mdw@git.distorted.org.uk Git - firewall/blob - local.m4

   1 ### -*-sh-*-
   2 ###
   3 ### Local firewall configuration
   4 ###
   5 ### (c) 2008 Mark Wooding
   6 ###
   7
   8 ###----- Licensing notice ---------------------------------------------------
   9 ###
  10 ### This program is free software; you can redistribute it and/or modify
  11 ### it under the terms of the GNU General Public License as published by
  12 ### the Free Software Foundation; either version 2 of the License, or
  13 ### (at your option) any later version.
  14 ###
  15 ### This program is distributed in the hope that it will be useful,
  16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18 ### GNU General Public License for more details.
  19 ###
  20 ### You should have received a copy of the GNU General Public License
  21 ### along with this program; if not, write to the Free Software Foundation,
  22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  23
  24 ###--------------------------------------------------------------------------
  25 ### Local configuration.
  26
  27 m4_divert(6)m4_dnl
  28 ## Default NTP servers.
  29 defconf(ntp_servers,
  30         "158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232")
  31
  32 m4_divert(-1)
  33 ###--------------------------------------------------------------------------
  34 ### Packet classification.
  35
  36 ## Define the available network classes.
  37 m4_divert(42)m4_dnl
  38 defnetclass untrusted untrusted trusted
  39 defnetclass trusted untrusted trusted safe noloop
  40 defnetclass safe trusted safe noloop
  41 defnetclass noloop trusted safe
  42 m4_divert(-1)
  43
  44 m4_divert(26)m4_dnl
  45 ###--------------------------------------------------------------------------
  46 ### Network layout.
  47
  48 ## House networks.
  49 defnet dmz trusted
  50         addr 62.49.204.144/28
  51         forwards unsafe untrusted
  52 defnet unsafe trusted
  53         addr 172.29.199.0/25
  54         forwards househub
  55 defnet safe safe
  56         addr 172.29.199.192/28
  57         forwards househub
  58 defnet untrusted untrusted
  59         addr 172.29.198.0/25
  60         forwards househub
  61 defnet vpn safe
  62         addr 172.29.199.128/27
  63         forwards househub
  64         host crybaby 1
  65         host terror 2
  66 defnet iodine untrusted
  67         addr 172.29.198.128/28
  68
  69 defnet househub virtual
  70         forwards housebdry dmz unsafe safe untrusted
  71 defnet housebdry virtual
  72         forwards househub hub
  73         noxit dmz
  74
  75 ## House hosts.
  76 defhost radius
  77         router
  78         iface eth0 dmz
  79         iface eth1 unsafe
  80         iface eth2 safe
  81         iface eth3 untrusted
  82 defhost roadstar
  83         iface eth0 dmz
  84         iface eth1 unsafe
  85 defhost jem
  86         iface eth0 dmz
  87         iface eth1 unsafe
  88 defhost artist
  89         iface eth0 dmz
  90         iface eth1 unsafe
  91 defhost vampire
  92         router
  93         iface eth0.0 dmz
  94         iface eth0.1 unsafe
  95         iface eth0.3 untrusted
  96         iface dns0 dns
  97         iface vpn-+ vpn
  98         iface vpn-precision colobdry vpn
  99 defhost ibanez
 100         iface br-dmz dmz
 101         iface br-unsafe unsafe
 102
 103 defhost gibson
 104         iface eth0 unsafe
 105
 106 ## Colocated networks.
 107 defnet jump trusted
 108         addr 212.13.198.64/28
 109         forwards colohub
 110 defnet colo trusted
 111         addr 172.29.199.176/28
 112         forwards colohub
 113 defnet colohub virtual
 114         forwards colobdry jump colo
 115 defnet colobdry virtual
 116         forwards colohub hub
 117         noxit jump
 118
 119 ## Colocated hosts.
 120 defhost fender
 121         iface br-jump jump
 122         iface br-colo colo
 123 defhost precision
 124         router
 125         iface eth0 jump
 126         iface eth1 colo
 127         iface vpn-+ vpn
 128         iface vpn-vampire housebdry vpn
 129 defhost telecaster
 130         iface eth0 jump
 131         iface eth1 colo
 132 defhost stratocaster
 133         iface eth0 jump
 134         iface eth1 colo
 135 defhost jazz
 136         iface eth0 jump
 137         iface eth1 colo
 138
 139 ## Other networks.
 140 defnet hub virtual
 141         forwards housebdry colobdry
 142 defnet default untrusted
 143         addr 62.49.204.144/28
 144         addr 212.13.198.64/28
 145         forwards dmz untrusted unsafe jump colo
 146
 147 m4_divert(80)m4_dnl
 148 ###--------------------------------------------------------------------------
 149 ### Special forwarding exemptions.
 150
 151 ## Only allow these packets if they're not fragmented.  (Don't trust safe
 152 ## hosts's fragment reassembly to be robust against malicious fragments.)
 153 ## There's a hideous bug in iptables 1.4.11.1 which botches the meaning of
 154 ## `! -f', so we do the negation using early return from a subchain.
