rendered paste body<?PHP $green = 'green'; $greenip = '192.168.2.1'; $greenmask = '24'; $blue = 'tun0'; $blueip = '192.168.182.1'; $bluemask = '24'; $orange = 'orange'; $orangeip = '192.168.0.1'; $orangemask = '24'; $red = 'red'; $data = file('/var/lib/dhcpc/dhcpcd-red.info'); foreach ($data as $line) { $line = str_replace(array("\n","\r"),'',$line); $x = explode('=',$line); $redmisc[$x[0]] = $x[1]; } unset($data); unset($line); unset($x); $redip = $redmisc['IPADDR']; $redmask = $redmisc['NETMASK']; $yellow = 'yellow'; $purple = 'purple'; $plip = 'ppp0'; $ipt = '/sbin/iptables'; $ip6t = '/sbin/ip6tables'; $php = '/usr/bin/php'; class iptables { function ipt ($stuff,$type = '4') { global $ipt; global $ip6t; if ($type == 4) { echo $ipt.' '.$stuff."\n"; system($ipt.' '.$stuff); } else { echo $ip6t.' '.$stuff."\n"; system($ip6t.' '.$stuff); } } function add ($chain,$cond,$what,$table = 'filter',$type = '4') { if (!$table) { $table = 'filter'; } $this->ipt('-t '.$table.' -A '.$chain.' '.$cond.' -j '.$what,$type); } function flush ($chain = null,$table = 'filter',$type = '4') { if (!$table) { $table = 'filter'; } $this->ipt('-t '.$table.' -F '.$chain,$type); } function destroy ($chain = null,$table = 'filter',$type = '4') { if (!$table) { $table = 'filter'; } $this->ipt('-t '.$table.' -X '.$chain,$type); } function xflush ($chain = null,$table = 'filter',$type = '4') { if (!$table) { $table = 'filter'; } $this->flush($chain,$table,$type); $this->destroy($chain,$table,$type); } function def ($chain,$what,$table = 'filter',$type = '4') { if (!$table) { $table = 'filter'; } $this->ipt('-t '.$table.' -P '.$chain.' '.$what,$type); } function create ($chain,$table = 'filter',$type = '4') { if (!$table) { $table = 'filter'; } $this->ipt('-t '.$table.' -N '.$chain,$type); } } $it = new iptables; $arg = $_SERVER['argv'][1]; if ($arg == 'start') { file_put_contents('/proc/sys/net/ipv4/ip_forward','1'); file_put_contents('/proc/sys/net/ipv4/ip_dynaddr','1'); file_put_contents('/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts','1'); file_put_contents('/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses','1'); file_put_contents('/proc/sys/net/ipv4/tcp_ecn','0'); file_put_contents('/proc/sys/kernel/printk','1 4 1 7'); echo "Disable ICMP Redirect Acceptance...\n"; # Disable ICMP Redirect Acceptance foreach (glob('/proc/sys/net/ipv4/conf/*/accept_redirects') as $file) { file_put_contents($file,'0'); } echo "Disable Source Routed Packets...\n"; # Disable Source Routed Packets foreach (glob('/proc/sys/net/ipv4/conf/*/accept_source_route') as $file) { file_put_contents($file,'0'); } echo "Log Spoofed Packets, Source Routed Packets, Redirect Packets\n"; # Log Spoofed Packets, Source Routed Packets, Redirect Packets foreach (glob('/proc/sys/net/ipv4/conf/*/log_martians') as $file) { file_put_contents($file,'1'); } $it->xflush(); /* flush the firewall */ $it->def('INPUT','DROP'); /* Set defaults */ $it->def('FORWARD','DROP'); $it->def('OUTPUT','ACCEPT'); $it->add('INPUT','-p TCP ! -i lo --dport 800','DROP'); /* No getting around DansGuardian */ $it->add('INPUT','-p TCP ! -i lo --dport 8118','DROP'); $it->add('INPUT','-p TCP ! -i lo --dport 9050','DROP'); $it->add('INPUT','-p TCP ! -i lo --dport 8123','DROP'); $it->add('INPUT','-p TCP ! -i lo --dport 8081','DROP'); $it->add('INPUT','-p TCP ! -i '.$red.' ! -i '.$orange.' --dport 8080','DROP'); $it->add('INPUT','-p UDP -i '.$red.' --dport 137 -s 0/0','DROP'); /* No netbios */ $it->add('INPUT','-p UDP -i '.$red.' --dport 138 -s 0/0','DROP'); $it->add('INPUT','-p UDP -i '.$orange.' --dport 137 -s 0/0','DROP'); $it->add('INPUT','-p UDP -i '.