#!/bin/sh
#********************************************************************#
# Firewall for dindingapi Hotspot #
# 2007 #
#********************************************************************#
#********************************************************************#
# Subroutine change printk colour #
# #
#********************************************************************#

RESET=" ]R"

CRE="
[K"

CLEAR=" c"
# Normal colour
NORMAL=" [0;39m"
# RED
RED=" [1;31m"
# GREEN
GREEN=" [1;32m"
# YELLOW
YELLOW=" [1;33m"
# BLUE
BLUE=" [1;34m"
# MAGENTA
MAGENTA=" [1;35m"
# CYAN
CYAN=" [1;36m"
# BOLD WHITE
WHITE=" [1;37m"
#********************************************************************#
# root only can run this script #
#********************************************************************#
if [ $(id -u) != 0 ]; then
echo "${RED}Ralat${NORMAL}: ${YELLOW}You have to log in as root using sudo to run this firewall script!${NORMAL}"
exit 1
fi
#********************************************************************#
# Variable Firewall #
# #
#********************************************************************#
#path utitliti
MODPROBE="/sbin/modprobe"
IPTABLES="/sbin/iptables"
SYSCTL="/sbin/sysctl"
#interface connection to the internet. Please refer to ifconfig.
INET_IP="192.168.1.3" #interface that connecting to the net normally use eth0 (lan0 for kanotix)
INET_DEV="eth0"
#interface connection to the WLan. Please refer to ifconfig.
WIFI_IP="10.1.1.1" #wificard that connectind to WLAN.
WIFI_WLAN="10.1.1.0/24" #IP range that will be use by client
WIFI_DEV="ath0" #change to eth1 or lan1(kanotix) if using AP or switch
#IP DNS server ISP - Streamyx. Change if the ISP differ from this.
NS1="202.188.0.133"
NS2="202.188.1.5"
#Open the port that can access to the internet. Must use port that can be access.
PORT_INET="22 80"
#Open the port that can access to the Wlan. Only cab be access by client.
PORT_WLAN="20 21 22 25 139 143 110"
#optional tarpit for that who have kernel with tarpit module.
PORT_TARPIT="8080 23"
#optional layer7 matching bagi yang mempunyai kernel dgn layer7 module serta iptables patch dengan #layer7. Ubah atau tambah sendiri. Sila rujuk protocol definitoins. Tujuan untuk block client.
LAYER7="aim aimwebcontent ares bittorrent directconnect edonkey fasttrack gnutella irc jabber msnmessenger msn-filetransfer napster openft rtsp shoutcast soulseek yahoo httpvideo quicktime"
#********************************************************************#
# Info how to use firewall script #
# #
#********************************************************************#
usage()
{
echo "${GREEN}How to use${NORMAL}:"
echo "$0 ${RED}start${NORMAL}" "- (start firewall)"
echo "$0 ${RED}restart${NORMAL}" "- (same as start firewall)"
echo "$0 ${RED}stop${NORMAL}" "- (stop and delete all rules/chains firewall)"
echo "$0 ${RED}clear${NORMAL}" "- (same as stop; delete all rules/chains firewall)"
echo "$0 ${RED}test${NORMAL}" "- (only for testing the firewall, rules and chains will be deleted after the test)"
echo "$0 ${RED}status${NORMAL}" "- (firewall status: ${YELLOW}status umum${NORMAL}, ${YELLOW}status mangle${NORMAL}, ${YELLOW}status nat${NORMAL}, ${YELLOW}status filter${NORMAL}, ${YELLOW}status auth${NORMAL})"
echo "$0 ${RED}status auth${NORMAL}" "- (client and server status)"
echo "$0 ${RED}addClient IP MAC${NORMAL}" "- (add IP and MAC client.${YELLOW}must insert IP and MAC${NORMAL})"
echo "$0 ${RED}delClient IP MAC${NORMAL}" "- (delete IP and MAC client. ${YELLOW}must insert IP and MAC${NORMAL})"
echo "$0 ${RED}addServer IP${NORMAL}" "- (add AP server if needed. ${YELLOW}Insert IP only${NORMAL} #optional)"
echo "$0 ${RED}delServer IP${NORMAL}" "- (delete AP server. ${YELLOW}Insert IP only${NORMAL} #optional}"
exit 1;
}
usage_addclient()
{
echo "${GREEN}How to use${NORMAL}:"
echo "$0 ${RED}addClient IP MAC${NORMAL}"
echo "${GREEN}Example${NORMAL}: ${YELLOW}$0 addClient 10.1.1.200 00:40:C3:B1:AB:1F${NORMAL}"
echo "${GREEN}Explanation${NORMAL}: ${YELLOW}IP = client ip that are allow to login."
