rendered paste body##### /etc/init.d/S45firewall
#!/bin/sh
## Please make changes in /etc/firewall.user
. /etc/functions.sh
WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)
## CLEAR TABLES
for T in filter nat; do
iptables -t $T -F
iptables -t $T -X
done
iptables -N input_rule
iptables -N output_rule
iptables -N forwarding_rule
iptables -t nat -N prerouting_rule
iptables -t nat -N postrouting_rule
### INPUT
### (connections with the router as destination)
# base case
iptables -P INPUT DROP
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP
#
# insert accept rule or to jump to new accept-check table here
#
iptables -A INPUT -j input_rule
# allow
iptables -A INPUT -i \! $WAN -j ACCEPT # allow from lan/wifi interfaces
iptables -A INPUT -p icmp -j ACCEPT # allow ICMP
iptables -A INPUT -p gre -j ACCEPT # allow GRE
# reject (what to do with anything not allowed earlier)
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
### OUTPUT
### (connections with the router as source)
# base case
iptables -P OUTPUT DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#
# insert accept rule or to jump to new accept-check table here
#
iptables -A OUTPUT -j output_rule
# allow
iptables -A OUTPUT -j ACCEPT #allow everything out
# reject (what to do with anything not allowed earlier)
iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
### FORWARDING
### (connections routed through the router)
# base case
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmt
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#
# insert accept rule or to jump to new accept-check table here
#
iptables -A FORWARD -j forwarding_rule
# allow
iptables -A FORWARD -i br0 -o br0 -j ACCEPT
iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
# reject (what to do with anything not allowed earlier)
# uses the default -P DROP
### MASQ
iptables -t nat -A PREROUTING -j prerouting_rule
iptables -t nat -A POSTROUTING -j postrouting_rule
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
## USER RULES
[ -f /etc/firewall.user ] && . /etc/firewall.user
[ -e /etc/config/firewall ] && {
awk -f /usr/lib/common.awk -f /usr/lib/firewall.awk /etc/config/firewall
}
##### /etc/config/firewall
# RULE SYNTAX:
#
# forward:<match>:<target>[:<port>]
# - forwards all packets matched by <match> to <target>,
# optionally changing the port to <port>
#
# accept:<match>
# - accepts all traffic matched by <match>
#
# drop:<match>
# - drops all traffic matched by <match>
#
#
# MATCHING OPTIONS:
#
# src=<ip>
# - match the source ip <ip>
#
# dest=<ip>
# - match the destination ip <ip>
#
# proto=<proto>
# - match the protocol by name or number
#
# sport=<port(s)>
# - match the source port(s), see below for syntax
#
# dport=<port(s)>
# - match the destination port(s), see below for syntax
#
#
#
# PORT SYNTAX:
#
# You can enter an arbitrary list of ports and port ranges in the following forma
# - 22,53,993,1000-1024
#
# If you don't set the protocol to tcp or udp, it will apply to both
#
#
#
# EXAMPLES:
#
# drop:dport=22 src=1.3.3.7
# accept:proto=tcp dport=22
# forward:dport=60168:192.168.1.2:60169
##### /etc/firewall.user
#!/bin/sh
. /bin/fwlib.sh
flush_firewall
WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)
IP=$(/sbin/ifconfig ppp0 | awk '/Mask/ { print $2 }' | cut -f2 -d:)
#iptables -t nat -A PREROUTING -d $IP -p tcp --dport 80 -j DNAT --to-destination
#iptables -t nat -A POSTROUTING -p tcp --dst 10.0.0.5 --dport 80 -j SNAT --to-sou