$orange.' --dport 138 -s 0/0','DROP'); $it->create('ipblock'); /* Our IP blocker */ $it->add('INPUT','-i '.$red,'ipblock'); $it->add('FORWARD','-i '.$red,'ipblock'); $it->create('guardian'); /* Our guardian IP blocker */ $it->add('INPUT','-i '.$red,'guardian'); $it->add('FORWARD','-i '.$red,'guardian'); $it->create('advnet'); /* Other junk we don't want */ $it->add('INPUT','-i '.$red,'advnet'); $it->create('portfw'); /* Lets do some port forwarding */ $it->add('FORWARD','','portfw'); $it->add('INPUT','','portfw'); $it->add('INPUT','-i lo','ACCEPT'); /* Local host and ethernet */ $it->add('INPUT','-o lo','ACCEPT'); $it->add('INPUT','-i '.$green,'ACCEPT'); $it->add('INPUT','-i '.$plip,'ACCEPT'); $it->create('block'); $it->add('block','-m state --state ESTABLISHED,RELATED','ACCEPT'); /* Allow good stuff */ $it->add('block','-i '.$green,'ACCEPT'); $it->add('block','-i '.$plip,'ACCEPT'); $it->add('block','-i '.$blue,'ACCEPT'); $it->create('xtaccess'); /* external access for this box */ $it->add('block','','xtaccess'); $it->add('block','-p TCP --source-port 67 --destination-port 68 -i '.$red,'ACCEPT'); /* DHCP */ $it->add('block','-p TCP --source-port 68 --destination-port 67 -i '.$red,'ACCEPT'); $it->add('block','-p UDP --source-port 67 --destination-port 68 -i '.$red,'ACCEPT'); $it->add('block','-p UDP --source-port 68 --destination-port 67 -i '.$red,'ACCEPT'); $it->add('block','-p ICMP -i '.$red.' '.$redip.'/'.$redmask,'ACCEPT'); /* ICMP = good */ $it->add('block','-i '.$orange.' -p tcp --dport 16667','ACCEPT'); $it->add('INPUT','','block'); $it->add('INPUT','','LOG --log-prefix="INPUT: "'); /* Log and reject all else */ $it->add('INPUT','','REJECT'); /* Forwarding */// $it->add('FORWARD','-s 192.168.2.149','LOG --log-prefix="XBOX: "');// $it->add('FORWARD','-d 192.168.2.149','LOG --log-prefix="XBOX: "'); $it->add('FORWARD','-o '.$red.' -m mac --mac-source 00:16:36:2F:9C:0C','LOG'); /* No internet for Quincy */ $it->add('FORWARD','-o '.$red.' -m mac --mac-source 00:16:36:2F:9C:0C','REJECT'); /* No internet for Quincy */ $it->add('FORWARD','-m state --state ESTABLISHED,RELATED -o '.$red,'ACCEPT'); /* Stuff we know about */ $it->add('FORWARD','-m state --state ESTABLISHED,RELATED -i '.$red,'ACCEPT'); $it->add('FORWARD','-i '.$green.' -o '.$green,'ACCEPT'); /* Allow packets from green to green */ $it->add('FORWARD','-i '.$orange.' -o '.$orange,'ACCEPT'); /* Allow packets from green to green */ $it->add('FORWARD','','portfw'); /* More port forwarding */ $it->create('dmzholes'); /* DMZ pinholes and green to orange */ $it->create('wifiholes'); $it->add('FORWARD','-i '.$orange.' -o '.$green.' -m state --state ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$orange.' -o '.$plip.' -m state --state ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$orange.' -o '.$blue.' -m state --state ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$green.' -o '.$orange.' -m state --state NEW,ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$green.' -o '.$plip.' -m state --state NEW,ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$green.' -o '.$blue.' -m state --state NEW,ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$plip.' -o '.$orange.' -m state --state NEW,ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$plip.' -o '.$green.' -m state --state NEW,ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$plip.' -o '.$blue.' -m state --state NEW,ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$blue.' -o '.$orange.' -m state --state NEW,ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$blue.' -o '.$plip.' -m state --state ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$blue.' -o '.