~mdw
/
firewall
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge branch 'master' of /home/mdw/public-git/firewall
[firewall]
/
vampire.m4
diff --git
a/vampire.m4
b/vampire.m4
index
450bdff
..
d25bf49
100644
(file)
--- a/
vampire.m4
+++ b/
vampire.m4
@@
-29,6
+29,7
@@
m4_divert(44)m4_dnl
if_untrusted=eth0.1
if_trusted=eth0.0
if_vpn=vpn-+
if_untrusted=eth0.1
if_trusted=eth0.0
if_vpn=vpn-+
+if_iodine=dns+
if_its_mz=eth0.0
if_its_pi=eth0.0
if_its_mz=eth0.0
if_its_pi=eth0.0
@@
-40,20
+41,21
@@
m4_divert(82)m4_dnl
## Externally visible services.
allowservices inbound tcp \
finger ident \
## Externally visible services.
allowservices inbound tcp \
finger ident \
- dns \
+ dns
iodine
\
ssh \
smtp \
gnutella_svc \
ftp ftp_data \
rsync \
ssh \
smtp \
gnutella_svc \
ftp ftp_data \
rsync \
+ disorder mpd \
http https \
http https \
- git
-allowservices inbound tcp \
- tor_public tor_directory
+ git \
+ tor_public tor_directory i2p
allowservices inbound udp \
allowservices inbound udp \
- dns \
+ dns
iodine
\
tripe \
tripe \
- gnutella_svc
+ gnutella_svc \
+ i2p
## Provide DNS resolution to local untrusted hosts.
for p in tcp udp; do
## Provide DNS resolution to local untrusted hosts.
for p in tcp udp; do
@@
-72,6
+74,10
@@
run iptables -A inbound -j ACCEPT \
-s 172.29.198.0/24 \
-p tcp --destination-port $port_squid
-s 172.29.198.0/24 \
-p tcp --destination-port $port_squid
+## Watch outgoing Tor usage.
+run iptables -A OUTPUT -m multiport \
+ -p tcp --source-ports $port_tor_public,$port_tor_directory
+
## Other interesting things.
dnsresolver inbound
ntpclient inbound 158.152.1.76 158.152.1.204 194.159.253.2
## Other interesting things.
dnsresolver inbound
ntpclient inbound 158.152.1.76 158.152.1.204 194.159.253.2