1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144
|
revision 1.297
Remove adsense from offline manual pages
Fix persmissions on a couple of examples
----------------------------
RCS file: /cvsroot/firehol/firehol/firehol.sh,v
Working file: firehol.sh
head: 1.296
branch:
locks: strict
access list:
symbolic names:
start: 1.1.1.1
vendor: 1.1.1
keyword substitution: kv
total revisions: 297; selected revisions: 297
description:
----------------------------
revision 1.296
date: 2013/01/06 23:49:08; author: ktsaou; state: Exp; lines: +9 -8
Removed depedency to get-iana.sh
It is not usefull any more.
----------------------------
revision 1.295
date: 2013/01/06 23:26:04; author: ktsaou; state: Exp; lines: +11 -8
Updated blackist command so that it does not lead to timeouts when an internal host is trying to reach a blacklisted host.
----------------------------
revision 1.294
date: 2010/10/05 21:10:08; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.293
date: 2010/04/08 22:27:18; author: ktsaou; state: Exp; lines: +16 -16
Removed unnecessary quotes from logs.
----------------------------
revision 1.292
date: 2010/04/08 22:16:03; author: ktsaou; state: Exp; lines: +10 -6
Added service:
sane
----------------------------
revision 1.291
date: 2010/04/08 22:12:35; author: ktsaou; state: Exp; lines: +13 -6
Added services:
ipsecnatt
l2tp
----------------------------
revision 1.290
date: 2010/04/08 21:55:07; author: ktsaou; state: Exp; lines: +7 -7
Fixed bug: 2873689
Mispelled server_yppasswdd.
----------------------------
revision 1.289
date: 2010/04/08 21:51:26; author: ktsaou; state: Exp; lines: +12 -6
Added support for NFLOG as requested per patch 2954470.
----------------------------
revision 1.288
date: 2010/04/06 22:23:16; author: ktsaou; state: Exp; lines: +47 -6
Added support to block concurrent running of FireHOL by multiple admins.
FireHOL uses the lockfile command, if it finds it, allowing to detect
stale locks if 600 seconds have been passed since the last lock.
The lock file is /var/run/firehol.lck
----------------------------
revision 1.287
date: 2009/10/01 10:25:23; author: ktsaou; state: Exp; lines: +8 -7
Fixed issue with TRY and START.
----------------------------
revision 1.286
date: 2009/02/26 02:13:54; author: ktsaou; state: Exp; lines: +128 -61
Added syslog support. FireHOL now logs to syslog all important events.
Variable for the user:
FIREHOL_SYSLOG_FACILITY="daemon"
Default is shown. User can set it in config file.
----------------------------
revision 1.285
date: 2009/02/25 23:30:14; author: ktsaou; state: Exp; lines: +19 -7
Made it detect when the simple services have either server or client ports
defined, but not both.
----------------------------
revision 1.284
date: 2009/02/22 00:35:16; author: ktsaou; state: Exp; lines: +12 -10
Fixed an issue where the wizard/helpme generated too long names.
----------------------------
revision 1.283
date: 2009/02/21 21:42:07; author: ktsaou; state: Exp; lines: +28 -19
Updated the kernel module handling for certain helpers.
----------------------------
revision 1.282
date: 2009/02/19 05:27:49; author: ktsaou; state: Exp; lines: +259 -182
Added helper_<service>="helper" functionality.
This allows to consider as simple all the services which rely on a kernel
netfilter module.
Converted the following services to simple:
amanda, ftp, pptp, tftp
Updated the following simple services to use kernel modules:
h323, GRE, sip
----------------------------
revision 1.281
date: 2009/02/19 02:47:36; author: ktsaou; state: Exp; lines: +8 -8
Fixed ftp helper match to allow only ESTABLISHED or RELATED connections.
Otherwise it would allow NEW connections in the reverse direction too.
----------------------------
revision 1.280
date: 2009/02/19 02:33:08; author: ktsaou; state: Exp; lines: +37 -91
Updated service ftp to match everything with the kernel ftp helper.
Removed incomplete p2p service.
----------------------------
revision 1.279
date: 2009/02/06 04:18:31; author: ktsaou; state: Exp; lines: +8 -6
Service SIP now uses the kernel modules.
----------------------------
revision 1.278
date: 2009/02/05 02:45:00; author: ktsaou; state: Exp; lines: +9 -9
Fixed a copy and paste error in connmark helper.
----------------------------
revision 1.277
date: 2009/02/05 02:03:07; author: ktsaou; state: Exp; lines: +63 -7
Updated RESERVED_IPS for the latest IANA reservations.
Added classify helper for traffic shapping without marks.
Added connmark helper for statefull connection marking to assist the
routing decision (i.e. multiple upstream providers).
----------------------------
revision 1.276
date: 2008/12/02 20:28:02; author: ktsaou; state: Exp; lines: +16 -16
Renamed fixtos to tosfix, optimize it a bit, and added documentation about it.
----------------------------
revision 1.275
date: 2008/12/02 20:01:11; author: ktsaou; state: Exp; lines: +35 -6
Added fixtos helper to mangle packets that may have invalid TOS
----------------------------
revision 1.274
date: 2008/08/09 21:48:02; author: ktsaou; state: Exp; lines: +44 -12
fixed tcpmss issue described in bug 2043915.
It seems that LARTC is very old for this.
----------------------------
revision 1.273
date: 2008/07/31 00:46:41; author: ktsaou; state: Exp; lines: +7 -7
update RESERVED_IPS according to latest IANA reservations.
----------------------------
revision 1.272
date: 2008/04/09 21:03:13; author: ktsaou; state: Exp; lines: +7 -7
Updated IANA reservations.
----------------------------
revision 1.271
date: 2008/03/17 22:08:43; author: ktsaou; state: Exp; lines: +7 -7
Updated for latest IANA reservations format.
----------------------------
revision 1.270
date: 2007/12/11 22:05:24; author: ktsaou; state: Exp; lines: +47 -6
Added service xbox.
This is not final, as it opens all unprivileged UDP ports to anyone from source port UDP 3074.
----------------------------
revision 1.269
date: 2007/12/08 10:39:06; author: ktsaou; state: Exp; lines: +23 -23
Fixed the operation of FIREHOL_DROP_ORPHAN_TCP_ACK_FIN. It did not work
because it was also checking for a NEW state (which is not the case).
----------------------------
revision 1.268
date: 2007/11/30 19:22:36; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.267
date: 2007/10/25 12:34:06; author: ktsaou; state: Exp; lines: +13 -13
Changed all service definitions which can use client ports bellow 1024 to
allow client connections from any possible port, because when natted, these
services will me remapped to client ports bellow 1024 without any
restriction on the port range.
----------------------------
revision 1.266
date: 2007/10/15 00:43:17; author: ktsaou; state: Exp; lines: +95 -37
'less' is no more required. Now FireHOL can use 'less', 'more' or 'cat'
in that order, for a pager.
FireHOL will now correctly use 'zcat', 'gzcat' or 'gzip' for uncompressing
/proc/config.gz, and it will ignore /proc/config.gz if it cannot
find any of these commands (with a warning).
There was a case, where an attacker could use firehol to execute a custom
script, if it was saved at a location where the kernel config file is
expected by firehol, and /proc/config, /proc/config.gz did not exist.
FireHOL now greps the kernel config file for the information it needs, so
this threat has been eliminated.
Updated the line number management of the configuration file, using the
latest user commands offered by firehol.
----------------------------
revision 1.265
date: 2007/10/14 23:02:39; author: ktsaou; state: Exp; lines: +11 -11
Replace gzcat with zcat.
----------------------------
revision 1.264
date: 2007/10/14 23:00:41; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS to latest IANA reservations.
----------------------------
revision 1.263
date: 2007/08/20 02:03:28; author: ktsaou; state: Exp; lines: +8 -8
Made the helpme wizard correctly recognize services listening on the IPv6
equivalent of 0.0.0.0 (::).
----------------------------
revision 1.262
date: 2007/08/20 00:53:22; author: ktsaou; state: Exp; lines: +8 -8
Changed the protections to activate the 'invalid' match last, after all
other protections.
----------------------------
revision 1.261
date: 2007/07/30 22:52:48; author: ktsaou; state: Exp; lines: +39 -39
Various updates in 'helpme' mode.
There is still one issue unsolved: When there are routes to specific nets
befind a gateway, FireHOL checks if the IP of the host or the gateway are
inside the networks routed through the gateway. This is wrong. In several
cases, the network behind a gateway will not include the IP of the gateway
or the IP of the interface the firehol host routes this traffic via.
However, there seems to be no easy solution to this. For PPP interfaces the
IP of the PPP concentrator is included in the IPs that are reported by
'ip route show dev ppp0' as the networks behind this device.