echo " MAC = MAC Address/HWaddr of the client ip.${NORMAL}"
exit 1;
}
usage_delclient()
{
echo "${GREEN}How to use${NORMAL}:"
echo "$0 ${RED}delClient IP MAC${NORMAL}"
echo "${GREEN}Example${NORMAL}: ${YELLOW}$0 delClient 10.1.1.200 00:40:C3:B1:AB:1F${NORMAL}"
echo "${GREEN}Explanation${NORMAL}: ${YELLOW}IP = client ip that are allow to login."
echo " MAC = MAC Address/HWaddr of the client ip.${NORMAL}"
exit 1;
}
usage_addserver()
{
echo "${GREEN}How to use${NORMAL}:"
echo "$0 ${RED}addServer IP${NORMAL}"
echo "${GREEN}Example${NORMAL}: ${YELLOW}$0 addServer 10.1.1.2${NORMAL}"
echo "${GREEN}Explanation${NORMAL}: ${YELLOW}IP = ip WIFI server or ip AP.${NORMAL}"
exit 1;
}
usage_delserver()
{
echo "${GREEN}How to use${NORMAL}:"
echo "$0 ${RED}delServer IP${NORMAL}"
echo "${GREEN}Example${NORMAL}: ${YELLOW}$0 delServer 10.1.1.2${NORMAL}"
echo "${GREEN}Explanation${NORMAL}: ${YELLOW}IP = ip WIFI server or ip AP.${NORMAL}"
exit 1;
}
#********************************************************************#
# Subroutine for flush firewall #
#********************************************************************#
clear () {
echo -n "${MAGENTA}Delete all rules and chains${NORMAL} "
$IPTABLES -F
$IPTABLES -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
$IPTABLES -A FORWARD -j ACCEPT $IPTABLES -t nat -A POSTROUTING -o
$INET_DEV -j MASQUERADE
echo "${GREEN}.......Ok${NORMAL}"
}
#********************************************************************#
# Load all modules for creating firewall #
#********************************************************************#
loadmod() {
for mod in ip_tables ip_conntrack ip_conntrack_ftp iptable_nat ip_nat_ftp ipt_MASQUERADE ipt_LOG ipt_ULOG
do
$MODPROBE $mod
echo -n "";
done
echo -n "${MAGENTA}Load semua module yang diperlukan${NORMAL}....."
echo ".${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# Activate filter and IP-forwarding #
#********************************************************************#
setfilter() {
# Activate IP Forwarding, (If did not activate yet)
echo -n "${MAGENTA}Activate IP forwarding${NORMAL} ...."
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "..${GREEN}Ok${NORMAL}"
# Activate broadcast echo guard
echo -n "${MAGENTA}Activate basic guard${NORMAL} ...."
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Activate bad error message guard
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Activate IP spoofing guard
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
# Delete ICMP Redirect Acceptance
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $f
done
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
echo 0 > $f
done
# Delete Source Routed Packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $f
done
# Log Spoofed Packets, Source Routed Packets, Redirect Packets
for f in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 1 > $f
done
echo "..${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# Activate DoS attack guard #
#********************************************************************#
dos_prot()
{
echo -n "${MAGENTA}Activate Flood guard${NORMAL} ..."
