ipfilter/setup.cgi

   1 #!/usr/local/bin/perl
   2 # setup.cgi
   3 # Setup an initial save file
   4
   5 require './ipfilter-lib.pl';
   6 &ReadParse();
   7
   8 @rules = ( );
   9 if ($in{'auto'}) {
  10         $iface = $in{'iface'.$in{'auto'}};
  11         if ($iface eq 'other') {
  12                 $iface = $in{'iface'.$in{'auto'}.'_other'};
  13                 }
  14         $iface || &error($text{'setup_eiface'});
  15         if ($in{'auto'} >= 2) {
  16                 # Block all incoming traffic, except for established
  17                 # connections, DNS replies and safe ICMP types
  18                 # In mode 3 allow ssh and ident too
  19                 # In mode 4 allow ftp, echo-request and high ports too
  20                 push(@rules,
  21                      { 'action' => 'skip', 'skip' => 1, 'active' => 1,
  22                        'quick' => 1, 'dir' => 'in',
  23                        'all' => 1,
  24                        'on' => $iface,
  25                        'cmt' => 'Skip next rule for external interface' },
  26                      { 'action' => 'pass', 'active' => 1,
  27                        'quick' => 1, 'dir' => 'in',
  28                        'all' => 1,
  29                        'keep' => 'state',
  30                        'cmt' => 'Allow all traffic on internal interface' },
  31                      { 'action' => 'pass', 'active' => 1,
  32                        'quick' => 1, 'dir' => 'in',
  33                        'proto' => 'udp',
  34                        'from-any' => 1,
  35                        'to-any' => 1,
  36                        'to-port-start' => 1024,
  37                        'to-port-range' => '<>',
  38                        'to-port-end' => 1024,
  39                        'keep' => 'state',
  40                        'cmt' => 'Accept responses to DNS queries' },
  41                      { 'action' => 'pass', 'active' => 1,
  42                        'quick' => 1, 'dir' => 'in',
  43                        'proto' => 'icmp',
  44                        'all' => 1,
  45                        'icmp-type' => 'echorep',
  46                        'keep' => 'state',
  47                        'cmt' => 'Accept responses to our pings' },
  48                      { 'action' => 'pass', 'active' => 1,
  49                        'quick' => 1, 'dir' => 'in',
  50                        'proto' => 'icmp',
  51                        'all' => 1,
  52                        'icmp-type' => 'unreach',
  53                        'keep' => 'state',
  54                        'cmt' => 'Accept notifications of unreachable hosts' },
  55                      { 'action' => 'pass', 'active' => 1,
  56                        'quick' => 1, 'dir' => 'in',
  57                        'proto' => 'icmp',
  58                        'all' => 1,
  59                        'icmp-type' => 'squench',
  60                        'keep' => 'state',
  61                        'cmt' => 'Accept notifications to reduce sending speed' },
  62                      { 'action' => 'pass', 'active' => 1,
  63                        'quick' => 1, 'dir' => 'in',
  64                        'proto' => 'icmp',
  65                        'all' => 1,
  66                        'icmp-type' => 'timex',
  67                        'keep' => 'state',
  68                        'cmt' => 'Accept notifications of lost packets' },
  69                      { 'action' => 'pass', 'active' => 1,
  70                        'quick' => 1, 'dir' => 'in',
  71                        'proto' => 'icmp',
  72                        'all' => 1,
  73                        'icmp-type' => 'paramprob',
  74                        'keep' => 'state',
  75                        'cmt' => 'Accept notifications of protocol problems' }
  76                         );
  77                 if ($in{'auto'} >= 3) {
  78                         # Allow ssh and ident
  79                         push(@rules,
  80                              { 'action' => 'pass', 'active' => 1,
  81                                'quick' => 1, 'dir' => 'in',
  82                                'proto' => 'tcp',
  83                                'from-any' => 1,
  84                                'to-any' => 1,
  85                                'to-port-comp' => '=',
  86                                'to-port-num' => 22,
  87                                'keep' => 'state',
  88                                'cmt' => 'Allow connections to our SSH server' },
  89                              { 'action' => 'pass', 'active' => 1,
  90                                'quick' => 1, 'dir' => 'in',
  91                                'proto' => 'tcp',
  92                                'from-any' => 1,
  93                                'to-any' => 1,
  94                                'to-port-comp' => '=',
  95                                'to-port-num' => 113,
  96                                'keep' => 'state',
  97                                'cmt' => 'Allow connections to our IDENT server' },
  98                                 );