May be the 'scope' paramater of the routing table should be used to exclude
'scope link' routes. If 'scope link' routes are ommitted, the resulting set
could be used to identify the routes behind a router.
----------------------------
revision 1.260
date: 2007/07/26 21:39:50; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.259
date: 2007/07/20 21:28:13; author: ktsaou; state: Exp; lines: +11 -8
Service multicast has been changed to match dst 224.0.0.0/4 proto IGMP and
UDP.
----------------------------
revision 1.258
date: 2007/07/20 21:16:59; author: ktsaou; state: Exp; lines: +49 -18
Various minor fixed.
firehol 'save' now saves also the required kernel modules to restore the
firewall at /var/spool/firehol/last_save_modules.sh.
This is executable already and can be called from boot scripts to load
the kernel modules required when restoring the firewall with:
iptables-restore
----------------------------
revision 1.257
date: 2007/07/20 19:58:38; author: ktsaou; state: Exp; lines: +55 -7
Added helper action:
action [chain <name> <action>]
The action helper creates an iptables chain which can be used to control the
action of other firewall rules during runtime.
For example, you can setup the custom action ACT1, which by default is ACCEPT,
but under certain cases it can be changed to DROP, REJECT or RETURN without
restarting the firewall.
The first argument must always be the word 'chain', for the moment.
name can be any chain name accepted by iptables.
It is suggested to keep it between 5 to 10 letters.
action can be any action supported by FireHOL, although ony ACCEPT,
REJECT, DROP, RETURN may have any meaning under this use.
Example 1:
At the top of firehol.conf, create the action ACT1:
action chain ACT1 accept
later, in interfaces and routers, create rules that use the ACT1 action:
server smtp ACT1
client imap ACT1
Please note that actions created this way are case sensitive.
At some point, and while the firewall is running, the action ACT1 can be
changed to DROP, with this linux command (this is not FireHOL specific):
iptables -t filter -I ACT1 -j DROP
The above command inserts (-I) the new action DROP above the default
action ACCEPT, and therefore all the traffic matching the FireHOL rules that
have the action ACT1 will now be dropped.
To return to the default action (ACCEPT), run the following linux command:
iptables -t filter -D ACT1 -j DROP
This command deletes (-D) the DROP action that was inserted above the
default action. If you delete all actions in the chain ACT1, the default
action will be RETURN, in which case all rules with action ACT1 will be
nutralized (it will be the same as they were not specified at all in
firehol.conf).
Example 2:
action chain "ACT1 ACT2 ACT3" accept chain "ACT4 ACT5 ACT6" drop
will create 6 actions, ACT1, ACT2, ACT3 with ACCEPT, and
ACT4, ACT5, ACT6 with DROP.
----------------------------
revision 1.256
date: 2007/05/22 22:52:53; author: ktsaou; state: Exp; lines: +7 -7
Updated IANA RESERVED_IPS.
----------------------------
revision 1.255
date: 2007/05/06 14:42:43; author: ktsaou; state: Exp; lines: +23 -11
Made firehol correctly identify newer kernel options regarding iptables
modules (applies to kernels 2.6.20+).
----------------------------
revision 1.254
date: 2007/05/05 23:38:31; author: ktsaou; state: Exp; lines: +92 -8
Added support for external definitions of:
RESERVED_IPS
PRIVATE_IPS
MULTICAST_IPS
UNROUTABLE_IPS
in files under the same name in /etc/firehol/.
Only RESERVED_IPS is mandatory (firehol will complain if it is not there,
but it will still work without it), and is also the only file that firehol
checks how old is it. If it is 90+ days old, firehol will complain again.
Changed the supplied get-iana.sh script to generate the RESERVED_IPS file.
FireHOL also instructs the user to use this script if the file is missing
or is too old.
----------------------------
revision 1.253
date: 2007/04/29 18:38:41; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.252
date: 2007/04/29 18:34:55; author: ktsaou; state: Exp; lines: +9 -9
BASH 3.2 support.
The problem is in array variables.
For some reason, an empty array member in BASH 3.1 produces no iptables
arguments, but in BASH 3.2 an empty array member produces an empty iptables
argument which breaks iptables.
----------------------------
revision 1.251
date: 2007/02/04 23:28:41; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.250
date: 2006/11/21 23:41:23; author: ktsaou; state: Exp; lines: +7 -7
Updated latest IANA RESERVED_IPS.
----------------------------
revision 1.249
date: 2006/06/05 17:47:48; author: ktsaou; state: Exp; lines: +11 -6
Applied patch of bug: 1498292, "nfs" service missing ports for "rpc.statd"
----------------------------
revision 1.248
date: 2006/06/05 17:25:33; author: ktsaou; state: Exp; lines: +53 -15
Added support for TARPIT.
Made 'policy' work for routers too.
----------------------------
revision 1.247
date: 2006/04/22 17:26:18; author: ktsaou; state: Exp; lines: +11 -6
Added protection 'bad-packets'.
----------------------------
revision 1.246
date: 2006/03/23 18:50:16; author: ktsaou; state: Exp; lines: +8 -8
Fixed bug 1455569:
When FireHOL has created the
$FIREHOL_SPOOL_DIR, it then runs chown and chmod on
the $FIREHOL_CONFIG_DIR. This looks like a
cut-n-paste error, since it at that point makes more
sense to chown/chmod $FIREHOL_SPOOL_DIR.
----------------------------
revision 1.245
date: 2006/03/12 12:54:55; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS for latest IANA assignements.
----------------------------
revision 1.244
date: 2006/03/11 12:24:34; author: ktsaou; state: Exp; lines: +15 -7
Added service OSPF.
Make the wizard to ommit /32 from IPs since iptables now seems to complain
about it. Check bug: 1435098
----------------------------
revision 1.243
date: 2006/01/18 21:24:22; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.242
date: 2006/01/18 21:20:28; author: ktsaou; state: Exp; lines: +7 -7
Fixed the SIP service to allow port 5060 for the client (had only 'default').
----------------------------
revision 1.241
date: 2005/11/19 09:38:25; author: ktsaou; state: Exp; lines: +7 -7
Added tcp/8333 to vmwareweb
----------------------------
revision 1.240
date: 2005/11/11 21:49:03; author: ktsaou; state: Exp; lines: +70 -9
Added option 'recent' to action 'ACCEPT':
Example:
server smtp accept with recent NAME SECONDS HITS
where
NAME is a name for this RECENT match
SECONDS is a number, or empty ("")
HITS is a number, or empty ("")
Check:
iptables -m recent --help
for more information.
----------------------------
revision 1.239
date: 2005/10/27 23:46:01; author: ktsaou; state: Exp; lines: +9 -6
created a copy of "microsoft_ds" service as "ms_ds" to overcome the issue
of long chain names.
----------------------------
revision 1.238
date: 2005/10/16 08:55:53; author: ktsaou; state: Exp; lines: +24 -6
Added variable FIREHOL_DROP_ORPHAN_TCP_ACK_FIN which once set to 1 in the
config file, it makes FireHOL drop all packets that appear as NEW
connections to the connection tracker but they are TCP and have ACK and FIN
set.
This should eliminate the logs that appear in a few busy environments where
the iptables connection tracker removes entries from its table when it
sees the FIN and therefore the ACK,FIN is considered a NEW connection.
See also https://sourceforge.net/tracker/?func=detail&atid=487693&aid=1326811&group_id=58425
----------------------------
revision 1.237
date: 2005/09/21 21:32:58; author: ktsaou; state: Exp; lines: +16 -13
Made it dynamically detect /var/lock/subsys and switch back to /var/lock
if the first does not exist.
----------------------------
revision 1.236
date: 2005/06/02 16:20:35; author: ktsaou; state: Exp; lines: +7 -7
fixed a bug in negative 'mac' expressions where a faulty rule was generated
for matching mac-source 'any'.
----------------------------
revision 1.235
date: 2005/06/02 15:48:52; author: ktsaou; state: Exp; lines: +7 -7
Allowed 127.0.0.1 to be in RESERVED_IPS
----------------------------
revision 1.234
date: 2005/05/08 23:27:22; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS to current IANA reservations.
----------------------------
revision 1.233
date: 2005/04/18 22:38:23; author: ktsaou; state: Exp; lines: +83 -8
Added 'addrtype' matches, in the form of 'srctype' and 'dsttype' optional
rule parameters.
----------------------------
revision 1.232
date: 2005/04/18 21:00:22; author: ktsaou; state: Exp; lines: +11 -10
Added FIREHOL_LOG_PREFIX.