#Syn-flood guard
$IPTABLES -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
#Furtive port scanner guard
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#ping of death guard
$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
echo "..${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# Activate Ip Spoofing guard #
#********************************************************************#
spoof_prot()
{
echo -n "${MAGENTA}Enable sysctl for ip spoofing guard${NORMAL} .....${YELLOW}"
$SYSCTL "net.ipv4.conf.all.rp_filter"
echo -n "${MAGENTA}Activate Ip Spoofing guard${NORMAL} ..."
SPOOF_IPS="0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3"
$IPTABLES -A INPUT -s $INET_IP -j DROP
for IP in $SPOOF_IPS
do
$IPTABLES -A INPUT -s $IP -j DROP
done
echo "..${GREEN}Ok${NORMAL}"
}
#**********************************************************************#
# Subroutine clear firewall rules #
#**********************************************************************#
clear_rules() {
echo -n "${MAGENTA}Delete all rules${NORMAL}..."
# Flush table
$IPTABLES -F
echo -n "."
# Delete all chains
$IPTABLES -X
echo -n "."
# Flush NAT table
$IPTABLES -t nat -F
echo -n "."
# Flush NAT chains
$IPTABLES -t nat -X
# Flush mangle table
$IPTABLES -t mangle -F
#Flush mangle chains
$IPTABLES -t mangle -X
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
echo -n "..."
echo "${GREEN}Ok${NORMAL}"
}
#**********************************************************************#
# Reject all. #
#**********************************************************************#
reject_all () {
echo -n "${MAGENTA}Reject all${NORMAL} ..."
$IPTABLES -A INPUT -i ! lo -j REJECT
$IPTABLES -A OUTPUT -o ! lo -j REJECT
$IPTABLES -A FORWARD -i ! lo -j REJECT echo -n "..."
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
$IPTABLES -A FORWARD -i lo -j ACCEPT
echo -n "..."
echo "${GREEN}Ok${NORMAL}"
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
}
#********************************************************************#
# Subroutine for input mistake #
#********************************************************************#
fferror()
{
echo
echo "${RED}Ralat setting netfilter: $1${NORMAL}"
echo "${GREEN}Please check IP and MAC ...${NORMAL}"
echo
exit $1
}
#********************************************************************#
# Subroutine for filter #
#********************************************************************#
new_chains()
{ #Create filter chain to receive authenticated clients
echo -n "${MAGENTA}Creating again chains and policy iptables${NORMAL}
...."
$IPTABLES -t filter -N FCLIENT
#Create filter chain to receive website destination that allowed
$IPTABLES -t filter -N FSERVER
#Create filter chain for not rerouting authenticated clients
$IPTABLES -t nat -N DCLIENT
#Create filter chain for not rerouting server that allowed
$IPTABLES -t nat -N DSERVER
#Create filter chain for routing from authenticated clients
$IPTABLES -t nat -N SCLIENT
#create filter chain for routing to allowed servers
$IPTABLES -t nat -N SSERVER
}
#********************************************************************#
# Subroutine untuk policy #
#********************************************************************#
new_policy()
{
#Policy filter default ialah DROP
$IPTABLES -t filter -P INPUT DROP
$IPTABLES -t filter -P OUTPUT DROP
$IPTABLES -t filter -P FORWARD DROP
echo "..${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# Subroutine for traffic #
#********************************************************************#
new_traffic()
{
#Allow all icmp traffic AP<--> WLan
echo -n "${MAGENTA}Allowing all traffic icmp(ping) between AP and WLan${NORMAL} ...."
$IPTABLES -t filter -A INPUT -i $WIFI_DEV -s $WIFI_WLAN -d $WIFI_IP -p icmp -j ACCEPT
$IPTABLES -t filter -A OUTPUT -o $WIFI_DEV -s $WIFI_IP -d $WIFI_WLAN -p icmp -j ACCEPT
echo "..${GREEN}Ok${NORMAL}"
#Allow all icmp traffic eth0<-->Internet
echo -n "${MAGENTA}Allowing all traffic icmp(ping) between $INET_DEV dan Internet${NORMAL} ...."
