## $Id: lan-gateway.conf,v 1.1 2003/10/12 13:43:42 ktsaou Exp $## Configuration file for a LAN router with one ethernet interface (eth0)# for the LAN and a PPP interface for connecting to the Internet.## The LAN works with private IP addresses.## This script will also setup a transparent cache for all the PCs on the# local LAN.# ----------------------------------------------------------------------------# CUSTOM SERVICES# ----------------------------------------------------------------------------# See the section "Adding Services" in the documentation# Example service x, listening on port TCP/z# > server_x_ports="tcp/z"# > client_x_ports="default"server_azureus_ports="tcp/59567 udp/59567"client_azureus_ports="default"server_azureusweb_ports="tcp/6883"client_azureusweb_ports="default"iptables --new PEERGUARDIANiptables -A PEERGUARDIAN -j QUEUE# ----------------------------------------------------------------------------# NETWORK DEFINITIONS - Normally, only these are to be touched by you.# ----------------------------------------------------------------------------# You can define anything you like, assuming you are using it later.# --- HOME ---# The definition of our HOME LAN.HOME_MYIP="10.0.0.7" # The IP on our HOME LANHOME_MYIF="eth0" # The HOME LAN interfaceHOME_BCAST="10.0.255.255" # The HOME LAN broadcastHOME_LAN="10.0.0.0/16" # The HOME LANHOME_SERVICES="all"# Do we run a DHCP server on the HOME LAN?HOME_DHCP=1 # Set to 0 to disable# --- PUBLIC ---# The definition of our PUBLIC interface.PUBLIC_MYIP="" # Leave empty for dynamic IPPUBLIC_MYIF="ppp+" # The public interfacePUBLIC_SERVICES="smtp https ssh imaps azureus azureusweb"# Is the PPP interface a DIAL-ON-DEMAND?DIAL_ON_DEMAND=0 # Set to 0 to disable# --- TRUSTED ---# Hosts in the internet I trust for accessing private services# Empty these to disable.TRUSTED_IPS=""TRUSTED_SERVICES=""# --- TRANSPARENT CACHE ---# Run a transparent cache?SQUID_PORT="" # Leave empty to disable SQUIDSQUID_USERS="squid" # Users to be excluded from the cacheSQUID_EXCLUDE="" # Web Server IPs to be excluded from the cache# --- BLACKLIST ---# A space-separated list of IPs to be blocked.blacklist=""# ----------------------------------------------------------------------------# HELPERS# ----------------------------------------------------------------------------# Block all traffic from/to certain IPsif [ ! -z "${blacklist}" ]then blacklist full "${blacklist}"fi# Setup a transparent squid, only if SQUID_PORT is set.if [ ! -z "${SQUID_PORT}" ]then transparent_squid "${SQUID_PORT}" "${SQUID_USERS}" \ inface "${HOME_MYIF}" src "${HOME_LAN}" \ `test ! -z "${SQUID_EXCLUDE}" && echo "dst not '${SQUID_EXCLUDE}'"`fi# ----------------------------------------------------------------------------# NETWORK ADDRESS TRANSLATION# ----------------------------------------------------------------------------# Change the source/destination of packets...# Should we do SNAT or MASQUERADE?# If there is a PUBLIC_MYIP defined, we should do SNAT, otherwise MASQ.#if [ ! -z "${PUBLIC_MYIP}" ]then snat to "${PUBLIC_MYIP}" \ outface "${PUBLIC_MYIF}" \ src "${HOME_LAN}" dst not "${UNROUTABLE_IPS}"else masquerade "${PUBLIC_MYIF}"fi# To have some public service hit an internal machine, do this:# (the example redirects external port TCP/26 to internal IP 10.0.0.2 port 25)## > dnat to 10.0.0.2:25 \# > inface "${PUBLIC_MYIF}" \# > src not "${HOME_LAN} ${UNROUTABLE_IPS}" \# > proto tcp dport 26## For each such statement, the router at the end has to support it.# ----------------------------------------------------------------------------# PROTECT SELF# ----------------------------------------------------------------------------# Protect the firewall host...# --- HOME ---# Protect us from the HOME LANinterface "${HOME_MYIF}" home src "${HOME_LAN}" dst "${HOME_MYIP} ${HOME_BCAST}" policy reject server "${HOME_SERVICES}" PEERGUARDIAN client all PEERGUARDIAN# DHCP needs 0.0.0.0/255.255.255.255 access.if [ ${HOME_DHCP} -eq 1 ]then interface "${HOME_MYIF}" dhcp server dhcp PEERGUARDIANfi# --- PUBLIC ---# Protect us from the PUBLICinterface "${PUBLIC_MYIF}" internet \ src not "${UNROUTABLE_IPS}" \ `test ! -z "${PUBLIC_MYIP}" && echo "dst '${PUBLIC_MYIP}'"` protection strong policy drop # Are there any trusted PCs/services? if [ ! -z "${TRUSTED_PCS}" -a ! -z "${TRUSTED_SERVICES}" ] then server "${TRUSTED_SERVICES}" PEERGUARDIAN src "${TRUSTED_PCS}" fi server "${PUBLIC_SERVICES}" PEERGUARDIAN client all PEERGUARDIAN# DIAL-ON-DEMAND needs this in case there is a PUBLIC_MYIP defined.if [ ${DIAL_ON_DEMAND} -eq 1 ]then interface "${PUBLIC_MYIF}" dialup client all PEERGUARDIANfi# ----------------------------------------------------------------------------# PROTECT ROUTING# ----------------------------------------------------------------------------# Protect the LAN...# Route traffic for the clients on the LANrouter internet2lan inface "${PUBLIC_MYIF}" outface "${HOME_MYIF}" \ src not "${UNROUTABLE_IPS}" dst "${HOME_LAN}" # route all client traffic client all PEERGUARDIAN # For the dnat example above, this is needed: # > server smtp PEERGUARDIAN dst 10.0.0.2