### Ports accessible on the router from the WAN
# allow_port 22 # SSH
# allow_port 80 # HTTP
# allow_port 465 # HTTPS
allow_port 23
allow_port 24
### Ports accessible to client machines.
forward_port 21 refinery
forward_port 22 refinery
forward_port 25 refinery
forward_port 80 refinery
change_port 80 10.0.0.1 88
forward_port 143 refinery
forward_port 993 refinery
forward_port 5079 refinery
forward_port 30720 injector
# forward a few utility port-ranges to make it easier to deal with
# bittorrent configurations and the like
#forward_port 6100:6199 refinery
forward_port 6100:6111 refinery
forward_port 30000:30100 refinery
forward_port 6113:6199 refinery
forward_port 6200:6299 fuel
forward_port 6300:6399 injector
forward_port 6112 injector
# /usr/lib/qosfw/fw.sh reads and applies the firewalling rules from /etc/config/f
#. /usr/lib/qosfw/fw.sh
. /usr/lib/qos.sh
# IPv6
iptables -A INPUT -p 41 -i $WAN -j ACCEPT
##### /bin/fwlib.sh
#!/bin/sh
. /etc/functions.sh
WAN=$(nvram get wan_ifname)
WAN_IP=$(/sbin/ifconfig ppp0 | awk '/Mask/ { print $2 }' | cut -f2 -d:)
LAN=$(nvram get lan_ifname)
LAN_IP=$(/sbin/ifconfig br0 | awk '/Mask/ { print $2 }' | cut -f2 -d:)
flush_firewall () {
iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
}
### BIG FAT DISCLAIMER
### The "-i $WAN" literally means packets that came in over the $WAN interface;
### this WILL NOT MATCH packets sent from the LAN to the WAN address.
allow_port () {
ALLOWPORT=$1
iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP
iptables -A input_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP
}
sucky_resolve () {
HOSTNAME=$1
###
grep $HOSTNAME /etc/hosts | awk '{ print $1 }'
}
forward_port() {
ALLOWPORT=$1
ALLOWHOSTNAME=$2
ALLOWHOST=`sucky_resolve $ALLOWHOSTNAME`
echo "Forwarding $ALLOWPORT to $ALLOWHOSTNAME (
iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j DNAT
iptables -A forwarding_rule -i $WAN -p tcp --dport $ALLOWPORT -d $ALLO
iptables -t nat -A PREROUTING -d $WAN_IP -p tcp --dport $ALLOWPORT -j DNAT --
iptables -t nat -A POSTROUTING -p tcp --dst $ALLOWHOST --dport $ALLOWPORT -j
iptables -t nat -A prerouting_rule -i $WAN -p udp --dport $ALLOWPORT -j DNAT
iptables -A forwarding_rule -i $WAN -p udp --dport $ALLOWPORT -d $ALLO
iptables -t nat -A PREROUTING -d $WAN_IP -p udp --dport $ALLOWPORT -j DNAT --
iptables -t nat -A POSTROUTING -p udp --dst $ALLOWHOST --dport $ALLOWPORT -j
}
change_port() {
ALLOWPORT=$1
ALLOWHOSTNAME=$2
NEWPORT=$3
ALLOWHOST=`sucky_resolve $ALLOWHOSTNAME`
echo "Forwarding $ALLOWPORT to $ALLOWHOSTNAME (
iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j DNAT
iptables -A forwarding_rule -i $WAN -p tcp --dport $ALLOWPORT -d $ALLO
iptables -t nat -A PREROUTING -d $WAN_IP -p tcp --dport $ALLOWPORT -j DNAT --
iptables -t nat -A POSTROUTING -p tcp --dst $ALLOWHOST --dport $ALLOWPORT -j
iptables -t nat -A prerouting_rule -i $WAN -p udp --dport $ALLOWPORT -j DNAT
iptables -A forwarding_rule -i $WAN -p udp --dport $ALLOWPORT -d $ALLO
iptables -t nat -A PREROUTING -d $WAN_IP -p udp --dport $ALLOWPORT -j DNAT --
iptables -t nat -A POSTROUTING -p udp --dst $ALLOWHOST --dport $ALLOWPORT -j
iptables -t NAT -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP
iptables -A input_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP
}
register_dmz () {
ALLOWHOSTNAME=$1
DMZHOST=`sucky_resolve $ALLOWHOSTNAME`
iptables -t nat -A prerouting_rule -i $WAN -j DNAT --to $DMZHOST
iptables -A forwarding_rule -i $WAN -d $DMZHOST -j ACCEPT
}