Skip to content

Commit 5c7e3b7

Browse files
author
ivr
committed
third commit
1 parent 609ce16 commit 5c7e3b7

File tree

4 files changed

+305
-0
lines changed

4 files changed

+305
-0
lines changed

‎firewall

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
#!/bin/sh
2+
#
3+
# 1.1 Internet Configuration.
4+
#
5+
6+
INET_IP="188.127.232.218"
7+
INET_IFACE="eth1"
8+
INET_BROADCAST="188.127.232.255"
9+
10+
#
11+
# 1.2 Local Area Network configuration.
12+
#
13+
14+
LAN_IP="10.4.2.4"
15+
LAN_IP_RANGE="10.0.0.0/8"
16+
LAN_IFACE="eth0"
17+
18+
19+
LO_IFACE="lo"
20+
LO_IP="127.0.0.1"
21+
22+
VPN_IFACE='tun0'
23+
VPN_IP='10.197.0.1'
24+
VPN_IP_RANGE='10.197.0.0/16'
25+
VPN_REMOTE_RENGE='172.16.0.0/12'
26+
#
27+
# 1.5 IPTables Configuration.
28+
#
29+
30+
IPTABLES="/sbin/iptables"
31+
32+
######
33+
# 4.1 Filter table
34+
#
35+
36+
#
37+
# 4.1.1 Set policies
38+
#
39+
40+
$IPTABLES -P INPUT DROP
41+
$IPTABLES -P OUTPUT DROP
42+
$IPTABLES -P FORWARD DROP
43+
44+
#
45+
# Create chain for bad tcp packets
46+
#
47+
48+
$IPTABLES -N bad_tcp_packets
49+
50+
#
51+
# Create separate chains for ICMP, TCP and UDP to traverse
52+
#
53+
54+
$IPTABLES -N allowed
55+
$IPTABLES -N tcp_packets
56+
$IPTABLES -N udp_packets
57+
$IPTABLES -N icmp_packets
58+
59+
#
60+
# bad_tcp_packets chain
61+
#
62+
63+
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \
64+
-m state --state NEW -j REJECT --reject-with tcp-reset
65+
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
66+
--log-prefix "New not syn:"
67+
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
68+
69+
#
70+
# allowed chain
71+
#
72+
73+
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
74+
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
75+
$IPTABLES -A allowed -p TCP -j DROP
76+
77+
#
78+
# TCP rules allowed TCP incoming connections
79+
#
80+
81+
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 12456 -j allowed
82+
83+
#
84+
# UDP ports
85+
#
86+
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 12457 -j ACCEPT
87+
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 1194 -j ACCEPT
88+
89+
#
90+
# ICMP rules
91+
#
92+
93+
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
94+
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
95+
96+
#
97+
# 4.1.4 INPUT chain
98+
#
99+
100+
#
101+
# Bad TCP packets we don't want.
102+
#
103+
104+
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
105+
106+
#
107+
# Rules for special networks not part of the Internet
108+
#
109+
110+
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
111+
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
112+
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
113+
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
114+
$IPTABLES -A INPUT -p ALL -i $VPN_IFACE -s $VPN_IP_RANGE -j ACCEPT
115+
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $VPN_IP_RANGE -j ACCEPT
116+
$IPTABLES -A INPUT -p ALL -i $VPN_IFACE -s $VPN_REMOTE_RENGE -j ACCEPT
117+
#
118+
# Rules for incoming packets from the internet.
119+
#
120+
121+
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
122+
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
123+
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
124+
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
125+
126+
127+
#
128+
# Log weird packets that don't match the above.
129+
#
130+
131+
#$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
132+
#--log-level DEBUG --log-prefix "IPT INPUT packet died: "
133+
134+
#
135+
# 4.1.5 FORWARD chain
136+
#
137+
138+
#
139+
# Bad TCP packets we don't want
140+
#
141+
142+
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
143+
144+
#
145+
# Accept the packets we actually want to forward
146+
#
147+
$IPTABLES -A FORWARD -i $VPN_IFACE -j ACCEPT
148+
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
149+
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
150+
151+
#
152+
# Log weird packets that don't match the above.
153+
#
154+
155+
#$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
156+
#--log-level DEBUG --log-prefix "IPT FORWARD packet died: "
157+
158+
#
159+
# 4.1.6 OUTPUT chain
160+
#
161+
162+
#
163+
# Bad TCP packets we don't want.
164+
#
165+
166+
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
167+
168+
#
169+
# Special OUTPUT rules to decide which IP's to allow.
170+
#
171+
172+
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
173+
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
174+
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
175+
$IPTABLES -A OUTPUT -p ALL -s $VPN_IP -j ACCEPT
176+
177+
#
178+
# Log weird packets that don't match the above.
179+
#
180+
181+
#$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
182+
#--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
183+
184+
######
185+
# 4.2 nat table
186+
#
187+
188+
189+
#
190+
# Enable simple IP Forwarding and Network Address Translation
191+
#
192+
193+
$IPTABLES -t nat -A POSTROUTING -o $LAN_IFACE -j SNAT --to-source $LAN_IP
194+
#
195+
# 4.2.6 OUTPUT chain
196+
#
197+
198+
######
199+
# 4.3 mangle table
200+
#
201+
202+
###########################################################################
203+
#
204+
# 3. /proc set up.
205+
#
206+
207+
#
208+
# 3.1 Required proc configuration
209+
#
210+
211+
#echo "1" > /proc/sys/net/ipv4/ip_forward
212+