$IPTABLES -t filter -A INPUT -i $INET_DEV -d $INET_IP -p icmp -j ACCEPT
$IPTABLES -t filter -A OUTPUT -o $INET_DEV -s $INET_IP -p icmp -j ACCEPT
echo "..${GREEN}Ok${NORMAL}"
#Allow all local traffic
echo -n "${MAGENTA}Allow all local traffic${NORMAL} ...."
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
$IPTABLES -A FORWARD -i lo -j ACCEPT
echo "..${GREEN}Ok${NORMAL}"
#Allow all traffic out and in into the internet
echo -n "${MAGENTA}Allowing all traffic internet${NORMAL} ...."
$IPTABLES -A INPUT -i $INET_DEV -j ACCEPT
$IPTABLES -A OUTPUT -o $INET_DEV -j ACCEPT
$IPTABLES -A FORWARD -i $INET_DEV -j ACCEPT
echo "..${GREEN}Ok${NORMAL}"
#Allowing dhcp traffic AP<-->WLan
echo -n "${MAGENTA}Allowing traffic dhcp between AP and WLan, port${NORMAL} :"
$IPTABLES -t filter -A INPUT -i $WIFI_DEV -s 0.0.0.0/0 -d 255.255.255.255 -p udp --dport 67:68 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -o $WIFI_DEV -s $WIFI_IP -d $WIFI_WLAN -p udp --sport 67:68 -j ACCEPT
echo -n " ${YELLOW}67, 68${NORMAL}"
echo "....${GREEN}Ok${NORMAL}"
#Allowing all web traffic AP<-->WLan
echo -n "${MAGENTA}Allowing traffic http and https between AP and WLan, port${NORMAL} :"
for PORT in 80 443; do
echo -n " ${YELLOW}$PORT${NORMAL},"
$IPTABLES -t filter -A INPUT -i $WIFI_DEV -s $WIFI_WLAN -d $WIFI_IP -p tcp --dport $PORT -j ACCEPT
$IPTABLES -t filter -A OUTPUT -o $WIFI_DEV -s $WIFI_IP -d $WIFI_WLAN -p tcp --sport $PORT -j ACCEPT
done
echo "..${GREEN}Ok${NORMAL}"
#Forward dns into WLan
echo -n "${MAGENTA}Forward DNS ISP ke WLan${NORMAL} :"
for NS in $NS1 $NS2; do
echo -n " ${YELLOW}$NS${NORMAL},"
#Allow wifi->dns
$IPTABLES -t filter -A FORWARD -i $WIFI_DEV -o $INET_DEV -s $WIFI_WLAN -d $NS -p udp --dport 53 -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $INET_DEV -o $WIFI_DEV -s $NS -d
$WIFI_WLAN -p udp --sport 53 -j ACCEPT
#enable source network address translation for dns
$IPTABLES -t nat -A POSTROUTING -s $WIFI_WLAN -p udp --dport 53 -d $NS
-o $INET_DEV -j SNAT --to $INET_IP
done
echo "....${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# opening specific port on firewall #
#********************************************************************#
open_port()
{ #Allow specific service from internet
echo -n "${MAGENTA}Open specific port from internet${NORMAL} :"
for PORT in $PORT_INET; do
echo -n " ${YELLOW}$PORT${NORMAL},"
$IPTABLES -t filter -A INPUT -p tcp --dport $PORT -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p tcp --sport $PORT -j ACCEPT
done
echo ".....${GREEN}Ok${NORMAL}"
echo -n "${MAGENTA}Open specific port between AP and WLan${NORMAL} :"
for PORT in $PORT_WLAN; do
echo -n " ${YELLOW}$PORT${NORMAL},"
$IPTABLES -t filter -A INPUT -i $WIFI_DEV -s $WIFI_WLAN -d $WIFI_IP -p tcp --dport $PORT -j ACCEPT
$IPTABLES -t filter -A OUTPUT -o $WIFI_DEV -s $WIFI_IP -d $WIFI_WLAN -p tcp --sport $PORT -j ACCEPT
done
echo "....${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# TARPIT - OPTIONAL - Disable it if did not have #
# module TARPIT on kernel #
#********************************************************************#
enable_tarpit()
{
#Open port for TARPIT/HONEYPOT purpose