----------------------------
revision 1.231
date: 2005/04/03 21:48:04; author: ktsaou; state: Exp; lines: +16 -6
Added experimental protection all-floods.
----------------------------
revision 1.230
date: 2005/03/01 19:52:56; author: ktsaou; state: Exp; lines: +7 -6
Made FireHOL trap SIGHUP and cleanup properly on it.
----------------------------
revision 1.229
date: 2005/02/17 23:45:02; author: ktsaou; state: Exp; lines: +64 -19
Made a set of external commands optional in wizard mode, so that FireHOL
will work if these are absent, but will refuse to enter wizard mode.
----------------------------
revision 1.228
date: 2005/02/09 22:36:24; author: ktsaou; state: Exp; lines: +17 -8
Added support for /proc/config.gz for kernel configuration.
This is silently ignored if the command 'gzcat' cannot be found in the
system path.
----------------------------
revision 1.227
date: 2005/02/07 20:56:09; author: ktsaou; state: Exp; lines: +31 -7
Made wget and curl optional. Now they are required only when they are
really needed.
Also, small fixes in ecn_shame helper.
----------------------------
revision 1.226
date: 2005/01/25 21:28:19; author: ktsaou; state: Exp; lines: +10 -10
Remove -p from mkdir commands, in order for them to fail if the directory
to be created already exists.
----------------------------
revision 1.225
date: 2005/01/25 21:07:01; author: ktsaou; state: Exp; lines: +12 -12
Made sure that no files are created anywhere except the firehol temp dir.
Made the firehol temp dir use the $RANDOM variable to randomize its name.
----------------------------
revision 1.224
date: 2005/01/24 22:24:48; author: ktsaou; state: Exp; lines: +8 -8
Fixed service pptp to control GRE traffic in a stateless way.
----------------------------
revision 1.223
date: 2005/01/24 21:23:38; author: ktsaou; state: Exp; lines: +145 -103
Added security checks to directory creation mechanism.
----------------------------
revision 1.222
date: 2005/01/21 19:58:09; author: ktsaou; state: Exp; lines: +9 -6
Added service DICT (kdict, gnome-dictionary).
----------------------------
revision 1.221
date: 2004/12/29 22:34:45; author: ktsaou; state: Exp; lines: +21 -14
Minor fixes for calculating minor firehol version number, added transparent
proxy to line number calculation and fix a typo in the docs.
----------------------------
revision 1.220
date: 2004/12/23 18:43:03; author: ktsaou; state: Exp; lines: +8 -6
The knock was not allowing established connections, and knockd was
inserting a rule with a -s which matched requests but did not match the
replies.
Now, the default is to allow established connections for knock and only
control NEW connections via knockd.
----------------------------
revision 1.219
date: 2004/12/22 23:05:57; author: ktsaou; state: Exp; lines: +38 -8
Small internal changes.
Added support for integration with knockd (http://www.zeroflux.org/knock/)
This integration comes as part of the ACCEPT action:
accept [with knock <name>]
The optional parameter 'with knock' allows easy integration with knockd,
a server that allows you to control access to services, by sending certain
packets to "knock" the door, before the door is open for service.
This parameter accepts just a name. This name is used to build a special
chain knock_<name> which will contain no rules, so that the traffic entering
this chain will just return back and continue to match against the other
rules until the end of the firewall.
As an example, lets say that you want to allow https traffic based on a knock.
In FireHOL you write:
server https accept with knock hidden
and you configure knockd so that it runs:
iptables -A knock_hidden -s %IP% -j ACCEPT
to enable the https service (notice that there is no need to match anything
else than the IP. FireHOL already matches everything needed for its rules
to work), and:
iptables -D knock_hidden -s %IP% -j ACCEPT
to disable this service for the given IP.
----------------------------
revision 1.218
date: 2004/12/21 21:49:11; author: ktsaou; state: Exp; lines: +24 -18
Added helper 'transparent_proxy' and modified 'transparent_squid' to call
the new helper for setting up transparent web proxies.
----------------------------
revision 1.217
date: 2004/12/03 21:29:41; author: ktsaou; state: Exp; lines: +36 -5
Added service TIMESTAMP.
----------------------------
revision 1.216
date: 2004/11/04 19:47:05; author: ktsaou; state: Exp; lines: +7 -7
Fixed a bug in FIREHOL_OUTPUT_ACTIVATION_POLICY which was incorrectly
setting the INPUT policy.
----------------------------
revision 1.215
date: 2004/11/02 00:37:15; author: ktsaou; state: Exp; lines: +38 -5
Added service ANYSTATELESS
----------------------------
revision 1.214
date: 2004/11/01 00:13:00; author: ktsaou; state: Exp; lines: +30 -10
Implemented minor version check on services in /etc/firehol/services
----------------------------
revision 1.213
date: 2004/10/31 03:17:00; author: ktsaou; state: Exp; lines: +9 -6
Fixed a type in DSCP optional rule parameter.
Added line numbering to newly added helpers.
----------------------------
revision 1.212
date: 2004/10/31 02:21:02; author: ktsaou; state: Exp; lines: +497 -256
Added helpers:
tos - to set the TOS of packets
dscp - to set the DSCP field of packets (both raw and class)
Added optional rule parameters:
tos - to match the TOS of packets
mark - to match the MARK ID of packets
dscp - to match the DSCP field of packets (both raw and class)
Added the following actions to the rule() function:
dscp
The rule() function already had support for TOS and MARK.
----------------------------
revision 1.211
date: 2004/10/30 23:03:57; author: ktsaou; state: Exp; lines: +35 -8
Created the complex service DHCP and removed the simple one.
The complex DHCP is now stateless to overcome all the problems that
arise due to the initial DHCP broadcast.
----------------------------
revision 1.210
date: 2004/10/30 22:41:21; author: ktsaou; state: Exp; lines: +16 -12
Service SAMBA now includes MICROSOFT_DS (tcp/445). Also, updated samba
related documentation.
----------------------------
revision 1.209
date: 2004/10/30 21:27:00; author: ktsaou; state: Exp; lines: +18 -8
Some error detection for /etc/firehol/services directory creation.
----------------------------
revision 1.208
date: 2004/10/30 21:13:26; author: ktsaou; state: Exp; lines: +109 -5
Added service NIS.
Created by Carlos Rodrigues <crlf@users.sourceforge.net>
Feature Requests item #1050951 <https://sourceforge.net/tracker/?func=detail&atid=487695&aid=1050951&group_id=58425>
These rules work for client access only!
Pushing changes to slave servers won't work if these rules are active
somewhere between the master and its slaves, because it is impossible to
predict the ports where "yppush" will be listening on each push.
Pulling changes directly on the slaves will work, and could be improved
performance-wise if these rules are modified to open "fypxfrd". This wasn't
done because it doesn't make that much sense since pushing changes on the
master server is the most common, and recommended, way to replicate maps.
----------------------------
revision 1.207
date: 2004/10/28 23:03:06; author: ktsaou; state: Exp; lines: +67 -13
Added support for externally defined services in files under directory:
/etc/firehol/services
This directory may contain files ending with .conf. Example: imap.conf
Each file should *start* with a line like this:
#FHVER: 1
This must be the FIRST line of the file.
The number 1 is the FIREHOL_SERVICES_API version number. If the API within
FireHOL changes, FireHOL will refuse to load all those services files that
their API version number does not match.
----------------------------
revision 1.206
date: 2004/10/28 22:02:43; author: ktsaou; state: Exp; lines: +9 -5
Added service nut.
----------------------------
revision 1.205
date: 2004/10/08 22:30:52; author: ktsaou; state: Exp; lines: +90 -46
Added helper 'tcpmss'.
Added service 'nntps'.
Converted all simple services' port definitions to numeric.
Updated documentation accordingly.
----------------------------
revision 1.204
date: 2004/09/26 00:52:55; author: ktsaou; state: Exp; lines: +55 -6
Added services:
asterisk, darkstat, distcc, eserver, gift, giftui, h323, iax, iax2, icp,
rtp, sip, stun, upnp.
----------------------------
revision 1.203
date: 2004/09/14 21:15:44; author: ktsaou; state: Exp; lines: +119 -7
Added support for options to the ACCEPT action in order to allow
a certain frequency of NEW connections per service.
Now the template for the ACCEPT action is this:
ACCEPT [with limit frequency burst [overflow action]]
for example:
server smtp accept with limit 10/s 100 overflow drop
which means there is now control for the frequency at which NEW incoming
connections are accepted and control is also provided for the overflow
NEW ones.
The default overflow action is REJECT which rejects TCP connections with
TCP-RESET and all others with ICMP-PORT-UNREACHABLE.
