From: Mark Wooding Date: Sun, 12 Feb 2012 01:58:03 +0000 (+0000) Subject: Merge branch 'master' into emergency X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/commitdiff_plain/2861f481552b0cd6c118e7169397e134fde03b15?hp=5df19e1fc98497f17ba189dc40339146832e86c3 Merge branch 'master' into emergency * master: numbers.m4, gibson.m4: Allow gibson to receive IPMI responses. bookends.m4: Open up tables we clobbered at exit. fender: New host, with basic firewall. --- diff --git a/numbers.m4 b/numbers.m4 index ec86266..4d111da 100644 --- a/numbers.m4 +++ b/numbers.m4 @@ -49,6 +49,7 @@ defport rsync 873 defport imaps 993 defport h323 1720 defport squid 3128 +defport rdesktop 3389 defport tripe 4070 defport siplo 5000 defport siphi 5100 diff --git a/vampire.m4 b/vampire.m4 index e378447..2cf1a13 100644 --- a/vampire.m4 +++ b/vampire.m4 @@ -53,6 +53,7 @@ allowservices inbound tcp \ dns iodine \ ssh \ smtp submission \ + rdesktop \ gnutella_svc \ ftp ftp_data \ rsync \ @@ -92,5 +93,31 @@ run iptables -A OUTPUT -m multiport \ dnsresolver inbound ntpclient inbound $ntp_servers +## NAT for RFC1918 addresses. +for i in PREROUTING OUTPUT POSTROUTING; do + run iptables -t nat -P $i ACCEPT 2>/dev/null || : + run iptables -t nat -F $i 2>/dev/null || : +done +run iptables -t nat -F +run iptables -t nat -X + +run iptables -t nat -N outbound +run iptables -t nat -A outbound -j RETURN ! -o $if_dmz +run iptables -t nat -A outbound -j RETURN ! -s 172.29.198.0/23 +run iptables -t nat -A outbound -j RETURN -d 62.49.204.144/28 +run iptables -t nat -A outbound -j RETURN -d 172.29.198.0/23 +run iptables -t nat -A outbound -j SNAT --to-source 62.49.204.158 +run iptables -t nat -A POSTROUTING -j outbound + +## Set up NAT protocol helpers. In particular, SIP needs some special +## twiddling. +run modprobe nf_conntrack_sip \ + ports=5060 \ + sip_direct_signalling=0 \ + sip_direct_media=0 +for p in ftp sip h323; do + run modprobe nf_nat_$p +done + m4_divert(-1) ###----- That's all, folks --------------------------------------------------