"Fossies" - the Fresh Open Source Software Archive

Member "aif-2.1.1/share/arno-iptables-firewall/plugins/50dsl-ppp-modem.plugin" (16 Sep 2020, 7887 Bytes) of package /linux/privat/aif-2.1.1.tar.gz:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file. See also the latest Fossies "Diffs" side-by-side code changes report for "50dsl-ppp-modem.plugin": 2.1.0_vs_2.1.1.

    1 # ------------------------------------------------------------------------------
    2 #         -= Arno's Iptables Firewall(AIF) - (A)DSL PPP Modem plugin =-
    3 #
    4 PLUGIN_NAME="(A)DSL PPP Modem plugin"
    5 PLUGIN_VERSION="1.0g"
    6 PLUGIN_CONF_FILE="dsl-ppp-modem.conf"
    7 #
    8 # Last changed          : October 20, 2011
    9 # Requirements          : aif 1.9.2i+ & kernel 2.6 & iptable_nat & ip_nat & ipt_MASQUERADE
   10 # Comments              : This implements support for (A)DSL PPP modems
   11 #
   12 # Author                : (C) Copyright 2008-2011 by Arno van Amersfoort
   13 # Homepage              : https://rocky.eld.leidenuniv.nl/
   14 # Email                 : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l
   15 #                         (note: you must remove all spaces and substitute the @ and the .
   16 #                         at the proper locations!)
   17 # ------------------------------------------------------------------------------
   18 # This program is free software; you can redistribute it and/or
   19 # modify it under the terms of the GNU General Public License
   20 # version 2 as published by the Free Software Foundation.
   21 #
   22 # This program is distributed in the hope that it will be useful,
   23 # but WITHOUT ANY WARRANTY; without even the implied warranty of
   24 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   25 # GNU General Public License for more details.
   26 #
   27 # You should have received a copy of the GNU General Public License
   28 # along with this program; if not, write to the Free Software
   29 # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
   30 # ------------------------------------------------------------------------------
   31 
   32 # Plugin start function
   33 plugin_start()
   34 {
   35   echo "${INDENT}Applying rules for (A)DSL modem on interface: $MODEM_IF"
   36 
   37   if [ -n "$MODEM_IF_IP" ]; then
   38     echo "${INDENT}Setting up (antispoof) MODEM net: $MODEM_IF_IP/24"
   39 
   40     # Anti spoof protection for the modem net
   41     #########################################
   42     ip4tables -A SPOOF_CHK ! -i $MODEM_IF -s "$MODEM_IF_IP/24" \
   43         -m limit --limit 3/m -j LOG --log-level $LOGLEVEL --log-prefix "AIF:Spoofed (MODEM) packet: "
   44     ip4tables -A SPOOF_CHK ! -i $MODEM_IF -s "$MODEM_IF_IP/24" -j DROP
   45   fi
   46 
   47   # Create & flush our modem chain
   48   ip4tables -N MODEM_CHAIN 2>/dev/null
   49   ip4tables -F MODEM_CHAIN
   50   ip4tables -N MODEM_CHAIN_HOOK 2>/dev/null
   51   ip4tables -F MODEM_CHAIN_HOOK
   52 
   53 
   54   # This is only used if you have a (A)DSL modem using ppp (connected to an
   55   # ethernet interface)
   56   #########################################################################
   57   if [ -n "$MODEM_IF_IP" ]; then
   58     if [ -n "$MODEM_IP" ]; then
   59       echo "${INDENT}Using MODEM IP $MODEM_IP"
   60 
   61       # Only allow traffic from the MODEM (check IP) to this machine
   62       ##############################################################
   63       ip4tables -A MODEM_CHAIN -s $MODEM_IP -d $MODEM_IF_IP -j ACCEPT
   64     else
   65       # Only allow traffic from the MODEM (no IP, so no checking) to this machine
   66       ###########################################################################
   67       ip4tables -A MODEM_CHAIN -d $MODEM_IF_IP -j ACCEPT
   68     fi
   69   elif [ -n "$MODEM_IP" ]; then
   70     echo "${INDENT}Using MODEM IP $MODEM_IP"
   71 
   72     # Only allow traffic from the MODEM (check IP) to this machine
   73     ##############################################################
   74     ip4tables -A MODEM_CHAIN -s $MODEM_IP -j ACCEPT
   75   else
   76     # Only allow traffic from the MODEM (no IP, so no checking) to this machine
   77     ###########################################################################
   78     ip4tables -A MODEM_CHAIN -j ACCEPT
   79   fi
   80 
   81   # Allow DHCP packets
   82   ip4tables -A MODEM_CHAIN -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j ACCEPT
   83   
   84   # Everything else is logged & dropped
   85   ip4tables -A MODEM_CHAIN \
   86     -m limit --limit 1/s -j LOG --log-level $LOGLEVEL --log-prefix "AIF:Dropped MODEM packet: "
   87   ip4tables -A MODEM_CHAIN -j DROP
   88   
