mirror of
https://git.valherun.com/valherun/pxe_boot_alma.git
synced 2026-10-16 00:52:03 -04:00
refactor: move tree under homelab/, add alma10 hardening and kickstart docs
- restructure boot/kickstarts/scripts/docs into homelab/ - docs: alma9->10 breaking changes, CIS hardening, kickstart changes - add find_cron_entries.sh helper and codex running memory notes Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
andersenandClaude Fable 5 committed
1 parent
c44e450fb4
commit
6d398b826a
1703 files changed
+713908
-90
No files matched your search
@@ -0,0 +1,621 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_ipt v5.1.0.3599
|
||||
#
|
||||
# Generated Tue Mar 26 15:39:30 2019 EDT by wia
|
||||
#
|
||||
# files: * probe-4P-igbr-tun-182.fw /etc/probe-4P-igbr-tun-182.fw
|
||||
#
|
||||
# Compiled for iptables (any version)
|
||||
#
|
||||
|
||||
|
||||
|
||||
|
||||
FWBDEBUG=""
|
||||
|
||||
PATH="/sbin:/usr/sbin:/bin:/usr/bin:${PATH}"
|
||||
export PATH
|
||||
|
||||
|
||||
|
||||
LSMOD="/sbin/lsmod"
|
||||
MODPROBE="/sbin/modprobe"
|
||||
IPTABLES="/sbin/iptables"
|
||||
IP6TABLES="/sbin/ip6tables"
|
||||
IPTABLES_RESTORE="/sbin/iptables-restore"
|
||||
IP6TABLES_RESTORE="/sbin/ip6tables-restore"
|
||||
IP="/sbin/ip"
|
||||
IFCONFIG="/sbin/ifconfig"
|
||||
VCONFIG="/sbin/vconfig"
|
||||
BRCTL="/sbin/brctl"
|
||||
IFENSLAVE="/sbin/ifenslave"
|
||||
IPSET="/usr/sbin/ipset"
|
||||
LOGGER="/usr/bin/logger"
|
||||
|
||||
log() {
|
||||
echo "$1"
|
||||
which "$LOGGER" >/dev/null 2>&1 && $LOGGER -p info "$1"
|
||||
}
|
||||
|
||||
getInterfaceVarName() {
|
||||
echo $1 | sed 's/\./_/'
|
||||
}
|
||||
|
||||
getaddr_internal() {
|
||||
dev=$1
|
||||
name=$2
|
||||
af=$3
|
||||
L=$($IP $af addr show dev $dev | sed -n '/inet/{s!.*inet6* !!;s!/.*!!p}' | sed 's/peer.*//')
|
||||
test -z "$L" && {
|
||||
eval "$name=''"
|
||||
return
|
||||
}
|
||||
eval "${name}_list=\"$L\""
|
||||
}
|
||||
|
||||
getnet_internal() {
|
||||
dev=$1
|
||||
name=$2
|
||||
af=$3
|
||||
L=$($IP route list proto kernel | grep $dev | grep -v default | sed 's! .*$!!')