echo -n "${MAGENTA}Activating TARPIT on port${NORMAL} :"
for PORT in $PORT_TARPIT; do
$MODPROBE ipt_TARPIT
echo -n " ${YELLOW}$PORT${NORMAL},"
$IPTABLES -A INPUT -p tcp -m tcp --dport $PORT -j TARPIT
#$IPTABLES -A INPUT -p tcp -j TARPIT #uncomment if want other tarpit port that did not use
done
echo ".....${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# Layer7 - OPTIONAL - Disablekan it if did not have #
# module layer7 on kernel #
#********************************************************************#
enable_layer7()
{
#match file according to file type for blocking client purpose
echo -n "${MAGENTA}Blocking file layer${NORMAL} :"
for LAYER in $LAYER7; do
$MODPROBE ipt_layer7
echo -n " ${YELLOW}$LAYER${NORMAL},"
$IPTABLES -t mangle -A POSTROUTING -m layer7 --l7proto $LAYER -j DROP
$IPTABLES -A OUTPUT -m layer7 --l7proto yahoo -s $WIFI_WLAN -j DROP
done
echo ".....${GREEN}Ok${NORMAL}"
}
#********************************************************************#
# Subroutine for authentication module  #
#********************************************************************#
enable_auth()
{
echo -n "${MAGENTA}Activating hotspot authentication module${NORMAL} ...."
#Check for AP-->server that allowed
$IPTABLES -t filter -A FORWARD -i $WIFI_DEV -o $INET_DEV -s $WIFI_WLAN -j FSERVER
#Check for client that allowed --> internet
$IPTABLES -t filter -A FORWARD -i $WIFI_DEV -o $INET_DEV -s $WIFI_WLAN -j FCLIENT
#reject all other client
$IPTABLES -t filter -A FORWARD -i $WIFI_DEV -o $INET_DEV -s $WIFI_WLAN -j REJECT --reject-with icmp-net-prohibited
#Allow established connection,related wifi<->internet
$IPTABLES -t filter -A FORWARD -i $INET_DEV -o $WIFI_DEV -d $WIFI_WLAN -m state --state ESTABLISHED,RELATED -j ACCEPT
#snat traffic from authenticated clients
$IPTABLES -t nat -A POSTROUTING -s $WIFI_WLAN -d ! $WIFI_WLAN -j SCLIENT
$IPTABLES -t nat -A POSTROUTING -s $WIFI_WLAN -d ! $WIFI_WLAN -j SSERVER
#Dont dnat traffic from authenticated client
$IPTABLES -t nat -A PREROUTING -i $WIFI_DEV -d ! $WIFI_IP -j DCLIENT
#Dont dnat web traffic server that allowed 
$IPTABLES -t nat -A PREROUTING -i $WIFI_DEV -d ! $WIFI_IP -j DSERVER
#Allow dnat into AP from all web traffic
for PORT in 80 443; do
$IPTABLES -t nat -A PREROUTING -i $WIFI_DEV -d ! $WIFI_IP -p tcp --dport $PORT -j DNAT --to $WIFI_IP
done
echo "..${GREEN}Ok${NORMAL}"
}
#************************************************************************#
# For log purpose. Disable to avoid screen #
# full with log. Uncomment for enable. #
#************************************************************************#
enable_log()
{
#log all other packets
$IPTABLES -t filter -A INPUT -j LOG --log-level warning --log-prefix " >>INPUT "
$IPTABLES -t filter -A OUTPUT -j LOG --log-level warning --log-prefix " <<OUTPUT "
$IPTABLES -t filter -A FORWARD -j LOG --log-level warning --log-prefix ">>FORWARD>> "
}
#********************************************************************#
# Rule for all reject client that did not login #
#********************************************************************#
reject_client()
{ #add rule REJECT default
for CHAIN in INPUT OUTPUT FORWARD; do