   89   IFS=' ,'
   90   for interface in $MODEM_IF; do
   91     ip4tables -A MODEM_CHAIN_HOOK -i $interface -j MODEM_CHAIN
   92   done
   93 
   94   # Add our MODEM chain hook
   95   ip4tables -A INPUT -j MODEM_CHAIN_HOOK
   96 
   97   # Manage your modemsettings from computers on your LAN. For example with your browser via http://{MODEM_IP}
   98   ###########################################################################################################
   99   if [ -n "$MODEM_IP" -a -n "$MODEM_INTERNAL_NET" ]; then
  100     echo "${INDENT}Enabling (ADSL) modem (@$MODEM_IP) management for hosts(s): $MODEM_INTERNAL_NET"
  101     IFS=' ,'
  102     for net in `ip_range "$MODEM_INTERNAL_NET"`; do
  103       ip4tables -A FORWARD -o $MODEM_IF -s $net -j ACCEPT
  104       ip4tables -t nat -A POSTROUTING -o $MODEM_IF -s $net -d $MODEM_IP -j MASQUERADE
  105     done
  106   fi
  107 
  108   return 0
  109 }
  110 
  111 
  112 # Plugin stop function
  113 plugin_stop()
  114 {
  115   ip4tables -D INPUT -j MODEM_CHAIN_HOOK 2>/dev/null
  116   
  117   ip4tables -F MODEM_CHAIN_HOOK
  118   ip4tables -X MODEM_CHAIN_HOOK 2>/dev/null
  119 
  120   ip4tables -F MODEM_CHAIN
  121   ip4tables -X MODEM_CHAIN 2>/dev/null
  122   
  123   return 0
  124 }
  125 
  126 
  127 # Plugin status function
  128 plugin_status()
  129 {
  130   return 0
  131 }
  132 
  133 
  134 # Check sanity of eg. environment
  135 plugin_sanity_check()
  136 {
  137   if [ -z "$MODEM_IF" ]; then
  138     printf "\033[40m\033[1;31m${INDENT}ERROR: The plugin config file is not properly set!\033[0m\n" >&2
  139     return 1
  140   fi
  141 
  142   # Check whether MODEM_IF exists
  143   ###############################
  144   if ! check_interface $MODEM_IF; then
  145     printf "\033[40m\033[1;31m${INDENT}NOTE: Modem interface \"$MODEM_IF\" does NOT exist (yet?)\033[0m\n" >&2
  146   fi
  147 
  148   # Make sure EXT_IF != MODEM_IF
  149   ##############################
  150   IFS=' ,'
  151   for eif in $EXT_IF; do
  152     if [ "$eif" = "$MODEM_IF" ]; then
  153       printf "\033[40m\033[1;31m${INDENT}ERROR: One or more interfaces specified in EXT_IF is the same as the\033[0m\n" >&2
  154       printf "\033[40m\033[1;31m${INDENT}       MODEM_IF! Please, check the configuration file.\033[0m\n" >&2
  155       return 1
  156     fi
  157   done
  158 
  159   # Make sure INT_IF != MODEM_IF
  160   ##############################
  161   IFS=' ,'
  162   for iif in $INT_IF; do
  163     if [ "$iif" = "$MODEM_IF" ]; then
  164       printf "\033[40m\033[1;31m${INDENT}ERROR: One or more interfaces specified in INT_IF is the same as the one in\033[0m\n" >&2
  165       printf "\033[40m\033[1;31m${INDENT}       MODEM_IF! Please, check the configuration file.\033[0m\n" >&2
  166       return 1
  167     fi
  168   done
  169 
  170   # Make sure MODEM_IF != lo / 127.0.0.1
  171   ######################################
  172   if [ "$MODEM_IF" = "lo" -o "$MODEM_IF" = "127.0.0.1" ]; then
  173     printf "\033[40m\033[1;31m${INDENT}ERROR: The interface specified in MODEM_IF has the address or name of the local\033[0m\n" >&2
  174     printf "\033[40m\033[1;31m${INDENT}       loopback device! Please, check the configuration file.\033[0m\n" >&2
  175     return 1
  176   fi
  177 
  178   return 0
  179 }
  180 
  181 
  182 ############
  183 # Mainline #
  184 ############
  185 
  186 # Check where to find the config file
  187 CONF_FILE=""
  188 if [ -n "$PLUGIN_CONF_PATH" ]; then
  189   CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE"
  190 fi
  191 
  192 # Preinit to success:
  193 PLUGIN_RET_VAL=0
  194 
  195 # Check if the config file exists
  196 if [ ! -f "$CONF_FILE" ]; then
  197   printf "NOTE: Config file \"$CONF_FILE\" not found!\n        Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2
  198 else
  199   # Source the plugin config file
  200   . "$CONF_FILE"
  201 
  202   if [ "$ENABLED" = "1" ] ||
  203      [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] ||
  204      [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then
  205     # Show who we are:
  206     echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION"
  207 
  208     # Increment indention
  209     INDENT="$INDENT "
  210 
  211     # Only proceed if environment ok
  212     if ! plugin_sanity_check; then
  213       PLUGIN_RET_VAL=1
  214     else
  215       case $PLUGIN_CMD in
  216         start|'') plugin_start; PLUGIN_RET_VAL=$? ;;
  217         stop    ) plugin_stop; PLUGIN_RET_VAL=$? ;;
  218         status  ) plugin_status; PLUGIN_RET_VAL=$? ;;
  219         *       ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;;
  220       esac
  221     fi
  222   fi
  223 fi