|
||||
test -z "$L" && {
|
||||
eval "$name=''"
|
||||
return
|
||||
}
|
||||
eval "${name}_list=\"$L\""
|
||||
}
|
||||
|
||||
|
||||
getaddr() {
|
||||
getaddr_internal $1 $2 "-4"
|
||||
}
|
||||
|
||||
getaddr6() {
|
||||
getaddr_internal $1 $2 "-6"
|
||||
}
|
||||
|
||||
getnet() {
|
||||
getnet_internal $1 $2 "-4"
|
||||
}
|
||||
|
||||
getnet6() {
|
||||
getnet_internal $1 $2 "-6"
|
||||
}
|
||||
|
||||
# function getinterfaces is used to process wildcard interfaces
|
||||
getinterfaces() {
|
||||
NAME=$1
|
||||
$IP link show | grep ": $NAME" | while read L; do
|
||||
OIFS=$IFS
|
||||
IFS=" :"
|
||||
set $L
|
||||
IFS=$OIFS
|
||||
echo $2
|
||||
done
|
||||
}
|
||||
|
||||
diff_intf() {
|
||||
func=$1
|
||||
list1=$2
|
||||
list2=$3
|
||||
cmd=$4
|
||||
for intf in $list1
|
||||
do
|
||||
echo $list2 | grep -q $intf || {
|
||||
# $vlan is absent in list 2
|
||||
$func $intf $cmd
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
find_program() {
|
||||
PGM=$1
|
||||
which $PGM >/dev/null 2>&1 || {
|
||||
echo "\"$PGM\" not found"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
check_tools() {
|
||||
find_program which
|
||||
find_program $IPTABLES
|
||||
find_program $MODPROBE
|
||||
find_program $IP
|
||||
}
|
||||
reset_iptables_v4() {
|
||||
$IPTABLES -P OUTPUT DROP
|
||||
$IPTABLES -P INPUT DROP
|
||||
$IPTABLES -P FORWARD DROP
|
||||
|
||||
cat /proc/net/ip_tables_names | while read table; do
|
||||
$IPTABLES -t $table -L -n | while read c chain rest; do
|
||||
if test "X$c" = "XChain" ; then
|
||||
$IPTABLES -t $table -F $chain
|
||||
fi
|
||||
done
|
||||
$IPTABLES -t $table -X
|
||||
done
|
||||
}
|
||||
|
||||
reset_iptables_v6() {
|
||||
$IP6TABLES -P OUTPUT DROP
|
||||
$IP6TABLES -P INPUT DROP
|
||||
$IP6TABLES -P FORWARD DROP
|
||||
|
||||
cat /proc/net/ip6_tables_names | while read table; do
|
||||
$IP6TABLES -t $table -L -n | while read c chain rest; do
|
||||
if test "X$c" = "XChain" ; then
|
||||
$IP6TABLES -t $table -F $chain
|
||||
fi
|
||||
done
|
||||
$IP6TABLES -t $table -X
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
P2P_INTERFACE_WARNING=""
|
||||
|
||||
missing_address() {
|
||||
address=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $address
|
||||
addr=$1
|
||||
interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
|
||||
|
||||
$IP addr show dev $interface | grep -q POINTOPOINT && {
|
||||
test -z "$P2P_INTERFACE_WARNING" && echo "Warning: Can not update address of interface $interface. fwbuilder can not manage addresses of point-to-point interfaces yet"
|
||||
P2P_INTERFACE_WARNING="yes"
|
||||
return
|
||||
}
|
||||
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding ip address: $interface $addr"
|
||||
echo $addr | grep -q ':' && {
|
||||
$FWBDEBUG $IP addr $cmd $addr dev $interface
|
||||
} || {
|
||||
$FWBDEBUG $IP addr $cmd $addr broadcast + dev $interface
|
||||
}
|
||||
}
|
||||
|
||||
test "$cmd" = "del" && {
|
||||
echo "# Removing ip address: $interface $addr"
|
||||
$FWBDEBUG $IP addr $cmd $addr dev $interface || exit 1
|
||||
}
|
||||
|
||||
$FWBDEBUG $IP link set $interface up
|
||||
}
|
||||
|
||||
