2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
6 IPTABLES
="echo iptables"
17 ZONE_LIST
=$CONFIG_SECTION
25 config_get input
$1 input
26 config_get output
$1 output
27 config_get forward
$1 forward
29 DEF_INPUT
="${input:-$DEF_INPUT}"
30 DEF_OUTPUT
="${output:-$DEF_OUTPUT}"
31 DEF_FORWARD
="${forward:-$DEF_FORWARD}"
37 [ "$1" == "loopback" ] && return
39 config_get exists
$ZONE_LIST $1
40 [ -n "$exists" ] && return
41 config_set
$ZONE_LIST $1 1
44 $IPTABLES -N zone_
$1_MSSFIX
45 $IPTABLES -N zone_
$1_ACCEPT
46 $IPTABLES -N zone_
$1_DROP
47 $IPTABLES -N zone_
$1_REJECT
48 $IPTABLES -N zone_
$1_forward
49 $IPTABLES -A zone_
$1_forward -j zone_
$1_$5
50 $IPTABLES -A zone_
$1 -j zone_
$1_$3
51 $IPTABLES -A output
-j zone_
$1_$4
52 $IPTABLES -N zone_
$1_nat -t nat
53 $IPTABLES -N zone_
$1_prerouting -t nat
54 [ "$6" == "1" ] && $IPTABLES -t nat
-A POSTROUTING
-j zone_
$1_nat
63 config_get n_if core
"${network}_ifname"
64 config_get n_zone core
"${network}_zone"
66 if [ "$n_zone" != "$zone" ]; then
67 delif
"$network" "$n_if" "$n_zone"
73 logger
"adding $network ($ifname) to firewall zone $zone"
74 $IPTABLES -A input
-i "$ifname" -j zone_
${zone}
75 $IPTABLES -I zone_
${zone}_MSSFIX
1 -o "$ifname" -p tcp
--tcp-flags SYN
,RST SYN
-j TCPMSS
--clamp-mss-to-pmtu
76 $IPTABLES -I zone_
${zone}_ACCEPT
1 -o "$ifname" -j ACCEPT
77 $IPTABLES -I zone_
${zone}_DROP
1 -o "$ifname" -j DROP
78 $IPTABLES -I zone_
${zone}_REJECT
1 -o "$ifname" -j reject
79 $IPTABLES -I zone_
${zone}_ACCEPT
1 -i "$ifname" -j ACCEPT
80 $IPTABLES -I zone_
${zone}_DROP
1 -i "$ifname" -j DROP
81 $IPTABLES -I zone_
${zone}_REJECT
1 -i "$ifname" -j reject
82 $IPTABLES -I zone_
${zone}_nat
1 -t nat
-o "$ifname" -j MASQUERADE
83 $IPTABLES -I PREROUTING
1 -t nat
-i "$ifname" -j zone_
${zone}_prerouting
84 $IPTABLES -A forward
-i "$ifname" -j zone_
${zone}_forward
85 uci_set_state firewall core
"${network}_ifname" "$ifname"
86 uci_set_state firewall core
"${network}_zone" "$zone"
94 logger
"removing $network ($ifname) from firewall zone $zone"
95 $IPTABLES -D input
-i "$ifname" -j zone_
$zone
96 $IPTABLES -D zone_
${zone}_MSSFIX
-o "$ifname" -p tcp
--tcp-flags SYN
,RST SYN
-j TCPMSS
--clamp-mss-to-pmtu
97 $IPTABLES -D zone_
${zone}_ACCEPT
-o "$ifname" -j ACCEPT
98 $IPTABLES -D zone_
${zone}_DROP
-o "$ifname" -j DROP
99 $IPTABLES -D zone_
${zone}_REJECT
-o "$ifname" -j reject
100 $IPTABLES -D zone_
${zone}_ACCEPT
-i "$ifname" -j ACCEPT
101 $IPTABLES -D zone_
${zone}_DROP
-i "$ifname" -j DROP
102 $IPTABLES -D zone_
${zone}_REJECT
-i "$ifname" -j reject
103 $IPTABLES -D zone_
${zone}_nat
-t nat
-o "$ifname" -j MASQUERADE
104 $IPTABLES -D PREROUTING
-t nat
-i "$ifname" -j zone_
${zone}_prerouting
105 $IPTABLES -D forward
-i "$ifname" -j zone_
${zone}_forward
106 uci_revert_state firewall core
"${network}_ifname"
107 uci_revert_state firewall core
"${network}_zone"
113 echo "Loading synflood protection"
114 $IPTABLES -N syn_flood
115 $IPTABLES -A syn_flood
-p tcp
--syn -m limit
--limit $rate/second
--limit-burst $burst -j RETURN
116 $IPTABLES -A syn_flood
-j DROP
117 $IPTABLES -A INPUT
-p tcp
--syn -j syn_flood
120 fw_set_chain_policy
() {
123 [ "$target" == "REJECT" ] && {
124 $IPTABLES -A $chain -j reject
