##### /etc/init.d/S45firewall #!/bin/sh ## Please make changes in /etc/firewall.user . /etc/functions.sh WAN=$(nvram get wan_ifname) LAN=$(nvram get lan_ifname) ## CLEAR TABLES for T in filter nat; do iptables -t $T -F iptables -t $T -X done iptables -N input_rule iptables -N output_rule iptables -N forwarding_rule iptables -t nat -N prerouting_rule iptables -t nat -N postrouting_rule ### INPUT ### (connections with the router as destination) # base case iptables -P INPUT DROP iptables -A INPUT -m state --state INVALID -j DROP iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP # # insert accept rule or to jump to new accept-check table here # iptables -A INPUT -j input_rule # allow iptables -A INPUT -i \! $WAN -j ACCEPT # allow from lan/wifi interfaces iptables -A INPUT -p icmp -j ACCEPT # allow ICMP iptables -A INPUT -p gre -j ACCEPT # allow GRE # reject (what to do with anything not allowed earlier) iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable ### OUTPUT ### (connections with the router as source) # base case iptables -P OUTPUT DROP iptables -A OUTPUT -m state --state INVALID -j DROP iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # # insert accept rule or to jump to new accept-check table here # iptables -A OUTPUT -j output_rule # allow iptables -A OUTPUT -j ACCEPT #allow everything out # reject (what to do with anything not allowed earlier) iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable ### FORWARDING ### (connections routed through the router) # base case iptables -P FORWARD DROP iptables -A FORWARD -m state --state INVALID -j DROP iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmt iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # # insert accept rule or to jump to new accept-check table here # iptables -A FORWARD -j forwarding_rule # allow iptables -A FORWARD -i br0 -o br0 -j ACCEPT iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT # reject (what to do with anything not allowed earlier) # uses the default -P DROP ### MASQ iptables -t nat -A PREROUTING -j prerouting_rule iptables -t nat -A POSTROUTING -j postrouting_rule iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE ## USER RULES [ -f /etc/firewall.user ] && . /etc/firewall.user [ -e /etc/config/firewall ] && { awk -f /usr/lib/common.awk -f /usr/lib/firewall.awk /etc/config/firewall } ##### /etc/config/firewall # RULE SYNTAX: # # forward::[:] # - forwards all packets matched by to , # optionally changing the port to # # accept: # - accepts all traffic matched by # # drop: # - drops all traffic matched by # # # MATCHING OPTIONS: # # src= # - match the source ip # # dest= # - match the destination ip # # proto= # - match the protocol by name or number # # sport= # - match the source port(s), see below for syntax # # dport= # - match the destination port(s), see below for syntax # # # # PORT SYNTAX: # # You can enter an arbitrary list of ports and port ranges in the following forma # - 22,53,993,1000-1024 # # If you don't set the protocol to tcp or udp, it will apply to both # # # # EXAMPLES: # # drop:dport=22 src=1.3.3.7 # accept:proto=tcp dport=22 # forward:dport=60168:192.168.1.2:60169 ##### /etc/firewall.user #!