list_addresses_by_scope() {
|
||||
interface=$1
|
||||
scope=$2
|
||||
ignore_list=$3
|
||||
$IP addr ls dev $interface | \
|
||||
awk -v IGNORED="$ignore_list" -v SCOPE="$scope" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/inet |inet6 / && $0 ~ SCOPE && !($2 in ignored_dict)) {print $2;}' | \
|
||||
while read addr; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
}
|
||||
|
||||
|
||||
update_addresses_of_interface() {
|
||||
ignore_list=$2
|
||||
set $1
|
||||
interface=$1
|
||||
shift
|
||||
|
||||
FWB_ADDRS=$(
|
||||
for addr in $*; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
CURRENT_ADDRS_ALL_SCOPES=""
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
||||
|
||||
$IP link show dev $interface >/dev/null 2>&1 && {
|
||||
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface 'scope .*' "$ignore_list")
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scope global' "$ignore_list")
|
||||
} || {
|
||||
echo "# Interface $interface does not exist"
|
||||
# Stop the script if we are not in test mode
|
||||
test -z "$FWBDEBUG" && exit 1
|
||||
}
|
||||
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
}
|
||||
|
||||
clear_addresses_except_known_interfaces() {
|
||||
$IP link show | sed 's/://g' | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/state/ && !($2 in ignored_dict)) {print $2;}' | \
|
||||
while read intf; do
|
||||
echo "# Removing addresses not configured in fwbuilder from interface $intf"
|
||||
$FWBDEBUG $IP addr flush dev $intf scope global
|
||||
$FWBDEBUG $IP link set $intf down
|
||||
done
|
||||
}
|
||||
|
||||
check_file() {
|
||||
test -r "$2" || {
|
||||
echo "Can not find file $2 referenced by address table object $1"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
check_run_time_address_table_files() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
load_modules() {
|
||||
:
|
||||
OPTS=$1
|
||||
MODULES_DIR="/lib/modules/`uname -r`/kernel/net/"
|
||||
MODULES=$(find $MODULES_DIR -name '*conntrack*' \! -name '*ipv6*'|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')
|
||||
echo $OPTS | grep -q nat && {
|
||||
MODULES="$MODULES $(find $MODULES_DIR -name '*nat*'|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')"
|
||||
}
|
||||
echo $OPTS | grep -q ipv6 && {
|
||||
MODULES="$MODULES $(find $MODULES_DIR -name nf_conntrack_ipv6|sed -e 's/^.*\///' -e 's/\([^\.]\)\..*/\1/')"
|
||||
}
|
||||
for module in $MODULES; do
|
||||
if $LSMOD | grep ${module} >/dev/null; then continue; fi
|
||||
$MODPROBE ${module} || exit 1
|
||||
done
|
||||
}
|
||||
|
||||
verify_interfaces() {
|
||||
:
|
||||
echo "Verifying interfaces: em1 lo em2 p1p1 p1p2 igbr1 bond0"
|
||||
for i in em1 lo em2 p1p1 p1p2 igbr1 bond0 ; do
|
||||
$IP link show "$i" > /dev/null 2>&1 || {
|
||||
log "Interface $i does not exist"
|
||||
exit 1
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
prolog_commands() {
|
||||
echo "Running prolog script"
|
||||
|
||||
}
|
||||
|
||||
epilog_commands() {
|
||||
echo "Running epilog script"
|
||||
echo "Checking to see if tunnel needs to be opened up"
|
||||
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