To add other optional rule parameters to the server/client/route command
just add them after the ACCEPT expression. For example:
server smtp accept with limit 10/s 1000 src 1.2.3.4
If there are overflow NEW connections, the firewall will log "OVERFLOW"
with the packets and the frequency of loglimit (controled via global
variables).
The overflow action cannot accept parameters.
----------------------------
revision 1.202
date: 2004/09/12 07:24:58; author: ktsaou; state: Exp; lines: +8 -5
Added RDP service.
----------------------------
revision 1.201
date: 2004/09/12 06:57:47; author: ktsaou; state: Exp; lines: +9 -5
Added service NXSERVER.
----------------------------
revision 1.200
date: 2004/09/10 22:07:18; author: ktsaou; state: Exp; lines: +16 -5
Added a warning if wrong arguments are detected.
----------------------------
revision 1.199
date: 2004/09/10 21:36:26; author: ktsaou; state: Exp; lines: +12 -5
Added rquotad to the NFS service.
----------------------------
revision 1.198
date: 2004/08/21 21:07:09; author: ktsaou; state: Exp; lines: +6 -6
Updated RESERVED_IPS according to current IANA reserved IP range.
----------------------------
revision 1.197
date: 2004/07/31 22:31:08; author: ktsaou; state: Exp; lines: +31 -33
Due to a bug in BASH 3.0, the unset bash function corrupts array variables.
Changed FireHOL to set all variables to empty instead of unseting them.
----------------------------
revision 1.196
date: 2004/07/29 22:31:14; author: ktsaou; state: Exp; lines: +12 -6
Added documentation for DHCP and dropped packets.
Changed radius definition to use port numbers instead of port names
(gentoo has different names).
Added RADIUSPROXY and RADIUSOLDPROXY services.
----------------------------
revision 1.195
date: 2004/07/07 22:09:31; author: ktsaou; state: Exp; lines: +14 -7
Added variable FIREHOL_TRUST_LOOPBACK=1 which if set to 0, FireHOL will not
trust the lo interface allowing the admin to setup a firewall on it.
----------------------------
revision 1.194
date: 2004/05/15 10:19:01; author: ktsaou; state: Exp; lines: +9 -5
Added an iptables -nxvL command at the top of firehol.sh to initialize
iptables. Without it a few users have reported problems using firehol
during boot.
----------------------------
revision 1.193
date: 2004/05/05 23:41:19; author: ktsaou; state: Exp; lines: +88 -11
Added helper 'ecn_shame' that once called, it looks if ECN is enabled in
the kernel, and if it is, it fetches:
http://urchin.earth.li/cgi-bin/ecn.pl?output=ip
and disables ECN for all communication with these hosts.
----------------------------
revision 1.192
date: 2004/05/04 21:39:33; author: ktsaou; state: Exp; lines: +76 -5
Added grouping functionality. This is not yet finished. It has been added
to allow other developers test the functionality before optimizing all the
rules to use groups.
To use grouping, within an interface or router write:
group with [optional rule parameters]
server x accept
server y accept
group end
This will generate a much more optimized version of:
server "x y" accept [optional rule parameters]
by applying all the optional rule parameters once (instead of once per
service).
----------------------------
revision 1.191
date: 2004/04/23 22:15:18; author: ktsaou; state: Exp; lines: +26 -15
Made the nat helpers print their real statements instead of always
appearing as 'nat'.
----------------------------
revision 1.190
date: 2004/04/23 07:36:12; author: ktsaou; state: Exp; lines: +7 -7
Changed two:
tr [a-z] [A-Z]
to:
tr a-z A-Z
because a few versions of tr complain with the first format.
----------------------------
revision 1.189
date: 2004/04/23 07:32:01; author: ktsaou; state: Exp; lines: +6 -6
Fixed a printf that was giving errors because an argument was not numeric.
----------------------------
revision 1.188
date: 2004/04/21 22:57:11; author: ktsaou; state: Exp; lines: +5 -7
Removed the "press return to continue" from the 'debug' mode.
----------------------------
revision 1.187
date: 2004/04/21 22:39:40; author: ktsaou; state: Exp; lines: +12 -7
FireHOL now checks that /var/lock/subsys (the dir RH uses for startup
services lock files) exists before using it.
----------------------------
revision 1.186
date: 2004/04/21 22:23:10; author: ktsaou; state: Exp; lines: +8 -5
Added service WHOIS.
----------------------------
revision 1.185
date: 2004/04/21 21:48:32; author: ktsaou; state: Exp; lines: +10 -5
Kernel configuration is now searched in this order:
1. /proc/config
2. /lib/modules/`uname -r`/build/.config
3. /boot/config-`uname -r`
4. /usr/src/linux/.config
Check No 3 was added now.
----------------------------
revision 1.184
date: 2004/04/21 21:35:29; author: ktsaou; state: Exp; lines: +108 -49
IMPORTANT: My second kid was born a week ago!
Added a lot of information to the generated iptables command line to
debug both the commands generated and what FireHOL did.
Fixed a bug in kernel module management: check_kernel_module() was supposed
to be a runtime function, but accidentaly I had it generating commands
to be run later - which of course were not run.
----------------------------
revision 1.183
date: 2004/04/01 23:30:28; author: ktsaou; state: Exp; lines: +19 -9
Added finer control to control INVALID packets.
The default is now not to drop invalid packets globaly, but to drop them
as part of the protection statement (i.e. protection invalid). The default
full/strong/all protections include the invalid match.
To enable invalid packets dropping globaly (the previous behaviour) one
can give:
FIREHOL_DROP_INVALID=1
at the top of the configuration file.
----------------------------
revision 1.182
date: 2004/03/04 22:05:53; author: ktsaou; state: Exp; lines: +5 -6
Removed a tcp-flags match from protection because it was a subset of
another one already defined.
----------------------------
revision 1.181
date: 2004/03/03 23:18:43; author: ktsaou; state: Exp; lines: +40 -36
Fixed the required commands finder to stop properly when some system
command is not found in the system path.
----------------------------
revision 1.180
date: 2004/03/03 22:19:15; author: ktsaou; state: Exp; lines: +6 -5
Added:
--tcp-flags SYN,RST,PSH,ACK,URG SYN,RST,PSH,URG
to the list of malformed packets.
----------------------------
revision 1.179
date: 2004/03/03 21:24:41; author: ktsaou; state: Exp; lines: +12 -15
Minor mac optional rule parameter fix.
----------------------------
revision 1.178
date: 2004/03/03 20:32:35; author: ktsaou; state: Exp; lines: +11 -6
Completed the mac optional rule parameter. This was implemented since
v1.134 but it was producing rules for both input and output packets.
Now, it produces mac rules only for packets comming in the firewall
(interfaces and routers).
----------------------------
revision 1.177
date: 2004/02/07 00:43:11; author: ktsaou; state: Exp; lines: +6 -6
BUG 891471:
Multicast CIDR block is actually 224.0.0.0/4.
It extends from 224-239.
Fixed.
----------------------------
revision 1.176
date: 2004/01/10 18:44:39; author: ktsaou; state: Exp; lines: +8 -6
Further optimized and reduced PRIVATE_IPS using:
http://www.vergenet.net/linux/aggregate/
The supplied get-iana.sh uses 'aggregate-flim' if it finds it in the path.
(aggregate-flim is the name of this program when installed on Gentoo)
----------------------------
revision 1.175
date: 2004/01/02 22:32:28; author: ktsaou; state: Exp; lines: +6 -6
Fixed a warning generated incorrectly by the mark helper.
----------------------------
revision 1.174
date: 2003/12/29 22:46:00; author: ktsaou; state: Exp; lines: +7 -7
Aesthetic changes.
----------------------------
revision 1.173
date: 2003/12/29 22:40:11; author: ktsaou; state: Exp; lines: +70 -11
Added count of iptables commands generated.
----------------------------
revision 1.172
date: 2003/12/01 05:03:11; author: ktsaou; state: Exp; lines: +17 -8
Added FIREHOL_LOG_MODE which can either be LOG or ULOG to select the
logging mode for iptables. All FireHOL optional rule parameters use this.
Updated documentation to reflect the change.
----------------------------
revision 1.171
date: 2003/11/23 19:27:58; author: ktsaou; state: Exp; lines: +6 -6
Changed a "head -1" to "head -n 1" because head does not support the first
syntax anymore. Thanks to Maik Schreiber <blizzy@blizzy.de> for reporting
this.
----------------------------
revision 1.170
date: 2003/11/23 13:43:19; author: ktsaou; state: Exp; lines: +11 -5
Added support for kernel config in /lib/modules/`uname -r`/build/.config
Updated documentation.