127 $IPTABLES -P $chain $target
131 [ -n "$DEFAULTS_APPLIED" ] && {
132 echo "Error: multiple defaults sections detected"
139 echo 1 > /proc
/sys
/net
/ipv
4/tcp_syncookies
140 for f
in /proc
/sys
/net
/ipv
4/conf
/*/accept_redirects
144 for f
in /proc
/sys
/net
/ipv
4/conf
/*/accept_source_route
149 uci_revert_state firewall core
150 uci_set_state firewall core
"" firewall_state
152 $IPTABLES -P INPUT DROP
153 $IPTABLES -P OUTPUT DROP
154 $IPTABLES -P FORWARD DROP
157 $IPTABLES -t mangle
-F
159 $IPTABLES -t mangle
-X
163 $IPTABLES -A INPUT
-m state
--state INVALID
-j DROP
164 $IPTABLES -A INPUT
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
166 $IPTABLES -A OUTPUT
-m state
--state INVALID
-j DROP
167 $IPTABLES -A OUTPUT
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
169 $IPTABLES -A FORWARD
-m state
--state INVALID
-j DROP
170 $IPTABLES -A FORWARD
-m state
--state RELATED
,ESTABLISHED
-j ACCEPT
172 $IPTABLES -A INPUT
-i lo
-j ACCEPT
173 $IPTABLES -A OUTPUT
-o lo
-j ACCEPT
175 config_get syn_flood
$1 syn_flood
176 config_get syn_rate
$1 syn_rate
177 config_get syn_burst
$1 syn_burst
178 [ "$syn_flood" == "1" ] && load_synflood
$syn_rate $syn_burst
180 echo "Adding custom chains"
187 $IPTABLES -A INPUT
-j input
188 $IPTABLES -A OUTPUT
-j output
189 $IPTABLES -A FORWARD
-j forward
192 $IPTABLES -A reject
-p tcp
-j REJECT
--reject-with tcp-reset
193 $IPTABLES -A reject
-j REJECT
--reject-with icmp-port-unreachable
195 fw_set_chain_policy INPUT
"$DEF_INPUT"
196 fw_set_chain_policy OUTPUT
"$DEF_OUTPUT"
197 fw_set_chain_policy FORWARD
"$DEF_FORWARD"
205 config_get name
$1 name
206 config_get network
$1 network
207 config_get masq
$1 masq
210 [ -z "$network" ] && network
=$name
211 create_zone
"$name" "$network" "$input" "$output" "$forward" "$masq"
212 fw_custom_chains_zone
"$name"
228 config_get src
$1 src
229 config_get src_ip
$1 src_ip
230 config_get src_mac
$1 src_mac
231 config_get src_port
$1 src_port
232 config_get dest
$1 dest
233 config_get dest_ip
$1 dest_ip
234 config_get dest_port
$1 dest_port
235 config_get proto
$1 proto
236 config_get target
$1 target
237 config_get ruleset
$1 ruleset
239 src_port_first
=${src_port%-*}
240 src_port_last
=${src_port#*-}
241 [ "$src_port_first" -ne "$src_port_last" ] && { \
242 src_port
="$src_port_first:$src_port_last"; }
244 dest_port_first
=${dest_port%-*}
245 dest_port_last
=${dest_port#*-}
246 [ "$dest_port_first" -ne "$dest_port_last" ] && { \
247 dest_port
="$dest_port_first:$dest_port_last"; }
251 [ -z "$target" ] && target
=DROP
252 [ -n "$src" -a -z "$dest" ] && ZONE
=zone_
$src
253 [ -n "$src" -a -n "$dest" ] && ZONE
=zone_
${src}_forward
254 [ -n "$dest" ] && TARGET
=zone_
${dest}_
$target
256 $IPTABLES -I $ZONE 1 \
257 ${proto:+-p $proto} \
258 ${src_ip:+-s $src_ip} \
259 ${src_port:+--sport $src_port} \
260 ${src_mac:+-m mac --mac-source $src_mac} \
261 ${dest_ip:+-d $dest_ip} \
262 ${dest_port:+--dport $dest_port} \
265 [ "$proto" == "tcpudp" -o -z "$proto" ] && {
280 config_get src
$1 src
281 config_get dest
$1 dest
282 config_get_bool mtu_fix
$1 mtu_fix
0
283 [ -n "$src" ] && z_src
=zone_
${src}_forward || z_src
=forward
284 [ -n "$dest" ] && z_dest
=zone_
${dest}_ACCEPT || z_dest
=ACCEPT
285 $IPTABLES -I $z_src 1 -j $z_dest