||||
echo -n "Firewall looks to be running"
|
||||
if ip -o -4 addr |grep -q tun0; then
|
||||
echo -n ", found tun0"
|
||||
if [ -x /sbin/phoneHome ]; then
|
||||
echo ", so running 'phoneHome -O'"
|
||||
/sbin/phoneHome -O
|
||||
else
|
||||
echo ", but no phoneHome found"
|
||||
fi
|
||||
else
|
||||
echo " but no tun0 interface"
|
||||
fi
|
||||
else
|
||||
echo "Firewall not running"
|
||||
fi
|
||||
}
|
||||
|
||||
run_epilog_and_exit() {
|
||||
epilog_commands
|
||||
exit $1
|
||||
}
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
# Configure interfaces
|
||||
getaddr em1 i_em1
|
||||
getaddr6 em1 i_em1_v6
|
||||
getnet em1 i_em1_network
|
||||
getnet6 em1 i_em1_v6_network
|
||||
getaddr em2 i_em2
|
||||
getaddr6 em2 i_em2_v6
|
||||
getnet em2 i_em2_network
|
||||
getnet6 em2 i_em2_v6_network
|
||||
getaddr p1p1 i_p1p1
|
||||
getaddr6 p1p1 i_p1p1_v6
|
||||
getnet p1p1 i_p1p1_network
|
||||
getnet6 p1p1 i_p1p1_v6_network
|
||||
getaddr p1p2 i_p1p2
|
||||
getaddr6 p1p2 i_p1p2_v6
|
||||
getnet p1p2 i_p1p2_network
|
||||
getnet6 p1p2 i_p1p2_v6_network
|
||||
getaddr igbr1 i_igbr1
|
||||
getaddr6 igbr1 i_igbr1_v6
|
||||
getnet igbr1 i_igbr1_network
|
||||
getnet6 igbr1 i_igbr1_v6_network
|
||||
getaddr bond0 i_bond0
|
||||
getaddr6 bond0 i_bond0_v6
|
||||
getnet bond0 i_bond0_network
|
||||
getnet6 bond0 i_bond0_v6_network
|
||||
}
|
||||
|
||||
script_body() {
|
||||
# ================ IPv4
|
||||
|
||||
|
||||
# ================ Table 'filter', automatic rules
|
||||
# accept established sessions
|
||||
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
# ================ Table 'filter', rule set Policy
|
||||
#
|
||||
# Rule 0 (lo)
|
||||
#
|
||||
echo "Rule 0 (lo)"
|
||||
#
|
||||
# Allow anything on loopback
|
||||
$IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -o lo -m state --state NEW -j ACCEPT
|
||||
#
|
||||
# Rule 1 (global)
|
||||
#
|
||||
echo "Rule 1 (global)"
|
||||
#
|
||||
# Anti-spoofing rule
|
||||
$IPTABLES -N In_RULE_1
|
||||
for i_bond0 in $i_bond0_list
|
||||
do
|
||||
test -n "$i_bond0" && $IPTABLES -A INPUT -s $i_bond0 -j In_RULE_1
|
||||
done
|
||||
for i_igbr1 in $i_igbr1_list
|
||||
do
|
||||
test -n "$i_igbr1" && $IPTABLES -A INPUT -s $i_igbr1 -j In_RULE_1
|
||||
done
|
||||
for i_p1p2 in $i_p1p2_list
|
||||
do
|
||||
test -n "$i_p1p2" && $IPTABLES -A INPUT -s $i_p1p2 -j In_RULE_1
|
||||
done
|
||||
for i_p1p1 in $i_p1p1_list
|
||||
do
|
||||
test -n "$i_p1p1" && $IPTABLES -A INPUT -s $i_p1p1 -j In_RULE_1
|
||||
done
|
||||
for i_em2 in $i_em2_list
|
||||
do
|
||||
test -n "$i_em2" && $IPTABLES -A INPUT -s $i_em2 -j In_RULE_1
|
||||
done
|
||||
for i_em1 in $i_em1_list
|
||||
do
|
||||
test -n "$i_em1" && $IPTABLES -A INPUT -s $i_em1 -j In_RULE_1
|
||||
done
|
||||
for i_bond0 in $i_bond0_list
|
||||
do
|
||||
test -n "$i_bond0" && $IPTABLES -A FORWARD -i + -s $i_bond0 -j In_RULE_1
|
||||
done
|
||||
for i_igbr1 in $i_igbr1_list
|
||||
do
|
||||
test -n "$i_igbr1" && $IPTABLES -A FORWARD -i + -s $i_igbr1 -j In_RULE_1
|
||||
done
|
||||
for i_p1p2 in $i_p1p2_list
|
||||
do
|
||||
test -n "$i_p1p2" && $IPTABLES -A FORWARD -i + -s $i_p1p2 -j In_RULE_1