$green.' -m state --state ESTABLISHED,RELATED','ACCEPT'); $it->add('FORWARD','-i '.$orange.' -o '.$green,'dmzholes'); $it->add('FORWARD','-i '.$blue.' -o '.$green,'wifiholes'); $it->add('FORWARD','','LOG'); /* Log and reject all else */ $it->add('FORWARD','','REJECT'); /* NAT */ $it->xflush('','nat'); $it->create('squid','nat'); /* Squid stuff */ $it->create('jmpsquid','nat');// $it->add('PREROUTING','-s 192.168.2.149','LOG --log-prefix="XBOXnat: "','nat');// $it->add('PREROUTING','-d 192.168.2.149','LOG --log-prefix="XBOXnat: "','nat'); $it->add('jmpsquid','-d 10.0.0.0/8','RETURN','nat'); $it->add('jmpsquid','-d 172.16.0.0/12','RETURN','nat'); $it->add('jmpsquid','-d 192.168.0.0/16','RETURN','nat'); $it->add('jmpsquid','-s 192.168.2.160/27','RETURN','nat'); $it->add('jmpsquid','-d 169.254.0.0/16','RETURN','nat'); $it->add('jmpsquid','','squid','nat'); $it->add('PREROUTING','-i '.$green,'jmpsquid','nat'); $it->add('PREROUTING','-i '.$blue,'jmpsquid','nat'); $it->add('squid','-p TCP --dport 80','REDIRECT --to-ports 8080','nat'); /* A page saying they need to use squid */ $it->create('imlog','nat'); $it->add('imlog','-d 10.0.0.0/8','RETURN','nat'); $it->add('imlog','-d 172.16.0.0/12','RETURN','nat'); $it->add('imlog','-d 192.168.0.0/16','RETURN','nat'); $it->add('imlog','-d 169.254.0.0/16','RETURN','nat');# $it->add('imlog','-p TCP --dport 1863','REDIRECT --to-ports 16667','nat'); /* MSN logging */# $it->add('imlog','-p TCP --dport 5190','REDIRECT --to-ports 16667','nat'); /* AIM/ICQ logging */# $it->add('imlog','-p TCP --dport 5050','REDIRECT --to-ports 16667','nat'); /* Yahoo! logging */# $it->add('imlog','-p TCP --dport 6667','REDIRECT --to-ports 16667','nat'); /* IRC logging */ $it->add('PREROUTING','-i '.$orange.' -s 192.168.0.151','imlog','nat'); $it->add('PREROUTING','-i '.$orange.' -s 192.168.0.152','imlog','nat');// $it->add('PREROUTING','-i '.$green.' -m mac --mac-source 00:16:36:2F:9C:0C','LOG','nat'); /* No internet for Quincy */// $it->add('PREROUTING','-i '.$green.' -m mac --mac-source 00:16:36:2F:9C:0C','DROP','nat'); /* No internet for Quincy */ $it->add('POSTROUTING','-o '.$red,'MASQUERADE','nat'); /* Masquerading */ $it->add('POSTROUTING','-o '.$green.' -s '.$greenip.'/'.$greenmask,'MASQUERADE','nat'); $it->add('POSTROUTING','-o '.$orange.' -s '.$orangeip.'/'.$orangemask,'MASQUERADE','nat'); $it->create('portfw_pre','nat'); /* More port forwarding */ $it->create('portfw_post','nat'); $it->add('PREROUTING','','portfw_pre','nat'); $it->add('POSTROUTING','','portfw_post','nat'); system($php.' '.$_SERVER['argv'][0].' dmz'); system($php.' '.$_SERVER['argv'][0].' xtaccess'); system($php.' '.$_SERVER['argv'][0].' advnet'); system($php.' '.$_SERVER['argv'][0].' ipblock'); system($php.' '.$_SERVER['argv'][0].' guardian'); system($php.' '.$_SERVER['argv'][0].' portfw'); } elseif ($arg == 'dmz') { $names = Array ( 'dmzholes', 'wifiholes' ); foreach ($names as $name) { $it->flush($name); $data = file('/etc/router/'.$name); foreach ($data as $line) { $line = str_replace(array("\n","\r"),'',$line); if ($line{0} != '#') { $x = explode(',',$line); $it->add($name,'-m state --state NEW -p ' . $x[0].' -s '.$x[1].' -d '.$x[2].' --dport '.$x[3],'ACCEPT'); } } } } elseif ($arg == 'ipv6') { file_put_contents('/proc/sys/net/ipv6/conf/all/forwarding','1'); system('ip route add 2002:1828:83a7:c000::/64 via 2002:1828:83a7:0:210:5aff:fe83:df29 dev '.$orange); $it->xflush(null,null,6); /* flush the firewall */ $it->def('INPUT','DROP',null,6); /* Set defaults */ $it->def('FORWARD','DROP',null,6); $it->def('OUTPUT','ACCEPT',null,6); $it->add('INPUT','-p UDP -i '.