----------------------------
revision 1.169
date: 2003/11/18 23:00:48; author: ktsaou; state: Exp; lines: +6 -6
There was an extra - (minus) in the iptables command generation for
negative protocol expressions. Fixed.
----------------------------
revision 1.168
date: 2003/11/04 21:43:02; author: ktsaou; state: Exp; lines: +21 -6
NETBIOS initiates based on the broadcast address of an interface
(request goes to broadcast address) but the server responds from
its own IP address. This makes the server samba accept statement
drop the server reply.
Bellow is a hack, that allows a linux samba server to respond
correctly, as it allows new outgoing connections from the well
known netbios-ns port to the clients high ports.
For clients and routers this hack is not applied because it
would be a huge security hole.
----------------------------
revision 1.167
date: 2003/11/03 20:43:09; author: ktsaou; state: Exp; lines: +6 -6
Added again 172.16.0.0/12 to PRIVATE_IPS.
----------------------------
revision 1.166
date: 2003/10/26 21:40:30; author: ktsaou; state: Exp; lines: +67 -56
Fixed PRIVATE_IPS (there was an duplicate entry and a wrong entry).
----------------------------
revision 1.165
date: 2003/10/26 21:27:31; author: ktsaou; state: Exp; lines: +102 -8
Changed kernel module management to read kernel configuration and detect
if a module is compiled in the kernel or needs to be loaded separately.
(note: this is not finished yet)
----------------------------
revision 1.164
date: 2003/10/22 06:58:27; author: ktsaou; state: Exp; lines: +6 -6
Changed TIME service ports to numeric since a few versions of bash get
confused by the use of the reserved keywork "time".
----------------------------
revision 1.163
date: 2003/10/20 17:49:56; author: ktsaou; state: Exp; lines: +7 -7
Fixed service CUPS according to the following:
> The firehol system defines the 'cups' protocol as:
>
> server_cups_ports="tcp/631"
> client_cups_ports="default"
>
> This isn't a complete definition - CUPS also has an internal printer
> browsing protocol that operates over UDP, on port 631.
>
> The following definition is more correct:
>
> server_cups_ports="tcp/631 udp/631"
> client_cups_ports="default 631"
----------------------------
revision 1.162
date: 2003/10/18 09:40:45; author: ktsaou; state: Exp; lines: +8 -5
Added Distributed Checksum Clearinghouses (DCC) service.
----------------------------
revision 1.161
date: 2003/10/16 22:05:22; author: ktsaou; state: Exp; lines: +194 -84
Added the PHYSIN and PHYSOUT optional rule parameters to match the
physical network interface in cases where iptables defines as inface
and outface a virtual interface such as a bridge.
----------------------------
revision 1.160
date: 2003/10/13 18:50:30; author: ktsaou; state: Exp; lines: +13 -5
Added services ORACLE and GKRELLMD.
----------------------------
revision 1.159
date: 2003/10/09 10:01:26; author: ktsaou; state: Exp; lines: +9 -5
Added service Veritas NetBackup.
----------------------------
revision 1.158
date: 2003/10/07 22:31:06; author: ktsaou; state: Exp; lines: +12 -7
Added lockd support in service NFS, as suggested by
"Daniel Pittman" <daniel@rimspace.net>
----------------------------
revision 1.157
date: 2003/10/06 00:17:23; author: ktsaou; state: Exp; lines: +18 -6
Fixed TFTP service according to Goetz Bock <bock@blacknet.de> suggestions.
----------------------------
revision 1.156
date: 2003/10/05 22:58:57; author: ktsaou; state: Exp; lines: +110 -68
Cleaned up all complex services.
Added complex service TFTP.
----------------------------
revision 1.155
date: 2003/09/18 20:54:25; author: ktsaou; state: Exp; lines: +8 -5
When I first started FireHOL (about a year before) I started with the
header part of /etc/init.d/iptables (of redhat 7.2). This header
just checked the kernel version and made a check on whether ipchains
was running. If any of the above was faulty (kernel version less than
2.3 or ipchains loaded into the kernel) it was exiting silently.
Although I still keep this logic, now FireHOL will print a warning
instead of just exiting silently.
----------------------------
revision 1.154
date: 2003/09/13 01:03:46; author: ktsaou; state: Exp; lines: +26 -5
Added helper 'mark'
Abstract from the documentation:
mark <NUMBER> <WHERE> [optional rule parameters]
The mark helper marks the traffic with a specific mark NUMBER
that can be matched by traffic shapping tools for controlling the
traffic.
Parameters
* NUMBER is a number to mark the packets with.
* WHERE tells FireHOL where to search for the specific traffic
to be marked.
Currently, WHERE can be one of the build-in iptables chains
attached to table mangle. (for example: INPUT, FORWARD, OUTPUT,
PREROUTING, POSTROUTING - case does matter here).
* optional rule parameters is a set of rules that allow further
restriction of the traffic that gets matched by this rule.
See Optional Rules Parameters for more information.
Example 1: mark 1 OUTPUT
will mark with 1 all packets send by the local machine.
Example 2: mark 2 FORWARD
will mark with 2 all packets passing through the local machine.
Example 3: mark 3 FORWARD proto tcp dport 25 dst 1.1.1.1 src 2.2.2.2
will match with 3 all packets sent by 2.2.2.2, passing through the
local machine and targeting port TCP/25 of host 1.1.1.1.
----------------------------
revision 1.153
date: 2003/08/31 22:21:49; author: ktsaou; state: Exp; lines: +8 -5
Added service XDMCP.
----------------------------
revision 1.152
date: 2003/08/23 23:26:50; author: ktsaou; state: Exp; lines: +6 -6
Bug #793889:
Change #!/bin/sh to #!/bin/bash to allow FireHOL run on systems that
bash is not linked to /bin/sh.
----------------------------
revision 1.151
date: 2003/08/23 22:50:14; author: ktsaou; state: Exp; lines: +7 -7
Bug #893887:
Added -q to modprobe in order not to complain about modules already
loaded in kernel 2.6.x with module-init-tools
----------------------------
revision 1.150
date: 2003/08/23 22:27:34; author: ktsaou; state: Exp; lines: +35 -11
Made the blacklist helper produce only one set of chains for all its runs.
This will keep the produced rules clearer and the firewall smaller.
----------------------------
revision 1.149
date: 2003/08/23 21:42:35; author: ktsaou; state: Exp; lines: +54 -5
Added "blacklist" helper to create blacklists.
Abstract from the documentation:
blacklist [option] <IP>
The blacklist helper creates a blacklist for the IP addresses given.
It supports two modes of operation based on the option given (or the
absence of it).
The option can be:
* one of the words them, him, her, it, this, these, input in which
case it will generate a unidirectional statefull blacklist,
meaning that you will be able to ask (initiate connections)
anything from them, but they will not be able to ask (initiate
connections) anything from you or the remote hosts you protect
(routing).
* one of the words all, full or ommitted (no option given), in
which case FireHOL will create bidirectional stateless rules
that will DROP all traffic comming in from these IPs and will
REJECT all traffic going to them.
The blacklist helper affects both interfaces and routers.
Example 1: blacklist this 195.97.5.202
Example 2: blacklist full 195.97.5.202
Suggested by: Mikkel Schubert
----------------------------
revision 1.148
date: 2003/08/19 22:21:32; author: ktsaou; state: Exp; lines: +6 -6
Fixed a minor bug in kernel module handling that made it not detect that
ip_tables is already compiled (or loaded) in the kernel.
----------------------------
revision 1.147
date: 2003/07/31 20:44:45; author: ktsaou; state: Exp; lines: +7 -7
More Gentoo compatibility (mainly change of port names to port numbers in
services).
----------------------------
revision 1.146
date: 2003/07/27 22:58:59; author: ktsaou; state: Exp; lines: +21 -8
Minor changes for gentoo compatibility (SAVE feature)
.
----------------------------
revision 1.145
date: 2003/07/20 22:45:50; author: ktsaou; state: Exp; lines: +43 -7
Added service HYLAFAX, although experimental.
----------------------------
revision 1.144
date: 2003/07/20 22:14:28; author: ktsaou; state: Exp; lines: +37 -37
As suggested by "Francisco Javier Félix Belmonte" <ffelix@gescosoft.com>
fixed all EOF statements in order to produce cleaner iptables run script.
----------------------------
revision 1.143
date: 2003/07/20 21:52:41; author: ktsaou; state: Exp; lines: +8 -5
Added service POSTGRES.
----------------------------
revision 1.142
date: 2003/07/20 21:50:29; author: ktsaou; state: Exp; lines: +8 -5
Added TIME service.
----------------------------
revision 1.141
date: 2003/07/20 21:48:01; author: ktsaou; state: Exp; lines: +6 -6
Changed service CUPS ports to numeric. Gentoo does not have this defined.