$IPTABLES -t filter -A $CHAIN -j REJECT;
done
}
del_rulenum()
{
$IPTABLES -D FORWARD 1
$IPTABLES -D INPUT 1
$IPTABLES -D OUTPUT 1
}
#********************************************************************#
# Routine Firewall #
#********************************************************************#
start () {
loadmod
clear_rules
reject_all
setfilter
new_chains
new_policy
new_traffic
dos_prot
spoof_prot
open_port
#enable_tarpit #uncoment if did not want to enblekan tarpit. Make sure kernel support tarpit
#enable_layer7 #uncoment if want to enablekan layer7 blocking. Make sure support kernel and iptables
enable_auth
enable_log
reject_client
del_rulenum
}
case "$1" in
start|restart)
#flush and zero all tables
echo "${YELLOW}*--------------------------------------------------*"
echo "* Firewall with hotspot service *"
echo "* dindingapi@2007 *"
echo "*--------------------------------------------------*${NORMAL}"
echo
echo "${YELLOW}Staring hotspot firewall${NORMAL} .............." start
echo "${BLUE}Complete... Congratulation your system guard by firewall !!${NORMAL}"
echo "${GREEN}**System ready for HOTSPOT**${NORMAL}" ;;
#********************************************************************#
# Add client to use firewall #
#********************************************************************#
addClient)
[ "ff"$2 != "ff" ] || usage_addclient; [ "ff"$3 != "ff" ] || usage_addclient;
#allow client
$IPTABLES -t filter -A FCLIENT -s $2 -m mac --mac-source $3 -j ACCEPT || fferror $?
$IPTABLES -t nat -A DCLIENT -s $2 -m mac --mac-source $3 -j ACCEPT || fferror $?
$IPTABLES -t nat -A SCLIENT -s $2 -d ! $WIFI_WLAN -j SNAT --to $INET_IP || fferror $?
echo "Client ditambah: IP $2 MAC $3";
;;
#********************************************************************#
# Delete client using firewall #
#********************************************************************#
delClient)
[ "ff"$2 != "ff" ] || usage_delclient; [ "ff"$3 != "ff" ] || usage_delclient; $IPTABLES -t filter -D FCLIENT -s $2 -m mac --mac-source $3 -j ACCEPT || fferror $?
$IPTABLES -t nat -D DCLIENT -s $2 -m mac --mac-source $3 -j ACCEPT || fferror $?
$IPTABLES -t nat -D SCLIENT -s $2 -d ! $WIFI_WLAN -j SNAT --to $INET_IP || fferror $?
echo "Client dumped: IP $2 MAC $3";
;;
#********************************************************************#
# Add ekxtra server/ap using firewall #
#********************************************************************#
addServer)
[ "ff"$2 != "ff" ] || usage_addserver; $IPTABLES -t filter -A FSERVER -s $WIFI_WLAN -d $2 -j ACCEPT || fferror $?
$IPTABLES -t nat -A DSERVER -s $WIFI_WLAN -d $2 -j ACCEPT || fferror $?
$IPTABLES -t nat -A SSERVER -s $WIFI_WLAN -d $2 -j SNAT --to $INET_IP || fferror $?
echo "Server added: IP $2";
;;
#********************************************************************#
# Delete server/AP using firewall #
#********************************************************************#
delServer)
[ "ff"$2 != "ff" ] || usage_delserver; $IPTABLES -t filter -D FSERVER -s $WIFI_WLAN -d $2 -j ACCEPT || fferror $?
$IPTABLES -t nat -D DSERVER -s $WIFI_WLAN -d $2 -j ACCEPT || fferror $?