|
||||
done
|
||||
for i_p1p1 in $i_p1p1_list
|
||||
do
|
||||
test -n "$i_p1p1" && $IPTABLES -A FORWARD -i + -s $i_p1p1 -j In_RULE_1
|
||||
done
|
||||
for i_em2 in $i_em2_list
|
||||
do
|
||||
test -n "$i_em2" && $IPTABLES -A FORWARD -i + -s $i_em2 -j In_RULE_1
|
||||
done
|
||||
for i_em1 in $i_em1_list
|
||||
do
|
||||
test -n "$i_em1" && $IPTABLES -A FORWARD -i + -s $i_em1 -j In_RULE_1
|
||||
done
|
||||
$IPTABLES -A In_RULE_1 -j LOG --log-level warning --log-prefix "FW-RULE 1 -- DENY " --log-tcp-options --log-ip-options
|
||||
$IPTABLES -A In_RULE_1 -j DROP
|
||||
#
|
||||
# Rule 2 (global)
|
||||
#
|
||||
echo "Rule 2 (global)"
|
||||
#
|
||||
# Allow services in
|
||||
$IPTABLES -N Cid32453X2792.0
|
||||
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 3 -m state --state NEW -j Cid32453X2792.0
|
||||
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 0/0 -m state --state NEW -j Cid32453X2792.0
|
||||
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 8/0 -m state --state NEW -j Cid32453X2792.0
|
||||
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/0 -m state --state NEW -j Cid32453X2792.0
|
||||
$IPTABLES -A INPUT -p icmp -m icmp --icmp-type 11/1 -m state --state NEW -j Cid32453X2792.0
|
||||
$IPTABLES -A INPUT -p tcp -m tcp -m multiport --dports 7,22 -m state --state NEW -j Cid32453X2792.0
|
||||
$IPTABLES -A INPUT -p udp -m udp -m multiport --dports 161,162,514 -m state --state NEW -j Cid32453X2792.0
|
||||
$IPTABLES -A Cid32453X2792.0 -s 70.62.110.169 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 70.62.110.170/31 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 70.62.110.172/31 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 70.62.110.174 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 74.113.229.130/31 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 74.113.229.132/31 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 74.113.229.134 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 192.168.176.0/24 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 192.168.177.0/24 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 192.168.192.0/19 -j ACCEPT
|
||||
$IPTABLES -A Cid32453X2792.0 -s 192.168.224.0/20 -j ACCEPT
|
||||
#
|
||||
# Rule 3 (global)
|
||||
#
|
||||
echo "Rule 3 (global)"
|
||||
#
|
||||
# Allow services out
|
||||
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 3 -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 0/0 -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 8/0 -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/0 -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p icmp -m icmp --icmp-type 11/1 -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p tcp -m tcp --dport 1:9999 -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p udp -m udp --dport 1:9999 -m state --state NEW -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p udp -m udp --dport 33434:33524 -m state --state NEW -j ACCEPT
|
||||
#
|
||||
# Rule 4 (global)
|
||||
#
|
||||
echo "Rule 4 (global)"
|
||||
#
|
||||
# Ignore customer incoming broadcasts
|
||||
$IPTABLES -A INPUT -d 255.255.255.255 -j DROP