/bin/sh . /bin/fwlib.sh flush_firewall WAN=$(nvram get wan_ifname) LAN=$(nvram get lan_ifname) IP=$(/sbin/ifconfig ppp0 | awk '/Mask/ { print $2 }' | cut -f2 -d:) #iptables -t nat -A PREROUTING -d $IP -p tcp --dport 80 -j DNAT --to-destination #iptables -t nat -A POSTROUTING -p tcp --dst 10.0.0.5 --dport 80 -j SNAT --to-sou ### Ports accessible on the router from the WAN # allow_port 22 # SSH # allow_port 80 # HTTP # allow_port 465 # HTTPS allow_port 23 allow_port 24 ### Ports accessible to client machines. forward_port 21 refinery forward_port 22 refinery forward_port 25 refinery forward_port 80 refinery change_port 80 10.0.0.1 88 forward_port 143 refinery forward_port 993 refinery forward_port 5079 refinery forward_port 30720 injector # forward a few utility port-ranges to make it easier to deal with # bittorrent configurations and the like #forward_port 6100:6199 refinery forward_port 6100:6111 refinery forward_port 30000:30100 refinery forward_port 6113:6199 refinery forward_port 6200:6299 fuel forward_port 6300:6399 injector forward_port 6112 injector # /usr/lib/qosfw/fw.sh reads and applies the firewalling rules from /etc/config/f #. /usr/lib/qosfw/fw.sh . /usr/lib/qos.sh # IPv6 iptables -A INPUT -p 41 -i $WAN -j ACCEPT ##### /bin/fwlib.sh #!/bin/sh . /etc/functions.sh WAN=$(nvram get wan_ifname) WAN_IP=$(/sbin/ifconfig ppp0 | awk '/Mask/ { print $2 }' | cut -f2 -d:) LAN=$(nvram get lan_ifname) LAN_IP=$(/sbin/ifconfig br0 | awk '/Mask/ { print $2 }' | cut -f2 -d:) flush_firewall () { iptables -F input_rule iptables -F output_rule iptables -F forwarding_rule iptables -t nat -F prerouting_rule iptables -t nat -F postrouting_rule } ### BIG FAT DISCLAIMER ### The "-i $WAN" literally means packets that came in over the $WAN interface; ### this WILL NOT MATCH packets sent from the LAN to the WAN address. allow_port () { ALLOWPORT=$1 iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP iptables -A input_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP } sucky_resolve () { HOSTNAME=$1 ### grep $HOSTNAME /etc/hosts | awk '{ print $1 }' } forward_port() { ALLOWPORT=$1 ALLOWHOSTNAME=$2 ALLOWHOST=`sucky_resolve $ALLOWHOSTNAME` echo "Forwarding $ALLOWPORT to $ALLOWHOSTNAME ( iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j DNAT iptables -A forwarding_rule -i $WAN -p tcp --dport $ALLOWPORT -d $ALLO iptables -t nat -A PREROUTING -d $WAN_IP -p tcp --dport $ALLOWPORT -j DNAT -- iptables -t nat -A POSTROUTING -p tcp --dst $ALLOWHOST --dport $ALLOWPORT -j iptables -t nat -A prerouting_rule -i $WAN -p udp --dport $ALLOWPORT -j DNAT iptables -A forwarding_rule -i $WAN -p udp --dport $ALLOWPORT -d $ALLO iptables -t nat -A PREROUTING -d $WAN_IP -p udp --dport $ALLOWPORT -j DNAT -- iptables -t nat -A POSTROUTING -p udp --dst $ALLOWHOST --dport $ALLOWPORT -j } change_port() { ALLOWPORT=$1 ALLOWHOSTNAME=$2 NEWPORT=$3 ALLOWHOST=`sucky_resolve $ALLOWHOSTNAME` echo "Forwarding $ALLOWPORT to $ALLOWHOSTNAME ( iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j DNAT iptables -A forwarding_rule -i $WAN -p tcp --dport $ALLOWPORT -d $ALLO iptables -t nat -A PREROUTING -d $WAN_IP -p tcp --dport $ALLOWPORT -j DNAT -- iptables -t nat -A POSTROUTING -p tcp --dst $ALLOWHOST --dport $ALLOWPORT -j iptables -t nat -A prerouting_rule -i $WAN -p udp --dport $ALLOWPORT -j DNAT iptables -A forwarding_rule -i $WAN -p udp --dport $ALLOWPORT -d $ALLO iptables -t nat -A PREROUTING -d $WAN_IP -p udp --dport $ALLOWPORT -j DNAT -- iptables -t nat -A POSTROUTING -p udp --dst $ALLOWHOST --dport $ALLOWPORT -j iptables -t NAT -A prerouting_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP iptables -A input_rule -i $WAN -p tcp --dport $ALLOWPORT -j ACCEP } register_dmz () { ALLOWHOSTNAME=$1 DMZHOST=`sucky_resolve $ALLOWHOSTNAME` iptables -t nat -A prerouting_rule -i $WAN -j DNAT --to $DMZHOST iptables -A forwarding_rule -i $WAN -d $DMZHOST -j ACCEPT }