286 [ "$mtu_fix" -gt 0 -a -n "$dest" ] && $IPTABLES -I $z_src 1 -j zone_
${dest}_MSSFIX
296 local dest_port dest_port2
299 config_get src
$1 src
300 config_get src_ip
$1 src_ip
301 config_get src_port
$1 src_port
302 config_get src_dport
$1 src_dport
303 config_get src_mac
$1 src_mac
304 config_get dest_ip
$1 dest_ip
305 config_get dest_port
$1 dest_port
306 config_get proto
$1 proto
307 [ -z "$src" -o -z "$dest_ip" ] && { \
308 echo "redirect needs src and dest_ip"; return ; }
310 src_port_first
=${src_port%-*}
311 src_port_last
=${src_port#*-}
312 [ "$src_port_first" -ne "$src_port_last" ] && { \
313 src_port
="$src_port_first:$src_port_last"; }
315 src_dport_first
=${src_dport%-*}
316 src_dport_last
=${src_dport#*-}
317 [ "$src_dport_first" -ne "$src_dport_last" ] && { \
318 src_dport
="$src_dport_first:$src_dport_last"; }
320 dest_port2
=$dest_port
321 dest_port_first
=${dest_port2%-*}
322 dest_port_last
=${dest_port2#*-}
323 [ "$dest_port_first" -ne "$dest_port_last" ] && { \
324 dest_port2
="$dest_port_first:$dest_port_last"; }
327 $IPTABLES -A zone_
${src}_prerouting
-t nat \
328 ${proto:+-p $proto} \
329 ${src_ip:+-s $src_ip} \
330 ${src_port:+--sport $src_port} \
331 ${src_dport:+--dport $src_dport} \
332 ${src_mac:+-m mac --mac-source $src_mac} \
333 -j DNAT
--to-destination $dest_ip${dest_port:+:$dest_port}
335 $IPTABLES -I zone_
${src}_forward
1 \
336 ${proto:+-p $proto} \
338 ${src_ip:+-s $src_ip} \
339 ${src_port:+--sport $src_port} \
340 ${dest_port2:+--dport $dest_port2} \
341 ${src_mac:+-m mac --mac-source $src_mac} \
344 [ "$proto" == "tcpudp" -o -z "$proto" ] && {
356 config_get path
$1 path
357 [ -e $path ] && .
$path
364 config_get ifname
$1 ifname
365 [ -n "$up" ] ||
return 0
366 (ACTION
="ifup" INTERFACE
="$1" .
/etc
/hotplug.d
/iface
/20-firewall)
370 [ -n "$CUSTOM_CHAINS" ] ||
return 0
371 $IPTABLES -N input_rule
372 $IPTABLES -N output_rule
373 $IPTABLES -N forwarding_rule
374 $IPTABLES -N prerouting_rule
-t nat
375 $IPTABLES -N postrouting_rule
-t nat
377 $IPTABLES -A INPUT
-j input_rule
378 $IPTABLES -A OUTPUT
-j output_rule
379 $IPTABLES -A FORWARD
-j forwarding_rule
380 $IPTABLES -A PREROUTING
-t nat
-j prerouting_rule
381 $IPTABLES -A POSTROUTING
-t nat
-j postrouting_rule
384 fw_custom_chains_zone
() {
387 [ -n "$CUSTOM_CHAINS" ] ||
return 0
388 $IPTABLES -N input_
${zone}
389 $IPTABLES -N forwarding_
${zone}
390 $IPTABLES -N prerouting_
${zone} -t nat
391 $IPTABLES -I zone_
${zone} 1 -j input_
${zone}
392 $IPTABLES -I zone_
${zone}_forward
1 -j forwarding_
${zone}
393 $IPTABLES -I zone_
${zone}_prerouting
1 -t nat
-j prerouting_
${zone}
399 echo "Loading defaults"
400 config_foreach fw_defaults defaults
402 config_foreach fw_zone zone
404 config_foreach fw_rule rule
405 echo "Loading forwarding"
406 config_foreach fw_forwarding forwarding
407 echo "Loading redirects"
408 config_foreach fw_redirect redirect
409 echo "Loading includes"
410 config_foreach fw_include include
411 uci_set_state firewall core loaded
1
414 config_foreach fw_addif interface
419 $IPTABLES -t mangle
-F
421 $IPTABLES -t mangle
-X
424 $IPTABLES -P INPUT ACCEPT
425 $IPTABLES -P OUTPUT ACCEPT
426 $IPTABLES -P FORWARD ACCEPT
427 uci_revert_state firewall core