----------------------------
revision 1.140
date: 2003/07/20 21:46:41; author: ktsaou; state: Exp; lines: +131 -86
Added --cmd-owner support.
----------------------------
revision 1.139
date: 2003/06/30 22:18:46; author: ktsaou; state: Exp; lines: +8 -5
Added service webmin.
----------------------------
revision 1.138
date: 2003/06/30 22:07:01; author: ktsaou; state: Exp; lines: +11 -5
Added jabber and jabberd services.
----------------------------
revision 1.137
date: 2003/06/28 23:22:49; author: ktsaou; state: Exp; lines: +9 -7
Aesthetic changes in mac helper.
----------------------------
revision 1.136
date: 2003/06/28 21:26:20; author: ktsaou; state: Exp; lines: +6 -6
Updated service LPD according to RFCs, and now it accepts only ports
721 to 731 inclusive, plus the default client ports.
----------------------------
revision 1.135
date: 2003/06/28 20:52:09; author: ktsaou; state: Exp; lines: +7 -7
Reverted DEFAULT_CLIENT_PORTS to 1024+ (was 1000+)
Made LPD client ports "any".
----------------------------
revision 1.134
date: 2003/06/18 22:56:24; author: ktsaou; state: Exp; lines: +120 -52
Added the "mac" optional rule parameter, that matches the source mac
address of packets.
Added the "mac" helper that verifies that packets comming in from a
specific source IP address, always come from a specific MAC address.
This applies to the whole firewall (INPUT and FORWARD).
----------------------------
revision 1.133
date: 2003/06/18 21:44:52; author: ktsaou; state: Exp; lines: +19 -5
Added FIREHOL_INPUT_ACTIVATION_POLICY, FIREHOL_OUTPUT_ACTIVATION_POLICY,
and FIREHOL_FORWARD_ACTIVATION_POLICY to control the firewall default
policy during firewall activation.
----------------------------
revision 1.132
date: 2003/06/11 07:00:24; author: ktsaou; state: Exp; lines: +7 -7
Optimized RESERVED_IPS as suggested by Marc 'HE' Brockschmidt
<marc@marcbrockschmidt.de>.
----------------------------
revision 1.131
date: 2003/06/10 21:27:46; author: ktsaou; state: Exp; lines: +11 -5
Added MSN and DCPP services.
----------------------------
revision 1.130
date: 2003/06/10 20:44:27; author: ktsaou; state: Exp; lines: +7 -8
Added man page for firehol.conf, contributed by
"Marc 'HE' Brockschmidt" <marc@marcbrockschmidt.de>
Thanks Marc.
----------------------------
revision 1.129
date: 2003/05/22 19:39:53; author: ktsaou; state: Exp; lines: +56 -29
Made FireHOL mv /etc/firehol.conf to /etc/firehol/firehol.conf, if
/etc/firehol (directory) does not exist.
Also, made _CMD variables better detect wrong situations, such as
multiple instanses of the same command, command not found, etc.
----------------------------
revision 1.128
date: 2003/05/01 01:30:24; author: ktsaou; state: Exp; lines: +9 -9
Made default config in /etc/firehol/firehol.conf to comform with various
distributions that prefer it this way (Gentoo).
This will also allow to have services.d within this directory.
----------------------------
revision 1.127
date: 2003/04/30 23:29:47; author: ktsaou; state: Exp; lines: +9 -9
"Marc 'HE' Brockschmidt" <marc@marcbrockschmidt.de> wrote:
Today, I've tried to debianize firehol, but noticed a few problems
(eg. the need for a force-reload-option for every init-script [you could
realize it as an alias for restart]).
I've corrected a few " !!!" (As a reader of Terry Pratchett, I had to
kill them ;-)
I'm attaching a patch for these issues.
I've also created a manpage for FireHOL, and I'm working on the manpage
for firehole.conf.
---
Thank you Marc.
----------------------------
revision 1.126
date: 2003/04/24 08:15:08; author: ktsaou; state: Exp; lines: +6 -6
Fixed a 'touch' cmd to use the external command system.
----------------------------
revision 1.125
date: 2003/04/24 08:12:51; author: ktsaou; state: Exp; lines: +12 -5
Made HELPME detect duplicate routers and prevent multiple definitions
of them.
----------------------------
revision 1.124
date: 2003/04/23 20:42:26; author: ktsaou; state: Exp; lines: +18 -7
Eliminated duplicate router definitions in HELPME, when an interface
has multiple IPs on the same subnet.
----------------------------
revision 1.123
date: 2003/04/20 10:18:10; author: ktsaou; state: Exp; lines: +27 -7
FireHOL now stops the firewall with its own logic (without calling
/etc/init.d/iptables) since some distribution do not have this.
----------------------------
revision 1.122
date: 2003/04/18 20:52:44; author: ktsaou; state: Exp; lines: +48 -13
Module management can now be controlled with FIREHOL_LOAD_KERNEL_MODULES.
Default value is 1, it can be set to 0 to disable module management.
Also, now FireHOL automatically detects if ip_tables and ip_conntrack
are build into the kernel, by looking for relative files in /proc/net.
----------------------------
revision 1.121
date: 2003/04/08 00:12:02; author: ktsaou; state: Exp; lines: +184 -150
Removed all hard-coded references to external commands and made a dynamic
list at the top of FireHOL. Now FireHOL will refuse to run if some command
is missing.
----------------------------
revision 1.120
date: 2003/03/19 21:51:56; author: ktsaou; state: Exp; lines: +16 -6
Fixed MIRROR statements to produce REJECT on the OUTPUT of the host.
----------------------------
revision 1.119
date: 2003/03/18 21:27:35; author: ktsaou; state: Exp; lines: +9 -9
Copyright notices now print year 2003.
----------------------------
revision 1.118
date: 2003/03/17 23:03:00; author: ktsaou; state: Exp; lines: +13 -6
Cosmetic changes in 'helpme'
----------------------------
revision 1.117
date: 2003/03/17 22:57:26; author: ktsaou; state: Exp; lines: +7 -6
Fixed broken 'helpme' detection of networks behind gateways. Now it works.
----------------------------
revision 1.116
date: 2003/03/17 22:42:18; author: ktsaou; state: Exp; lines: +46 -9
'helpme' now detects multiple overlapping networks defined for the same
interface. In such cases it only defines the wider network.
----------------------------
revision 1.115
date: 2003/03/16 22:13:30; author: ktsaou; state: Exp; lines: +138 -50
Made 'helpme' detect point-to-point routes better.
----------------------------
revision 1.114
date: 2003/03/15 01:24:19; author: ktsaou; state: Exp; lines: +8 -5
Added service 'socks'.
----------------------------
revision 1.113
date: 2003/03/15 00:59:27; author: ktsaou; state: Exp; lines: +25 -5
'panic' now prevent you from loosing the SSH you are issuing this command
by allowing the established connection specified in the environment
variable SSH_CLIENT (only if it exists: it is lost if you su -, you should
su without the minus).
Also, the panic argument takes one optional argument. This can be an IP
address in which case all established connections between the host and this
IP will be allowed.
----------------------------
revision 1.112
date: 2003/03/14 21:22:37; author: ktsaou; state: Exp; lines: +6 -6
The squid service has been defined with numeric port numbers because
Debian systems have not this service defined.
----------------------------
revision 1.111
date: 2003/03/14 20:59:07; author: ktsaou; state: Exp; lines: +26 -7
Command line argument 'panic' does not call the system's iptables script
but blocks all traffic by itself, since many systems do not have the
'panic' argument.
----------------------------
revision 1.110
date: 2003/03/14 20:36:52; author: ktsaou; state: Exp; lines: +30 -10
Added FIREHOL_AUTOSAVE variable that controls the file that is saved with
the 'save' argument of FireHOL. By default this variable is empty in which
case FireHOL detects RedHat and Debian systems and saves it to the right
place.
----------------------------
revision 1.109
date: 2003/03/07 23:34:29; author: ktsaou; state: Exp; lines: +7 -5
'helpme' now allows ICMP traffic by default.
----------------------------
revision 1.108
date: 2003/03/07 23:17:38; author: ktsaou; state: Exp; lines: +15 -15
Fixed double quoting in router statements produced by 'helpme'.
----------------------------
revision 1.107
date: 2003/03/07 23:12:15; author: ktsaou; state: Exp; lines: +15 -7
'helpme' handles multiple networks in router statements.
----------------------------
revision 1.106
date: 2003/03/07 23:01:31; author: ktsaou; state: Exp; lines: +6 -6
'helpme' mode does not require a configuration file present.
