X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/00851a0a72356001e40304879907b9ecec8ce588..961148a5388760756ab37b897576eec33edbd3a9:/vampire.m4 diff --git a/vampire.m4 b/vampire.m4 index e7114cf..e378447 100644 --- a/vampire.m4 +++ b/vampire.m4 @@ -1,4 +1,4 @@ -### -*-m4-*- +### -*-sh-*- ### ### Firewall configuration for vampire ### @@ -22,16 +22,25 @@ ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ###-------------------------------------------------------------------------- +### Config settings. + +## This router is involved in a routing asymmetry. +setconf(rp_filter, 0) +setconf(log_martians, 0) + +###-------------------------------------------------------------------------- ### Network interfaces. m4_divert(44)m4_dnl ## Interface definitions. -if_untrusted=eth0.1 -if_trusted=eth0.0 +if_dmz=eth0.0 +if_trusted=eth0.1 +if_safe=$if_dmz,$if_trusted +if_untrusted=eth0.3 if_vpn=vpn-+ if_iodine=dns+ -if_its_mz=eth0.0 -if_its_pi=eth0.0 +if_its_mz=$if_dmz,$if_trusted +if_its_pi=$if_dmz,$if_trusted m4_divert(-1) ###-------------------------------------------------------------------------- @@ -58,22 +67,17 @@ allowservices inbound udp \ gnutella_svc \ i2p -## Provide DNS resolution to local untrusted hosts. -for p in tcp udp; do - run iptables -A inbound -j ACCEPT \ - -s 172.29.198.0/24 \ - -p $p --destination-port $port_dns -done +## Extend some services to local untrusted hosts. +clearchain inbound-untrusted +run iptables -A inbound -j inbound-untrusted \ + -s 172.29.198.0/24 -## Allow smb and nmb to untrusted hosts. This is a bit experimental. -run iptables -A inbound -j ACCEPT \ - -s 172.29.198.0/24 \ - -p udp -m multiport --destination-ports \ - $port_netbios_ns,$port_netbios_dgm -run iptables -A inbound -j ACCEPT \ - -s 172.29.198.0/24 \ - -p tcp -m multiport --destination-ports \ - $port_netbios_ssn,$port_microsoft_ds +allowservices inbound-untrusted tcp \ + dns \ + netbios_ssn microsoft_ds +allowservices inbound-untrusted udp \ + dns \ + tftp ## Provide syslog for evolution. run iptables -A inbound -j ACCEPT \ @@ -86,7 +90,7 @@ run iptables -A OUTPUT -m multiport \ ## Other interesting things. dnsresolver inbound -ntpclient inbound 158.152.1.76 158.152.1.204 194.159.253.2 +ntpclient inbound $ntp_servers m4_divert(-1) ###----- That's all, folks --------------------------------------------------