Initscript per firewall iptables su Debian - Revision history

Gabriele.vivinetto: /* Esempio di rulescripts */

2005-12-16T15:12:49Z

Esempio di rulescripts

← Older revision		Revision as of 15:12, 16 December 2005
Line 84:		Line 84:
	== Esempio di rulescripts ==		== Esempio di rulescripts ==

	* '''start.firewall~~'''~~		=== start.firewall ===

	<pre>		<pre>
Line 108:		Line 108:

	LAN0_SMTP_SERVER="192.168.10.100"		LAN0_SMTP_SERVER="192.168.10.100"
	~~# non carica~~		LAN0_PROXY_SERVER="192.168.10.100"
			LAN0_DNS_SERVER="192.168.10.100"

	ADMIN_MAC_01="00:08:02:68:3A:7C" # mnt.vvngrl intel lan		ADMIN_MAC_01="00:08:02:68:3A:7C" # mnt.vvngrl intel lan
Line 284:		Line 285:
	$IPTABLES -A FORWARD -p tcp \		$IPTABLES -A FORWARD -p tcp \
	--dport 22 -j ACCEPT		--dport 22 -j ACCEPT
			# ------------------------------------------------------------------
			# DNS
			# ------------------

			$IPTABLES -A FORWARD -p udp \
			--dport 53 \
			-s $LAN0_DNS_SERVER \
			-j ACCEPT

			# ------------------------------------------------------------------
			# HTTP client (80)
			# ------------------

			$IPTABLES -A FORWARD -p tcp \
			-d $ANYWHERE --dport 443 \
			-s $LAN0_PROXY_SERVER --sport $UNPRIVPORTS \
			-j ACCEPT

	# ------------------------------------------------------------------		# ------------------------------------------------------------------
Line 289:		Line 307:
	# ------------------		# ------------------

	#$IPTABLES -A FORWARD -p tcp \		$IPTABLES -A FORWARD -p tcp \
	# -d $ANYWHERE --dport ~~443~~ \		-d $ANYWHERE --dport 80 \
	# -j ACCEPT		-s $LAN0_PROXY_SERVER --sport $UNPRIVPORTS \
			-j ACCEPT

	# ------------------------------------------------------------------		# ------------------------------------------------------------------
Line 365:		Line 384:
	</pre>		</pre>

	* '''firewall~~.stop'''~~		=== stop.firewall ===

	<pre>		<pre>

Gabriele.vivinetto: /* Creazione initscript */

2005-12-16T15:08:59Z

Creazione initscript

← Older revision		Revision as of 15:08, 16 December 2005
Line 26:		Line 26:

	stop_firewall () {		stop_firewall () {
	. $CONFIG_DIR/~~start~~.firewall \|\| {		. $CONFIG_DIR/stop.firewall \|\| {
	echo "$CONFIG_DIR/stop.firewall missing, not stopping $DESC"		echo "$CONFIG_DIR/stop.firewall missing, not stopping $DESC"
	exit 1		exit 1

Gabriele.vivinetto at 14:42, 16 December 2005

2005-12-16T14:42:19Z

Show changes

Gabriele.vivinetto at 14:04, 16 December 2005

2005-12-16T14:04:34Z

New page

== Creazione initscript ==

<pre>
cat > /etc/init.d/firewall <<'EOFile'
#!/bin/sh -e
#
# v1.0 2005.12.16
# gabriele.vivinetto@rvmgroup.it

test $DEBIAN_SCRIPT_DEBUG && set -v -x

DESC="firewall"
CONFIG_DIR=/etc/firewall
test -d $CONFIG_DIR || {
echo $CONFIG_DIR missing, nothing to do.
exit 1
}

start_firewall () {
. $CONFIG_DIR/start.firewall || {
echo $CONFIG_DIR/start.firewall missing, not starting $DESC
exit 1
}

stop_firewall () {
. $CONFIG_DIR/start.firewall || {
echo $CONFIG_DIR/stop.firewall missing, not stopping $DESC
exit 1
}

case "$1" in
start)
echo -n "Starting $DESC:"
start_firewall
echo "."
;;

stop)
echo -n "Stopping $DESC:"
stop_firewall
echo "."
;;

restart)
shift
$0 stop
sleep 1
$0 start
;;

*)
echo "Usage: $0 {start|stop|restart}" >&2
exit 1
;;
esac

exit 0

# vim:set ai sts=2 sw=2 tw=0:
EOFile

chmod 755 /etc/init.d/firewall
mkdir /etc/firewall
</pre>

== Creazione regole ==

Le regole sono contenute in due files:

* '''/etc/firewall/start-firewall''': contiene le regole necessarie alla partenza del firewall. Questo files sarà eseguito dando l'opzione ''start'' all'initscript.

* '''/etc/firewall/stop-firewall''': contiene le regole necessarie alla disattivazione di tutte le regole del firewall. Questo files sarà eseguito dando l'opzione ''stop'' all'initscript.

Se questi files non esistono, l'initscript terminerà.

== Attivazione dell'initscript ==

Creaiamo i link di partena automatica dello script, che deve essere attivato dopo aver configurato le interfacce:

sudo update-rc.d firewall start 41 S . stop 89 0 6 .