 155 clearchain fwd-spec-nofrag
 156 run iptables -A fwd-spec-nofrag -j RETURN --fragment
 157 run ip6tables -A fwd-spec-nofrag -j RETURN \
 158         -m ipv6header --soft --header frag
 159 run iptables -A FORWARD -j fwd-spec-nofrag
 160
 161 ## Allow ping from safe/noloop to untrusted networks.
 162 run iptables -A fwd-spec-nofrag -j ACCEPT \
 163         -p icmp --icmp-type echo-request \
 164         -m mark --mark $to_untrusted/$MASK_TO
 165 run iptables -A fwd-spec-nofrag -j ACCEPT \
 166         -p icmp --icmp-type echo-reply \
 167         -m mark --mark $from_untrusted/$MASK_FROM \
 168         -m state --state ESTABLISHED
 169 run ip6tables -A fwd-spec-nofrag -j ACCEPT \
 170         -p ipv6-icmp --icmpv6-type echo-request \
 171         -m mark --mark $to_untrusted/$MASK_TO
 172 run ip6tables -A fwd-spec-nofrag -j ACCEPT \
 173         -p ipv6-icmp --icmpv6-type echo-reply \
 174         -m mark --mark $from_untrusted/$MASK_FROM \
 175         -m state --state ESTABLISHED
 176
 177 ## Allow SSH from safe/noloop to untrusted networks.
 178 run iptables -A fwd-spec-nofrag -j ACCEPT \
 179         -p tcp --destination-port $port_ssh \
 180         -m mark --mark $to_untrusted/$MASK_TO
 181 run iptables -A fwd-spec-nofrag -j ACCEPT \
 182         -p tcp --source-port $port_ssh \
 183         -m mark --mark $from_untrusted/$MASK_FROM \
 184         -m state --state ESTABLISHED
 185 run ip6tables -A fwd-spec-nofrag -j ACCEPT \
 186         -p tcp --destination-port $port_ssh \
 187         -m mark --mark $to_untrusted/$MASK_TO
 188 run ip6tables -A fwd-spec-nofrag -j ACCEPT \
 189         -p tcp --source-port $port_ssh \
 190         -m mark --mark $from_untrusted/$MASK_FROM \
 191         -m state --state ESTABLISHED
 192
 193 m4_divert(60)m4_dnl
 194 m4_divert(80)m4_dnl
 195 ###--------------------------------------------------------------------------
 196 ### Kill things we don't understand properly.
 197 ###
 198 ### I don't like having to do this, but since I don't know how to do proper
 199 ### multicast filtering, I'm just going to ban it from being forwarded.
 200
 201 errorchain poorly-understood REJECT
 202
 203 ## Ban multicast destination addresses in forwarding.
 204 run iptables -A FORWARD -g poorly-understood \
 205         -d 224.0.0.0/4
 206 run ip6tables -A FORWARD -g poorly-understood \
 207         -d ff::/8
 208
 209 m4_divert(84)m4_dnl
 210 ###--------------------------------------------------------------------------
 211 ### Locally-bound packet inspection.
 212
 213 clearchain inbound
 214
 215 ## Track connections.
 216 commonrules inbound
 217 conntrack inbound
 218
 219 ## Allow incoming bootp.  Bootp won't be forwarded, so this is obviously a
 220 ## local request.
 221 run iptables -A inbound -j ACCEPT \
 222         -s 0.0.0.0 -d 255.255.255.255 \
 223         -p udp --source-port $port_bootpc --destination-port $port_bootps
 224 run iptables -A inbound -j ACCEPT \
 225         -s 172.29.198.0/23 \
 226         -p udp --source-port $port_bootpc --destination-port $port_bootps
 227
 228 ## Incoming multicast on a network interface associated with a trusted
 229 ## network is OK, since it must have originated there (or been forwarded, but
 230 ## we don't do that yet).
 231 for i in $(echo $if_trusted $if_dmz $if_safe | sed 'y/,/ /'); do
 232   echo $i
 233 done | {
 234   seen=:
 235   while read i; do
 236     case "$seen" in *:$i:*) continue ;; esac
 237     seen=$seen$i:
 238     run iptables -A inbound -j ACCEPT \
 239         -s 0.0.0.0 -d 224.0.0.0/24 \
 240         -i $i
 241   done
 242 }
 243
 244 ## Allow incoming ping.  This is the only ICMP left.
 245 run ip46tables -A inbound -j ACCEPT -p icmp
 246
 247 m4_divert(88)m4_dnl
 248 ## Allow unusual things.
 249 openports inbound
 250
 251 ## Inspect inbound packets from untrusted sources.
 252 run ip46tables -A inbound -j forbidden
 253 run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
 254
 255 ## Otherwise process as indicated by the mark.
 256 for i in INPUT FORWARD; do
 257   run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
 258 done
 259
 260 m4_divert(-1)
 261 ###----- That's all, folks --------------------------------------------------