  99                         }
 100                 if ($in{'auto'} == 4) {
 101                         # Allow pings and most high ports
 102                         push(@rules,
 103                              { 'action' => 'pass', 'active' => 1,
 104                                'quick' => 1, 'dir' => 'in',
 105                                'proto' => 'icmp',
 106                                'all' => 1,
 107                                'icmp-type' => 'echo',
 108                                'keep' => 'state',
 109                                'cmt' => 'Respond to pings' },
 110                              { 'action' => 'block', 'active' => 1,
 111                                'quick' => 1, 'dir' => 'in',
 112                                'proto' => 'tcp',
 113                                'from-any' => 1,
 114                                'to-any' => 1,
 115                                'to-port-start' => 2049,
 116                                'to-port-range' => '<>',
 117                                'to-port-end' => 2050,
 118                                'keep' => 'state',
 119                                'cmt' => 'Protect our NFS server' },
 120                              { 'action' => 'block', 'active' => 1,
 121                                'quick' => 1, 'dir' => 'in',
 122                                'proto' => 'tcp',
 123                                'from-any' => 1,
 124                                'to-any' => 1,
 125                                'to-port-start' => 6000,
 126                                'to-port-range' => '<>',
 127                                'to-port-end' => 6063,
 128                                'keep' => 'state',
 129                                'cmt' => 'Protect our X11 display server' },
 130                              { 'action' => 'block', 'active' => 1,
 131                                'quick' => 1, 'dir' => 'in',
 132                                'proto' => 'tcp',
 133                                'from-any' => 1,
 134                                'to-any' => 1,
 135                                'to-port-start' => 7000,
 136                                'to-port-range' => '<>',
 137                                'to-port-end' => 7010,
 138                                'keep' => 'state',
 139                                'cmt' => 'Protect our X font server' },
 140                              { 'action' => 'pass', 'active' => 1,
 141                                'quick' => 1, 'dir' => 'in',
 142                                'proto' => 'tcp',
 143                                'from-any' => 1,
 144                                'to-any' => 1,
 145                                'to-port-start' => 1024,
 146                                'to-port-range' => '<>',
 147                                'to-port-end' => 65535,
 148                                'keep' => 'state',
 149                                'cmt' => 'Allow connections to unprivileged ports' },
 150                                 );
 151                         }
 152
 153                 # Add final block rule
 154                 push(@rules, { 'action' => 'block', 'active' => 1,
 155                                'all' => 1,
 156                                'dir' => 'in' });
 157                 push(@rules, { 'action' => 'pass', 'active' => 1,
 158                                'all' => 1,
 159                                'dir' => 'out' });
 160                 }
 161         else {
 162                 # Just add one rule for NAT
 163                 push(@natrules, { 'action' => 'map', 'active' => 1,
 164                                   'fromip' => '0.0.0.0', 'frommask' => 0,
 165                                   'toip' => '0.0.0.0', 'tomask' => 32,
 166                                   'iface' => $iface,
 167                                   'type' => 'ipnat' });
 168
 169                 # Allow all other traffic
 170                 push(@rules, { 'action' => 'pass', 'active' => 1,
 171                                'all' => 1,
 172                                'dir' => 'in' });
 173                 push(@rules, { 'action' => 'pass', 'active' => 1,
 174                                'all' => 1,
 175                                'dir' => 'out' });
 176                 }
 177         }
 178 else {
 179         # Just add rules to allow all
 180         push(@rules, { 'action' => 'pass', 'active' => 1,
 181                        'all' => 1,
 182                        'dir' => 'in' });
 183         push(@rules, { 'action' => 'pass', 'active' => 1,
 184                        'all' => 1,
 185                        'dir' => 'out' });
 186         }
 187 &lock_file($config{'ipf_conf'});
 188 &save_config(\@rules);
 189 &unlock_file($config{'ipf_conf'});
 190 &lock_file($config{'ipnatf_conf'});
 191 &save_config(\@natrules, undef, 'ipnat');
 192 &unlock_file($config{'ipnatf_conf'});
 193 &copy_to_cluster();
 194
 195 if ($in{'atboot'}) {
 196         &create_firewall_init();
 197         }
 198
 199 &webmin_log("setup");
 200 &redirect("");
 201
 202