|
||||
#
|
||||
# Rule 5 (global)
|
||||
#
|
||||
echo "Rule 5 (global)"
|
||||
#
|
||||
# Ignore chatty stuff
|
||||
$IPTABLES -A INPUT -p tcp -m tcp --dport 139 -j DROP
|
||||
$IPTABLES -A INPUT -p udp -m udp -m multiport --dports 68,67,138,137,6157,5757 -j DROP
|
||||
#
|
||||
# Rule 6 (global)
|
||||
#
|
||||
echo "Rule 6 (global)"
|
||||
#
|
||||
# Ignore multicast
|
||||
$IPTABLES -A INPUT -d 224.0.0.0/4 -j DROP
|
||||
#
|
||||
# Rule 7 (global)
|
||||
#
|
||||
echo "Rule 7 (global)"
|
||||
#
|
||||
# Deny and log catch all
|
||||
$IPTABLES -N RULE_7
|
||||
$IPTABLES -A OUTPUT -j RULE_7
|
||||
$IPTABLES -A INPUT -j RULE_7
|
||||
$IPTABLES -A FORWARD -j RULE_7
|
||||
$IPTABLES -A RULE_7 -j LOG --log-level info --log-prefix "FW-RULE 7 -- DENY " --log-tcp-options --log-ip-options
|
||||
$IPTABLES -A RULE_7 -j DROP
|
||||
}
|
||||
|
||||
ip_forward() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
reset_all() {
|
||||
:
|
||||
reset_iptables_v4
|
||||
}
|
||||
|
||||
block_action() {
|
||||
reset_all
|
||||
}
|
||||
|
||||
stop_action() {
|
||||
reset_all
|
||||
$IPTABLES -P OUTPUT ACCEPT
|
||||
$IPTABLES -P INPUT ACCEPT
|
||||
$IPTABLES -P FORWARD ACCEPT
|
||||
}
|
||||
|
||||
check_iptables() {
|
||||
IP_TABLES="$1"
|
||||
[ ! -e $IP_TABLES ] && return 151
|
||||
NF_TABLES=$(cat $IP_TABLES 2>/dev/null)
|
||||
[ -z "$NF_TABLES" ] && return 152
|
||||
return 0
|
||||
}
|
||||
status_action() {
|
||||
check_iptables "/proc/net/ip_tables_names"
|
||||
ret_ipv4=$?
|
||||
check_iptables "/proc/net/ip6_tables_names"
|
||||
ret_ipv6=$?
|
||||
[ $ret_ipv4 -eq 0 -o $ret_ipv6 -eq 0 ] && return 0
|
||||
[ $ret_ipv4 -eq 151 -o $ret_ipv6 -eq 151 ] && {
|
||||
echo "iptables modules are not loaded"
|
||||
}
|
||||
[ $ret_ipv4 -eq 152 -o $ret_ipv6 -eq 152 ] && {
|
||||
echo "Firewall is not configured"
|
||||
}
|
||||
exit 3
|
||||
}
|
||||
|
||||
# See how we were called.
|
||||
# For backwards compatibility missing argument is equivalent to 'start'
|
||||
|
||||
cmd=$1
|
||||
test -z "$cmd" && {
|
||||
cmd="start"
|
||||
}
|
||||
|
||||
case "$cmd" in
|
||||
start)
|
||||
log "Activating firewall script generated Tue Mar 26 15:39:30 2019 by wia"
|
||||
check_tools
|
||||
prolog_commands
|
||||
check_run_time_address_table_files
|
||||
|
||||
load_modules " "
|
||||
configure_interfaces
|
||||
verify_interfaces
|
||||
|
||||
reset_all
|
||||
|
||||
script_body
|
||||
ip_forward
|
||||
epilog_commands
|
||||
RETVAL=$?
|
||||
;;
|
||||
|
||||
stop)
|
||||
stop_action
|
||||
RETVAL=$?
|
||||
;;
|
||||
|
||||
status)
|
||||
status_action
|
||||
RETVAL=$?
|
||||
;;
|
||||
|
||||
block)
|
||||
block_action
|
||||
RETVAL=$?
|
||||
;;
|
||||
|
||||
reload)
|
||||
$0 stop
|
||||
$0 start
|
||||
RETVAL=$?
|
||||
;;
|
||||
|
||||
interfaces)
|
||||
configure_interfaces
|
||||
RETVAL=$?
|
||||
;;
|
||||
|
||||
test_interfaces)
|
||||
FWBDEBUG="echo"
|
||||
configure_interfaces
|
||||
RETVAL=$?
|
||||
;;
|
||||
|
||||
|
||||
|
||||
*)
|
||||
echo "Usage $0 [start|stop|status|block|reload|interfaces|test_interfaces]"
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
Reference in new issue
Block a user