----------------------------
revision 1.105
date: 2003/03/07 09:19:19; author: ktsaou; state: Exp; lines: +6 -6
Made it not ignore the default route in 'helpme' routers.
----------------------------
revision 1.104
date: 2003/03/06 08:18:49; author: ktsaou; state: Exp; lines: +17 -14
Minor changes in 'helpme' generation.
----------------------------
revision 1.103
date: 2003/03/05 22:06:51; author: ktsaou; state: Exp; lines: +23 -14
Made it ignore a default gateway when there was a P-t-P default gateways
found.
----------------------------
revision 1.102
date: 2003/03/05 18:23:57; author: ktsaou; state: Exp; lines: +106 -72
Made the 'helpme' feature append another interface for the default gateway.
----------------------------
revision 1.101
date: 2003/03/05 00:33:56; author: ktsaou; state: Exp; lines: +23 -10
Minor changes in the default help page presented by FireHOL.
----------------------------
revision 1.100
date: 2003/03/05 00:11:56; author: ktsaou; state: Exp; lines: +232 -154
Re-wrote 'helpme' to detect multiple IPs and networks per interfaces,
and to produce multiple interfaces for each IP. This means that FireHOL
is somewhat smart to match IPs with networks and interfaces, to detect
networks behind gateways, default gateways on point-to-point interfaces,
and to produce router statements matching the interfaces detected above.
----------------------------
revision 1.99
date: 2003/03/03 21:51:04; author: ktsaou; state: Exp; lines: +22 -10
Made 'helpme' ignore interfaces that do not have an IP or no traffic is
routed to them (no route).
----------------------------
revision 1.98
date: 2003/02/26 22:26:16; author: ktsaou; state: Exp; lines: +6 -6
Minor changes in 'helpme' and changes in documentation to reflect the
'helpme' feature addition.
----------------------------
revision 1.97
date: 2003/02/25 21:35:06; author: ktsaou; state: Exp; lines: +151 -61
'helpme' now produces router statements for each network each interface
is attached to. This produces templates to be used in cases where one
interface is used for routing traffic between multiple networks.
Additionally, 'helpme' produces example SNAT statements to be used instead
of masquerade when the IPs of the interfaces are statically assigned.
----------------------------
revision 1.96
date: 2003/02/24 23:30:21; author: ktsaou; state: Exp; lines: +48 -58
The helpme wizard now detects interfaces using:
ip link show
detects interface IPs using:
ip addr show
and detects interface networks using:
ip route show
This makes the 'helpme' wizard support any kind of interfaces,
configurations and interfaces aliases.
----------------------------
revision 1.95
date: 2003/02/22 03:50:55; author: ktsaou; state: Exp; lines: +15 -7
Minor changes to helpme output.
----------------------------
revision 1.94
date: 2003/02/22 03:41:16; author: ktsaou; state: Exp; lines: +203 -33
The helpme command line argument is now somewhat useful.
It produces a FireHOL configuration file in standard output.
----------------------------
revision 1.93
date: 2003/02/21 23:47:22; author: ktsaou; state: Exp; lines: +6 -5
Added a modprobe ip_tables before iptables-save to make sure that the
later will not fail during boot.
----------------------------
revision 1.92
date: 2003/02/20 22:32:56; author: ktsaou; state: Exp; lines: +126 -5
Fixed snmptrap and syslog.
Added the still 'under construction' wizard mode.
----------------------------
revision 1.91
date: 2003/02/18 20:42:20; author: ktsaou; state: Exp; lines: +4 -4
Updated RESERVED_IPS according to the latest IANA Reserved IPv4 address
space.
----------------------------
revision 1.90
date: 2003/02/11 22:20:07; author: ktsaou; state: Exp; lines: +25 -9
Added /sbin in front of two sysctl statements that were producing errors
in a few systems.
Added control option FIREHOL_LOG_LEVEL and the optional argument 'level'
to the 'log' parameter in order to accept custom log levels per rule.
Now, to have different log levels, one could write:
server dhcp accept log "my-dhcp" src 1.1.1.1
to get the default controlled by FIREHOL_LOG_LEVEL, or
server dhcp accept log "my-dhcp" level critical src 1.1.1.1
Note that the 'level' is NOT a FireHOL optional rule parameter. It is an
optional argument to the 'log' parameter. This for example is invalid:
server dhcp accept level critical log "my-dhcp" src 1.1.1.1
The new definition of the 'log' optional rule parameter is:
log "some text" [level a_level]
----------------------------
revision 1.89
date: 2003/02/03 23:11:49; author: ktsaou; state: Exp; lines: +52 -3
Added service emule.
----------------------------
revision 1.88
date: 2003/01/30 21:39:36; author: ktsaou; state: Exp; lines: +6 -6
Fixed a typo.
----------------------------
revision 1.87
date: 2003/01/30 21:36:07; author: ktsaou; state: Exp; lines: +65 -15
Added TOS and MARK actions in FireHOL's core to support Type-Of-Service and
MARKing (for traffic shapping) in the future.
Also, added an error handler that detects use of SNAT, DNAT, REDIRECT
outside the 'nat' table and TOS, MARK outside the 'mangle' table.
----------------------------
revision 1.86
date: 2003/01/29 23:19:20; author: ktsaou; state: Exp; lines: +26 -12
The nat helper was wrongly producing duplicate logs when log/loglimit was
present in the optional rule parameters. Fixed.
----------------------------
revision 1.85
date: 2003/01/28 19:47:31; author: ktsaou; state: Exp; lines: +4 -4
Made masquerade handle correctly interfaces given directly to it.
----------------------------
revision 1.84
date: 2003/01/28 19:42:09; author: ktsaou; state: Exp; lines: +4 -4
Made it handle the 'reverse' keyword of masquerade correctly.
----------------------------
revision 1.83
date: 2003/01/25 02:33:59; author: ktsaou; state: Exp; lines: +77 -36
FireHOL now supports runtime ERRORs and WARNINGs.
ERRORs are assumed to be situations where FireHOL cannot continue, and it
will exit just after restoring the previous firewall.
WARNINGs are situations where FireHOL cannot determine if the firewall
will or won't work, and it will just present the warning and continue.
----------------------------
revision 1.82
date: 2003/01/25 01:46:11; author: ktsaou; state: Exp; lines: +15 -9
Made FireHOL not stop processing if some required kernel module is not
present. This behaviour is required when the required module is compiled
in the kernel, instead of being a module.
However, FireHOL still calls /sbin/modprobe which will print some error
to the console (this will not make FireHOL stop functioning).
----------------------------
revision 1.81
date: 2003/01/25 00:37:37; author: ktsaou; state: Exp; lines: +25 -9
Added redirect helper to implement port redirections.
----------------------------
revision 1.80
date: 2003/01/22 21:14:21; author: ktsaou; state: Exp; lines: +4 -4
Fixed a small typo.
----------------------------
revision 1.79
date: 2003/01/22 21:02:43; author: ktsaou; state: Exp; lines: +11 -5
Added some comments to the just added code.
----------------------------
revision 1.78
date: 2003/01/22 20:54:05; author: ktsaou; state: Exp; lines: +56 -93
Fixed a bug in 'REJECT with auto' that made FireHOL produce wrong iptables
statements in some versions of BASH.
Fixed a problem of some early 2.4 kernels where not all mangle default
chains are defined. Now, FireHOL detects which chains are present.
----------------------------
revision 1.77
date: 2003/01/22 19:13:27; author: ktsaou; state: Exp; lines: +5 -5
Some text changes.
----------------------------
revision 1.76
date: 2003/01/20 22:10:56; author: ktsaou; state: Exp; lines: +15 -5
Allowed multiple 'to' arguments to DNAT and SNAT.
----------------------------
revision 1.75
date: 2003/01/20 21:50:36; author: ktsaou; state: Exp; lines: +6 -3
Added service cvspserver as suggested by Florian Thiel <thiel@ksan.de>
----------------------------
revision 1.74
date: 2003/01/16 00:55:36; author: ktsaou; state: Exp; lines: +38 -27
Made snat and dnat use one core function named 'nat'.
----------------------------
revision 1.73
date: 2003/01/16 00:33:26; author: ktsaou; state: Exp; lines: +166 -70
Added experimental "snat" and "dnat" helpers.
----------------------------
revision 1.72
date: 2003/01/14 21:49:23; author: ktsaou; state: Exp; lines: +5 -5
*** empty log message ***
----------------------------
revision 1.71
date: 2003/01/13 23:31:03; author: ktsaou; state: Exp; lines: +406 -281
Added user (uid), group (gid), process (pid), session (sid) to optional
rule parameters. Modified FireHOL to apply such parameters only to
traffic send by the localhost and silently ignore them on incoming and
passing through traffic.
