rendered paste body#!/bin/sh ## This is automatically generated file. DO NOT MODIFY !## Firewall Builder fwb_ipt v2.0.12-1 ## Generated Mon Dec 3 20:56:38 2007 CET by acid## files: * max.fw### bla###PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"export PATH## Prolog script### End of prolog script#log() { echo "$1" test -x "$LOGGER" && $LOGGER -p info "$1"}va_num=1add_addr() { addr=$1 nm=$2 dev=$3 type="" aadd="" L=`$IP -4 link ls $dev | head -n1` if test -n "$L"; then OIFS=$IFS IFS=" /:,<" set $L type=$4 IFS=$OIFS L=`$IP -4 addr ls $dev to $addr | grep inet | grep -v :` if test -n "$L"; then OIFS=$IFS IFS=" /" set $L aadd=$2 IFS=$OIFS fi fi if test -z "$aadd"; then if test "$type" = "POINTOPOINT"; then $IP -4 addr add $addr dev $dev scope global label $dev:FWB${va_num} va_num=`expr $va_num + 1` fi if test "$type" = "BROADCAST"; then $IP -4 addr add $addr/$nm dev $dev brd + scope global label $dev:FWB${va_num} va_num=`expr $va_num + 1` fi fi}getInterfaceVarName() { echo $1 | sed 's/\./_/'}getaddr() { dev=$1 name=$2 L=`$IP -4 addr show dev $dev | grep inet | grep -v :` test -z "$L" && { eval "$name=''" return } OIFS=$IFS IFS=" /" set $L eval "$name=$2" IFS=$OIFS}getinterfaces() { NAME=$1 $IP link show | grep ": $NAME" | while read L; do OIFS=$IFS IFS=" :" set $L IFS=$OIFS echo $2 done}LSMOD="lsmod"MODPROBE="modprobe"IPTABLES="iptables"IPTABLES_RESTORE="iptables-restore"IP="ip"LOGGER="logger"if $IP link ls >/dev/null 2>&1; then echo;else echo "iproute not found" exit 1fiINTERFACES="eth0 "for i in $INTERFACES ; do $IP link show "$i" > /dev/null 2>&1 || { log "Interface $i does not exist" exit 1 }done$IP -4 neigh flush dev eth0 >/dev/null 2>&1$IP -4 addr flush dev eth0 secondary label "eth0:FWB*" >/dev/null 2>&1add_addr 91.121.99.21 24 eth0$IP link set eth0 upMODULE_DIR="/lib/modules/`uname -r`/kernel/net/ipv4/netfilter/" MODULES=`(cd $MODULE_DIR; ls *_conntrack* | sed -n -e 's/\.ko$//p' -e 's/\.o$//p' -e 's/\.ko\.gz$//p' -e 's/\.o\.gz$//p')`for module in $MODULES; do if $LSMOD | grep ${module} >/dev/null; then continue; fi $MODPROBE ${module} || exit 1 donelog 'Activating firewall script generated Mon Dec 3 20:56:38 2007 by acid'$IPTABLES -P OUTPUT DROP$IPTABLES -P INPUT DROP$IPTABLES -P FORWARD DROPip6tables -L -n > /dev/null 2>&1 && { ip6tables -P OUTPUT DROP ip6tables -P INPUT DROP ip6tables -P FORWARD DROP}cat /proc/net/ip_tables_names | while read table; do test "X$table" = "Xmangle" && continue $IPTABLES -t $table -L -n | while read c chain rest; do if test "X$c" = "XChain" ; then $IPTABLES -t $table -F $chain fi done $IPTABLES -t $table -Xdone$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT# # Rule 0 (eth0)# echo "Rule 0 (eth0)"# # # $IPTABLES -N eth0_In_RULE_0$IPTABLES -A INPUT -i eth0 -s 91.65.60.118 -d 91.121.99.21 -m state --state NEW -j eth0_In_RULE_0 $IPTABLES -A eth0_In_RULE_0 -j LOG --log-level info --log-prefix "RULE 0 -- ACCEPT "$IPTABLES -A eth0_In_RULE_0 -j ACCEPT $IPTABLES -N eth0_Out_RULE_0$IPTABLES -A FORWARD -o eth0 -s 91.65.60.118 -d 91.121.99.21 -m state --state NEW -j eth0_Out_RULE_0 $IPTABLES -A eth0_Out_RULE_0 -j LOG --log-level info --log-prefix "RULE 0 -- ACCEPT "$IPTABLES -A eth0_Out_RULE_0 -j ACCEPT # # Rule 1 (eth0)# echo "Rule 1 (eth0)"# # # $IPTABLES -N eth0_In_RULE_1$IPTABLES -A INPUT -i eth0 -p tcp -m tcp --sport 80 -d 91.121.99.21 --dport 80 -m state --state NEW -j eth0_In_RULE_1 $IPTABLES -A eth0_In_RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- ACCEPT "$IPTABLES -A eth0_In_RULE_1 -j ACCEPT # # Rule 0 (global)# echo "Rule 0 (global)"# # # $IPTABLES -N RULE_0$IPTABLES -A INPUT -s 91.121.99.21 -m state --state NEW -j RULE_0 $IPTABLES -A OUTPUT -s 91.121.99.21 -m state --state NEW -j RULE_0 $IPTABLES -A RULE_0 -j LOG --log-level info --log-prefix "RULE 0 -- ACCEPT "$IPTABLES -A RULE_0 -j ACCEPT # # Rule 1 (global)# echo "Rule 1 (global)"# # # $IPTABLES -N RULE_1$IPTABLES -A OUTPUT -j RULE_1 $IPTABLES -A INPUT -j RULE_1 $IPTABLES -A FORWARD -j RULE_1 $IPTABLES -A RULE_1 -j LOG --log-level info --log-prefix "RULE 1 -- DENY "$IPTABLES -A RULE_1 -j DROP ##echo 1 > /proc/sys/net/ipv4/ip_forward## Epilog script## End of epilog script#