-### -*-m4-*-
+### -*-sh-*-
###
### Firewall configuration for vampire
###
### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
###--------------------------------------------------------------------------
-### Network interfaces.
-
-m4_divert(44)m4_dnl
-## Interface definitions.
-if_untrusted=eth0.1
-if_trusted=eth0.0
-if_vpn=vpn-+
-if_its_mz=eth0.0
-if_its_pi=eth0.0
-
-m4_divert(-1)
-###--------------------------------------------------------------------------
### vampire-specific rules.
-m4_divert(82)m4_dnl
+m4_divert(86)m4_dnl
## Externally visible services.
allowservices inbound tcp \
finger ident \
- dns \
+ dns iodine \
ssh \
- smtp \
+ smtp submission \
+ rdesktop \
gnutella_svc \
ftp ftp_data \
rsync \
- http https \
- git
-allowservices inbound tcp \
- tor_public tor_directory
+ imaps \
+ disorder mpd \
+ http https squid \
+ git \
+ tor_public tor_directory i2p
allowservices inbound udp \
- dns \
+ dns iodine \
tripe \
- gnutella_svc
+ gnutella_svc \
+ i2p
-## Provide DNS resolution to local untrusted hosts.
-for p in tcp udp; do
- run iptables -A inbound -j ACCEPT \
- -s 172.29.198.0/24 \
- -p $p --destination-port $port_dns
-done
+## Extend some services to local untrusted hosts.
+clearchain inbound-untrusted
+run iptables -A inbound -j inbound-untrusted \
+ -s 172.29.198.0/24
+
+allowservices inbound-untrusted tcp \
+ dns \
+ netbios_ssn microsoft_ds
+allowservices inbound-untrusted udp \
+ dns \
+ tftp
## Provide syslog for evolution.
run iptables -A inbound -j ACCEPT \
-s 172.29.198.2 \
-p udp --destination-port $port_syslog
-## Provide a web cache to local untrusted hosts.
-run iptables -A inbound -j ACCEPT \
- -s 172.29.198.0/24 \
- -p tcp --destination-port $port_squid
-
## Watch outgoing Tor usage.
run iptables -A OUTPUT -m multiport \
-p tcp --source-ports $port_tor_public,$port_tor_directory
## Other interesting things.
dnsresolver inbound
-ntpclient inbound 158.152.1.76 158.152.1.204 194.159.253.2
+ntpclient inbound $ntp_servers
+
+## NAT for RFC1918 addresses.
+for i in PREROUTING OUTPUT POSTROUTING; do
+ run iptables -t nat -P $i ACCEPT 2>/dev/null || :
+ run iptables -t nat -F $i 2>/dev/null || :
+done
+run iptables -t nat -F
+run iptables -t nat -X
+
+run iptables -t nat -N outbound
+run iptables -t nat -A outbound -j RETURN ! -o eth0.0
+run iptables -t nat -A outbound -j RETURN ! -s 172.29.198.0/23
+run iptables -t nat -A outbound -j RETURN -d 62.49.204.144/28
+run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23
+run iptables -t nat -A outbound -j SNAT --to-source 62.49.204.158
+run iptables -t nat -A POSTROUTING -j outbound
+
+## Set up NAT protocol helpers. In particular, SIP needs some special
+## twiddling.
+run modprobe nf_conntrack_sip \
+ ports=5060 \
+ sip_direct_signalling=0 \
+ sip_direct_media=0
+for p in ftp sip h323; do
+ run modprobe nf_nat_$p
+done
+
+## Forbid anything complicated to the NAT address.
+run iptables -A INPUT -d 62.49.204.158 ! -p icmp -j REJECT
m4_divert(-1)
###----- That's all, folks --------------------------------------------------