|
|
Packit Service |
d1fe03 |
*filter
|
|
Packit Service |
d1fe03 |
-I INPUT_ZONES 1 -i enp3s0 -g IN_public
|
|
Packit Service |
d1fe03 |
-I FORWARD_IN_ZONES 1 -i enp3s0 -g FWDI_public
|
|
Packit Service |
d1fe03 |
-I FORWARD_OUT_ZONES 1 -o enp3s0 -g FWDO_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*nat
|
|
Packit Service |
d1fe03 |
-I PREROUTING_ZONES 1 -i enp3s0 -g PRE_public
|
|
Packit Service |
d1fe03 |
-I POSTROUTING_ZONES 1 -o enp3s0 -g POST_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*mangle
|
|
Packit Service |
d1fe03 |
-I PREROUTING_ZONES 1 -i enp3s0 -g PRE_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
*raw
|
|
Packit Service |
d1fe03 |
-I PREROUTING_ZONES 1 -i enp3s0 -g PRE_public
|
|
Packit Service |
d1fe03 |
COMMIT
|
|
Packit Service |
d1fe03 |
EOF
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if [ $? -ne 0 ]; then
|
|
Packit Service |
d1fe03 |
echo "Error during 4th iptables-restore"
|
|
Packit Service |
d1fe03 |
exit 1
|
|
Packit Service |
d1fe03 |
fi
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
tmpfile=$(mktemp) || exit 1
|
|
Packit Service |
d1fe03 |
for table in nat mangle raw filter;do
|
|
Packit Service |
d1fe03 |
$XT_MULTI iptables-save -t $table | grep -v '^#' >> "$tmpfile"
|
|
Packit Service |
d1fe03 |
done
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
case "$XT_MULTI" in
|
|
Packit Service |
f21f3a |
*xtables-nft-multi)
|
|
Packit Service |
d1fe03 |
# nft-multi displays chain names in different order, work around this for now
|
|
Packit Service |
d1fe03 |
tmpfile2=$(mktemp)
|
|
Packit Service |
d1fe03 |
sort "$tmpfile" > "$tmpfile2"
|
|
Packit Service |
d1fe03 |
sort $(dirname "$0")/dumps/ipt-save-completed.txt > "$tmpfile"
|
|
Packit Service |
d1fe03 |
diff -u $tmpfile $tmpfile2
|
|
Packit Service |
d1fe03 |
RET=$?
|
|
Packit Service |
d1fe03 |
rm -f "$tmpfile2"
|
|
Packit Service |
d1fe03 |
;;
|
|
Packit Service |
d1fe03 |
*)
|
|
Packit Service |
d1fe03 |
diff -u $tmpfile $(dirname "$0")/dumps/ipt-save-completed.txt
|
|
Packit Service |
d1fe03 |
RET=$?
|
|
Packit Service |
d1fe03 |
;;
|
|
Packit Service |
d1fe03 |
esac
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
rm -f "$tmpfile"
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
exit $RET
|