$IPTABLES -t nat -D SSERVER -s $WIFI_WLAN -d $2 -j SNAT --to $INET_IP || fferror $?
echo "Server dumped: IP $2";
;;
#********************************************************************#
# Stopped and flush all rules and firewall chains #
#********************************************************************#
stop)
echo "${YELLOW}*-----------------------------------------------------*"
echo "*${BLUE} Stopped firewall with hotspot service${NORMAL}${YELLOW} *"
echo "*-----------------------------------------------------*${NORMAL}"
echo "${CYAN}You do not need to STOP firewall, clear only !${NORMAL}"
clear
echo "${RED}Complete... BEWARE your system did not guard by firewall anymore !${NORMAL}"
;; clear)
echo "${CYAN}*-----------------------------------------------*"
echo "* Delete all firewall chains dan rules *"
echo "*-----------------------------------------------*${NORMAL}"
clear
echo "${RED}Complete ....BEWARE your system did not guard by firewall !!${NORMAL}"
;;
test)
echo "${YELLOW}*--------------------------------------------------*"
echo "* ${BLUE}For testing firewall puspose only${NORMAL}${YELLOW} *"
echo "* ${BLUE}Firewall stopped when settle${NORMAL}${YELLOW} *"
echo "*--------------------------------------------------*${NORMAL}"
date;start;date;sleep 10;clear;date
;;
#********************************************************************#
# Pelbagai status firewall. Samada secara asing atau gabungan #
#********************************************************************#
status)
echo "${YELLOW}*-----------------------------------------------*"
echo "* Firewall Status with hotspot service *"
echo "*-----------------------------------------------*${NORMAL}"
echo
case "$2" in
umum)
echo "${CYAN}* UMUM *"
echo "====================================================="
$IPTABLES -nv -L
echo "=====================================================${NORMAL}"
echo; echo;
;;
mangle)
echo "${GREEN}* MANGLE *"
echo "====================================================="
$IPTABLES -t mangle --list -n
echo "=====================================================${NORMAL}"
echo; echo;
;;
nat)
echo "${YELLOW}* NAT *"
echo "====================================================="
$IPTABLES -t nat --list -n
echo "=====================================================${NORMAL}"
echo; echo;
;;
filter) echo "${BLUE}* FILTER *"
echo "====================================================="
$IPTABLES -t filter --list -n
echo "=====================================================${NORMAL}"
echo; echo;
;;
auth)
echo "${WHITE}* CLIENTS *"
echo "====================================================="
$IPTABLES -t filter --list FCLIENT -n
$IPTABLES -t nat --list DCLIENT -n
$IPTABLES -t nat --list SCLIENT -n
echo "=====================================================${NORMAL}"
echo
echo "${RED}* SERVERS *"
echo "====================================================="
$IPTABLES -t filter --list FSERVER -n
$IPTABLES -t nat --list DSERVER -n
$IPTABLES -t nat --list SSERVER -n
echo "=====================================================${NORMAL}"
;;
*)
echo "${GREEN}* MANGLE *"
echo "====================================================="
$IPTABLES -t mangle --list -n
echo "=====================================================${NORMAL}"
echo; echo;
echo "${YELLOW}* NAT *"
echo "====================================================="
$IPTABLES -t nat --list -n
echo "=====================================================${NORMAL}"
echo; echo;
echo "${BLUE}* FILTER *"
echo "====================================================="
$IPTABLES -t filter --list -n
echo "=====================================================${NORMAL}"
echo; echo;
echo "${WHITE}* CLIENTS *"
echo "====================================================="
$IPTABLES -t filter --list FCLIENT -n
$IPTABLES -t nat --list DCLIENT -n
$IPTABLES -t nat --list SCLIENT -n
echo "=====================================================${NORMAL}"
echo
echo "${RED}* SERVERS *"
echo "====================================================="
$IPTABLES -t filter --list FSERVER -n
$IPTABLES -t nat --list DSERVER -n
$IPTABLES -t nat --list SSERVER -n
echo "=====================================================${NORMAL}"
echo; echo;
esac ;;
*)
usage;
;; esac
exit