‎image-updater.sh

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
3+
chck_alive ()
4+
{
5+
if ping -c 1 -W 3 $1 &>/dev/null ; then
6+
return 0
7+
else
8+
return 1
9+
fi
10+
}
11+
12+
declare -r image_name=$1
13+
declare -r OIFS=$IFS
14+
declare -r script_name="$0"
15+
declare -r script_dir="$( cd -P "$( dirname "$script_name" )" && pwd )"
16+
17+
[[ -f "/srv/http/img/${image_name}" ]] || echo "file not found /srv/http/img/${image_name}"
18+
19+
sed -n '/#START_CLIENT_SUBNETS#/,/#END_CLIENT_SUBNETS#/p' /etc/openvpn/server.conf | \
20+
grep -v "CLIENT_SUBNETS" | \
21+
while read -r line ; do
22+
net_ip=$(echo $line | awk '{print $2}')
23+
IFS='.' ; ip_arr=($net_ip) ; IFS=$OIFS
24+
(( ++ip_arr[3] ))
25+
rout_ip=172.${ip_arr[1]}.${ip_arr[2]}.${ip_arr[3]}
26+
if chck_alive $rout_ip ; then
27+
echo -e "router $rout_ip is alive \n\n"
28+
#scp "/srv/http/img/${image_name}" "root@${rout_ip}:/mnt/rootfs.squashfs"
29+
else
30+
echo -e "router $rout_ip is down \n\n"
31+
fi
32+
done
33+
exit

‎ntp-time.sh

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
export lim=5
4+
5+
server1='0.ru.pool.ntp.org'
6+
server2='1.ru.pool.ntp.org'
7+
server3='2.ru.pool.ntp.org'
8+
server4='3.ru.pool.ntp.org'
9+
10+
until ntpdate $server1 || ntpdate $server2 || ntpdate $server3 || ntpdate $server4
11+
do
12+
(( lim = $lim - 1 ))
13+
if (( $lim == 0 ))
14+
then
15+
break
16+
fi
17+
sleep 5
18+
done
19+
20+
exit 0
21+

‎speed-test.sh

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/bash
2+
3+
#program takes an address of the network and checks the speed on the first 20 network addresses.
4+
5+
###########
6+
#functions#
7+
8+
function valid_ip () {
9+
IFS='.' ; ip=($1) ; IFS=$OIFS
10+
if (( ip[0] == 172 && ip[1] >= 16 && ip[1] <= 31 && ip[2] >= 0 && ip[2] <= 255 && ( ip[3] == 0 || ip[3] == 128 ) )) ; then
11+
return 0
12+
else
13+
return 1
14+
fi
15+
}
16+
17+
OIFS=$IFS
18+
NET_IP=$1
19+
US_MES="usage: speed-test 172.16.5.0
20+
valid ip address is 172.16 - 31.0 - 255.0|128"
21+
22+
#validation ip address
23+
if ! valid_ip $NET_IP ; then
24+
echo "bad ip address $NET_IP"
25+
echo "$US_MES"
26+
exit 1;
27+
fi
28+
29+
IFS='.' ; ip=($NET_IP) ; IFS=$OIFS
30+
(( ip[3] += 3 ))
31+
(( host_max = ip[3] + 124 ))
32+
fping -g "${ip[0]}.${ip[1]}.${ip[2]}.${ip[3]}" "${ip[0]}.${ip[1]}.${ip[2]}.$host_max" 2>&1 | grep alive | sed 's/ is alive//g' > /tmp/$$.tmp
33+
34+
for i in $(cat /tmp/$$.tmp | head -n 3) ; do
35+
echo "testing speed: $i"
36+
iperf -c $i -p 12458
37+
echo ; echo ; echo "############################"
38+
done
39+
exit 0

0 commit comments

Comments
 (0)