$orange.' --dport 137','DROP',null,6); $it->add('INPUT','-p UDP -i '.$orange.' --dport 138','DROP',null,6); $it->create('ip6block',null,6); /* Our IP blocker */ $it->add('INPUT','-i '.$purple,'ip6block',null,6); $it->add('FORWARD','-i '.$purple,'ip6block',null,6); $it->add('INPUT','-p TCP --dport 8123','DROP',null,6); $it->add('INPUT','-p TCP --dport 8081','DROP',null,6); $it->add('INPUT','-i '.$green,'ACCEPT',null,6); $it->add('INPUT','-i '.$blue,'ACCEPT',null,6); $it->add('INPUT','-i '.$purple.' -p TCP --dport ! 0:1024','ACCEPT',null,6); $it->add('INPUT','-p ICMPv6','ACCEPT',null,6); /* ICMP = good */ $it->add('INPUT','','LOG',null,6); /* Log and reject all else */ $it->add('INPUT','','DROP',null,6); $it->add('FORWARD','-i '.$green.' -o '.$green,'ACCEPT',null,6); /* Allow packets from green to green */ $it->add('FORWARD','-i '.$orange.' -o '.$green,'ACCEPT',null,6); $it->add('FORWARD','-i '.$orange.' -o blue','ACCEPT',null,6); $it->add('FORWARD','-i '.$orange.' -o '.$orange,'ACCEPT',null,6); $it->add('FORWARD','-i '.$green.' -o '.$orange,'ACCEPT',null,6); $it->add('FORWARD','-i '.$green.' -o blue','ACCEPT',null,6); $it->add('FORWARD','-i blue -o '.$green,'ACCEPT',null,6); $it->add('FORWARD','-i blue -o '.$orange,'ACCEPT',null,6);/* $it->add('FORWARD','-i '.$green.' -o '.$yellow,'ACCEPT',null,6); $it->add('FORWARD','-i '.$orange.' -o '.$yellow,'ACCEPT',null,6); $it->add('FORWARD','-i '.$yellow.' -o '.$green.' -m state --state ESTABLISHED,RELATED','ACCEPT',null,6); $it->add('FORWARD','-i '.$yellow.' -o '.$orange,'ACCEPT',null,6);*/ $it->add('FORWARD','-o '.$purple,'ACCEPT',null,6); $it->add('FORWARD','-i '.$purple,'ACCEPT',null,6);// $it->add('FORWARD','-p TCP','ACCEPT',null,6); $it->add('FORWARD','-p ICMPv6 -o '.$purple,'ACCEPT',null,6); /* ICMP = good */ $it->add('FORWARD','-p ICMPv6 -i '.$purple,'ACCEPT',null,6); /* ICMP = good */ $it->add('FORWARD','','LOG',null,6); /* Log and reject all else */ $it->add('FORWARD','','DROP',null,6);/* $it->add('INPUT','','LOG --log-prefix="INPUT6: "',null,6); $it->add('INPUT','-i '.$green,'ACCEPT',null,6); $it->add('INPUT','-i '.$orange,'ACCEPT',null,6); $it->add('INPUT','-i '.$yellow,'ACCEPT',null,6); $it->add('INPUT','','LOG --log-prefix="INPUT6 DENY: "',null,6); $it->add('FORWARD','','LOG --log-prefix="FORWARD6: "',null,6); $it->add('FORWARD','-i '.$green,'ACCEPT',null,6); $it->add('FORWARD','-o '.$green,'ACCEPT',null,6); $it->add('FORWARD','-i '.$orange,'ACCEPT',null,6); $it->add('FORWARD','-o '.$orange,'ACCEPT',null,6); $it->add('FORWARD','-i '.$yellow,'ACCEPT',null,6); $it->add('FORWARD','-o '.$yellow,'ACCEPT',null,6); $it->add('FORWARD','','LOG --log-prefix="FORWARD6 DENY: "',null,6); $it->add('OUTPUT','','LOG --log-prefix="OUTPUT6: "',null,6);*/ system($php.' '.$_SERVER['argv'][0].' ip6block'); } elseif ($arg == 'ip6block') { $it->flush('ip6block',null,6); $data = file('/etc/router/ip6block'); foreach ($data as $ip) { $ip = str_replace(array("\n","\r"),'',$ip); if ($ip{0} != '#') { $it->add('ip6block','-s '.$ip,'DROP',null,6); } } } elseif ($arg == 'ipblock') { $it->flush('ipblock'); $data = file('/etc/router/ipblock'); foreach ($data as $ip) { $ip = str_replace(array("\n","\r"),'',$ip); if ($ip{0} != '#') { $it->add('ipblock','-s '.$ip,'DROP'); } } } elseif ($arg == 'guardian') { $it->flush('guardian'); $data = file('/etc/router/guardian'); foreach ($data as $ip) { $ip = str_replace(array("\n","\r"),'',$ip); if($ip{0} != '#') {// $it->add('guardian','-s '.$ip,'LOG --log-prefix="GUARDIAN: "'); $it->add('guardian','-s '.