rendered paste body[root@Lost ~] cat /etc/init.d/rc.firewall
#!/bin/sh
##########################################
#
# Author Olivier GENRE : olivier.genre@efixo.com
#
##########################################
# firewalling
# Separate chains for nat and filter
IPTABLES="/bin/iptables"
LAN_NET="$(net `/bin/nvram get lan_ipaddr` `/bin/nvram get lan_netmask`)"
PPP_IFACE=`/bin/nvram get ppp_ifname`
LAN_BR=`/bin/nvram get lan_ifname`
WAN_BR=`/bin/nvram get wan_ifname`
CHILL_TUN=`/bin/nvram get chilli_tun`
NET_INFRA=`/bin/nvram get net_infra`
logger -s -t firewall -p daemon.info "== $0 $* =="
case "$1" in
prepare)
# INPUT POLICY set to DROP
$IPTABLES -P INPUT DROP
# Accept from known connections
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -N CHILLI_FILTER
$IPTABLES -A INPUT -j CHILLI_FILTER
$IPTABLES -N PPP_FILTER
$IPTABLES -A INPUT -j PPP_FILTER
$IPTABLES -N WAN_FILTER
$IPTABLES -A INPUT -j WAN_FILTER
$IPTABLES -N ACLS_FILTER
$IPTABLES -A INPUT -j ACLS_FILTER
$IPTABLES -N LAN_FILTER
$IPTABLES -A INPUT -j LAN_FILTER
$IPTABLES -N USER_FILTER
$IPTABLES -A FORWARD -j USER_FILTER
$IPTABLES -N CHILLI_FILTER_FW
$IPTABLES -A FORWARD -i $CHILL_TUN -j CHILLI_FILTER_FW
$IPTABLES -t nat -N USER_NAT
$IPTABLES -t nat -A PREROUTING -j USER_NAT
$IPTABLES -t nat -N SYS_NAT
$IPTABLES -t nat -A PREROUTING -j SYS_NAT
;;
PPP|ppp)
$IPTABLES -F PPP_FILTER
#For ICMP it's OK
$IPTABLES -A PPP_FILTER -p icmp --icmp-type 8 -i $PPP_IFACE -j ACCEPT
;;
WAN|wan|dhcp|DHCP)
$IPTABLES -F WAN_FILTER
$IPTABLES -A WAN_FILTER -p icmp --icmp-type 8 -i $WAN_BR -j ACCEPT
# From 9 private network MGCP/RTP, it's OK
$IPTABLES -A WAN_FILTER -i $WAN_BR -p udp -m udp -m state --state NEW --dport 2427 -j ACCEPT
$IPTABLES -A WAN_FILTER -i $WAN_BR -p udp -m udp -m state --state NEW --dport 2727 -j ACCEPT
$IPTABLES -A WAN_FILTER -i $WAN_BR -p udp -m udp -m state --state NEW --dport 53456:63456 -j ACCEPT
;;
LAN|lan)
$IPTABLES -F LAN_FILTER
#From loopback all is Ok !
$IPTABLES -A LAN_FILTER -i lo -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p icmp --icmp-type 8 -i $LAN_BR -j ACCEPT
# DHCP Client from lan
$IPTABLES -A LAN_FILTER -p udp -m udp -i $LAN_BR --dport 67 -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p udp -m udp -i $LAN_BR --dport 68 -m state --state NEW -j ACCEPT
# DNS
$IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 53 -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p udp -m udp -i $LAN_BR -s $LAN_NET --dport 53 -m state --state NEW -j ACCEPT
# Web servers
$IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 80 -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p tcp -m tcp -i $WAN_BR -s $LAN_NET --dport 80 -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p tcp -m tcp -i $WAN_BR -s $LAN_NET --dport 8080 -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 8080 -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p tcp -m tcp -i $WAN_BR -s $LAN_NET --dport 1287 -m state --state NEW -j ACCEPT
$IPTABLES -A LAN_FILTER -p tcp -m tcp -i $LAN_BR -s $LAN_NET --dport 1287 -m state --state NEW -j ACCEPT
;;
ACLS|acls)
$IPTABLES -F ACLS_FILTER
#if [ "$NET_INFRA" != "mediafibre" ]
#then
# STB ACLS
# $IPTABLES -A ACLS_FILTER -i $WAN_BR -p tcp -m tcp -s 172.16.255.253 --dport 80 -m state --state NEW -j ACCEPT
# $IPTABLES -A ACLS_FILTER -i $WAN_BR -p tcp -m tcp -s 172.16.255.253 --dport 8080 -m state --state NEW -j ACCEPT
#else
# $IPTABLES -A ACLS_FILTER -i eth1.2101 -p tcp -m tcp -s 172.16.255.253 --dport 80 -m state --state NEW -j ACCEPT
# $IPTABLES -A ACLS_FILTER -i eth1.2101 -p tcp -m tcp -s 172.16.255.253 --dport 8080 -m state --state NEW -j ACCEPT
#fi
# TELNET ACLS
$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 192.168.0.0/255.255.248.0 --dport 1287 -m state --state NEW -j ACCEPT
$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 192.168.0.0/255.255.248.0 --dport 22 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 212.94.162.0/255.255.255.128 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 80.118.192.64/26 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 80.118.196.0/26 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 10.0.32.0/255.255.224.0 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 84.96.217.0/255.255.255.0 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 86.64.233.0/27 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 84.103.237.176/28 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 84.103.235.176/29 --dport 1287 -m state --state NEW -j ACCEPT
#$IPTABLES -A ACLS_FILTER -p tcp -m tcp -s 86.64.145.176/29 --dport 1287 -m state --state NEW -j ACCEPT
;;
stop)
# $IPTABLES -F PPP_FILTER
# $IPTABLES -X PPP_FILTER
#
# $IPTABLES -F WAN_FILTER
# $IPTABLES -X WAN_FILTER
#
# $IPTABLES -F ACLS_FILTER
# $IPTABLES -X ACLS_FILTER
#
# $IPTABLES -F LAN_FILTER
# $IPTABLES -X LAN_FILTER
#
# $IPTABLES -F USER_FILTER
# $IPTABLES -X USER_FILTER
#
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F
exit 0
;;
*)
echo "Usage: $0 {stop}"
exit 1
;;
esac