$ip,'DROP'); } } } elseif ($arg == 'xtaccess') { $it->flush('xtaccess'); $data = file('/etc/router/xtaccess'); foreach ($data as $line) { $line = str_replace(array("\n","\r"),'',$line); if ($line{0} != '#') { $x = explode(',',$line); if (isset($x[2]) and $x[2]) { $it->add('xtaccess','-i '.$red.' -p '.$x[0] .' -s '.$x[1].' --destination-port '.$x[2],'ACCEPT'); } else { $it->add('xtaccess','-i '.$red.' -p '.$x[0] .' -s '.$x[1],'ACCEPT'); } } } } elseif ($arg == 'advnet') { $it->flush('advnet'); $data = file('/etc/router/advnet'); foreach ($data as $line) { $line = str_replace(array("\n","\r"),'',$line); if ($line{0} != '#') { $x = explode('=',$line); $advnet[$x[0]] = $x[1]; } } file_put_contents('/proc/sys/net/ipv4/icmp_echo_ignore_all',$advnet['noping']); if ($advnet['noigmp'] == 1) { $it->add('advnet','-p IGMP','DROP'); } if ($advnet['nomulticast'] == 1) { $it->add('advnet','-d 224.0.0.0/4','DROP'); } } elseif ($arg == 'portfw') { $it->flush('portfw'); $it->flush('portfw_pre','nat'); $it->flush('portfw_post','nat'); $data = file('/etc/router/port_forwards'); foreach ($data as $line) { $line = str_replace(array("\n","\r"),'',$line); if (!($line{0} == '#')) { $x = explode(',',$line); $order = $x[0]; $srciface = $x[1]; $srcipmac = $x[2]; $locport = $x[3]; $destiface = $x[4]; $destipmac = $x[5]; $destport = $x[6]; $protocol = $x[7]; $target = $x[8]; $enabled = $x[9]; if ($enabled == 'on') { $origdestport = $destport; if ($destport == 0) { $destport = $locport; } if (strstr($srcipmac, ':')) { $srcipmacfull = '-m mac --mac-source '.$srcipmac; } else { $srcipmacfull = '-s '.$srcipmac; }// if ((!strstr($locport,':')) || (($origdestport != 0) && ($destport != 0))) { if (($protocol != 'all') && (!(strstr($locport,':')) || ($origdestport == 0) && ($destport == 0))) { $destdouble = $destipmac.':'.$destport; } else { $destdouble = $destipmac; } if ($destport == 0) { if ($srciface == 'any') { if ($destiface == 'any') { $cmd = '-p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac; } else { $cmd = '-o '.$destiface.' -p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac; } } else { if ($destiface == 'any') { $cmd = '-i '.$srciface.' -p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac; } else { $cmd = '-i '.$srciface.' -o '.$destiface.' -p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac; } } } else { if ($srciface == 'any') { if ($destiface == 'any') { $cmd = '-p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac.' --dport '.$destport; } else { $cmd = '-o '.$destiface.' -p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac.' --dport '.$destport; } } else { if ($destiface == 'any') { $cmd = '-i '.$srciface.' -p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac.' --dport '.$destport; } else { $cmd = '-i '.$srciface.' -o '.$destiface.' -p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac.' --dport '.$destport; } } } $it->add('portfw',$cmd,$target); if ($srciface == $red) { $srcifaceipmac = $redip; if ($locport == 0) { $cmd = '-p '.$protocol.' '.$srcipmacfull.' -d '.$srcifaceipmac; } else { $cmd = '-p '.$protocol.' '.$srcipmacfull.' -d '.$srcifaceipmac.' --dport '.$locport; } $it->add('portfw_pre',$cmd,'DNAT --to '.$destdouble,'nat'); } else { if (!strstr($destipmac,'0.0.0.0/0')) { if ($locport == 0) { $cmd = '-p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac; } else { $cmd = '-p '.$protocol.' '.$srcipmacfull.' -d '.$destipmac.' --dport '.$locport; } $it->add('portfw_pre',$cmd,'DNAT --to '.$destdouble,'nat'); } } } } } $it->add('portfw','-m state --state NEW -o '.$red,'ACCEPT'); } else { $it->xflush(); /* flush the firewall */ $it->def('INPUT','ACCEPT'); /* Set defaults */ $it->def('FORWARD','DROP'); $it->def('OUTPUT','ACCEPT'); }?>