----------------------------
revision 1.70
date: 2003/01/08 23:33:25; author: ktsaou; state: Exp; lines: +68 -6
Added detection of overwritten optional rule parameters.
----------------------------
revision 1.69
date: 2003/01/08 22:42:46; author: ktsaou; state: Exp; lines: +9 -6
changed helpers to overwrite illegal optional parameters in order to avoid
building rules that match nothing.
transparent_squid now passes some rule parameters to the rules matching
the user ids. This makes it possible to use succesfully negative rules,
such as:
dst not "A B C"
to make the transparent cache exclude these.
----------------------------
revision 1.68
date: 2003/01/07 20:21:57; author: ktsaou; state: Exp; lines: +39 -30
Made transparent_squid accept multiple users
----------------------------
revision 1.67
date: 2003/01/07 01:51:47; author: ktsaou; state: Exp; lines: +4 -22
Made internal parameters of masquerade to overwrite its optional ones.
Made the version command optional.
----------------------------
revision 1.66
date: 2003/01/06 16:13:34; author: ktsaou; state: Exp; lines: +186 -93
The previous implementation of the "with" parameter was conflicting with
negative expressions. Fixed.
Now each action (ACCEPT, REJECT, etc) can have each own optional rule
parameters. Currently only REJECT (with) and REDIRECT (to-port) have
such parameters.
Implemented the REDIRECT action (usefull in NAT).
Introduced a new concept in FireHOL: helpers
Helpers are functions that do some job for you, like a shortcut.
Implemented the transparent_squid helper.
----------------------------
revision 1.65
date: 2003/01/06 01:16:41; author: ktsaou; state: Exp; lines: +19 -3
I have added a not-to-be-documented command line argument:
gimme-the-services-defs
An application can choose to run FireHOL with this argument to have all
the service definitions FireHOL knows in the environment variables.
----------------------------
revision 1.64
date: 2003/01/06 00:41:10; author: ktsaou; state: Exp; lines: +736 -671
Changed the method with which the current command line was saved for the
error handler. The new way saved a fork() and gave some speed improvements.
Re-arranged the code so that the global variables and the services
definitions will be at the top of the file firehol.sh
Developed a work-around for a bug in iptables-save where:
! --uid-owner A
was saved as
--uid-owner !A
which was giving errors during restoration.
Unfortunatelly this made firehol saving the running firewall without the
use of /etc/init.d/iptables save.
The "save" argument to firehol saves the firewall to:
/etc/sysconfig/iptables
----------------------------
revision 1.63
date: 2003/01/05 20:03:07; author: ktsaou; state: Exp; lines: +29 -3
Added service ping
----------------------------
revision 1.62
date: 2003/01/03 23:34:37; author: ktsaou; state: Exp; lines: +16 -4
Added protocols as services: ICMP, AH, GRE, ESP
----------------------------
revision 1.61
date: 2003/01/01 04:32:48; author: ktsaou; state: Exp; lines: +6 -3
Added service: microsoft_ds
----------------------------
revision 1.60
date: 2003/01/01 03:12:17; author: ktsaou; state: Exp; lines: +51 -38
FireHOL has been changed to be "smart" when REJECTing packets.
If the packet to be rejected is a TCP packet, it will send back a tcp-reset
message, while for any other protocol it will send icmp-port-unreachable.
This is now the default behavior, without specifing a 'with' parameter.
Also, the multicast service has been changed to additionally match
protocol No 2.
----------------------------
revision 1.59
date: 2002/12/31 09:10:15; author: ktsaou; state: Exp; lines: +20 -12
Extended REJECT control ('with' parameter) to work on 'policy' and on the
default firewall policies.
----------------------------
revision 1.58
date: 2002/12/31 08:55:42; author: ktsaou; state: Exp; lines: +19 -4
Added optional rule parameter "with" which is only valid just after the
action "REJECT" on all rules. "with" allows finer control over the method
of packet rejection.
----------------------------
revision 1.57
date: 2002/12/23 14:39:19; author: ktsaou; state: Exp; lines: +609 -501
Code cleanup and code comments
----------------------------
revision 1.56
date: 2002/12/23 13:49:09; author: ktsaou; state: Exp; lines: +27 -4
Error handles now shows the command line that generated the error
as-is in the configuration file.
----------------------------
revision 1.55
date: 2002/12/22 14:02:54; author: ktsaou; state: Exp; lines: +6 -3
Added service APCUPSDNIS.
----------------------------
revision 1.54
date: 2002/12/20 20:31:11; author: ktsaou; state: Exp; lines: +10 -6
Added variable FIREHOL_AMANDA_PORTS to control which ports amanda has been
compiled with.
Added service CUPS.
----------------------------
revision 1.53
date: 2002/12/19 22:52:15; author: ktsaou; state: Exp; lines: +43 -3
Added service AMANDA.
----------------------------
revision 1.52
date: 2002/12/18 23:36:07; author: ktsaou; state: Exp; lines: +98 -42
Fixed a bug in command line parsing when there was a configuration file
specified in the command line together with a command.
Now, when a filename is specified only three commands are valid:
debug, try, start
Fixed error handling to detect errors in a few functions that were
ignored.
Updated documentation to reflect the above changes.
Updated interactive mode help and added directive 'in' as a shortcut to
interface eth0 internet
----------------------------
revision 1.51
date: 2002/12/18 22:05:37; author: ktsaou; state: Exp; lines: +20 -5
Enhanced the error handler to detect errors separately for each protection.
----------------------------
revision 1.50
date: 2002/12/18 20:44:08; author: ktsaou; state: Exp; lines: +78 -71
Fixed a potential security hole where UDP traffic could come in
uncoditionally from source port 53 when there was a:
client dns accept
This means that DNS is back to statefull mode.
Also, removed from ICMP the RELATED state, since it will be matched
at the end of the end of the interface or firewall.
----------------------------
revision 1.49
date: 2002/12/18 20:18:53; author: ktsaou; state: Exp; lines: +13 -5
Fixed active FTP bug. It was not working.
----------------------------
revision 1.48
date: 2002/12/18 00:35:42; author: ktsaou; state: Exp; lines: +7 -3
Added help entry for explain.
----------------------------
revision 1.47
date: 2002/12/18 00:30:28; author: ktsaou; state: Exp; lines: +67 -13
More changes regarding explain.
Added interactive commands 'help', 'show' and 'quit'.
Now the interactive mode automatically generates a configuration file
from all the successfull commands.
Made interactive mode accept variable definitions and loops.
----------------------------
revision 1.46
date: 2002/12/17 20:47:34; author: ktsaou; state: Exp; lines: +100 -24
Added command line argument "explain" to run in interactive debugging
mode.
This resulted in discovering bugs in NFS (fixed) and masquerade (fixed).
Also, enriched the error handler to be more descriptive about what
FireHOL is doing.
----------------------------
revision 1.45
date: 2002/12/16 20:41:39; author: ktsaou; state: Exp; lines: +56 -86
Added service DHCP Relay.
Made kernel modules loaded during run time.
Saving of old firewall takes now place before processing the configuration
file, in order to make sure it will not be altered by accident due to
some illegal commands in the configuration file.
FireHOL enables kernel routing automatically when there is at least a
router defined in the configuration.
Now the configuration accepts command line arguments given to FireHOL.
To send a set of arguments to the script, either just append them to
FireHOL command line or (in case it is not clear if the argument is going
to be used by FireHOL or the configuration) precede the configuration
arguments by -- (two dashes).
----------------------------
revision 1.44
date: 2002/12/16 18:57:30; author: ktsaou; state: Exp; lines: +12 -12
Restored gawk stuff to previous methodology, using <<"EOF" since escaping
produced warnings in debian systems.
----------------------------
revision 1.43
date: 2002/12/13 21:52:19; author: ktsaou; state: Exp; lines: +13 -17
Further optimizations in the error handler.
----------------------------
revision 1.42
date: 2002/12/13 19:56:11; author: ktsaou; state: Exp; lines: +93 -113
Made tons of optimizations for better FireHOL speed.
----------------------------
revision 1.41
date: 2002/12/12 20:07:47; author: ktsaou; state: Exp; lines: +22 -4
Added services: APTPROXY, APCUPSD, ISAKMP
Removed Service: TFTP
----------------------------
revision 1.40
date: 2002/12/11 20:51:38; author: ktsaou; state: Exp; lines: +4 -4
Changed service submission to be presented by number instead of name
because debian does not have this service in /etc/services.
----------------------------
revision 1.39
date: 2002/12/10 23:31:32; author: ktsaou; state: Exp; lines: +3 -3
Made default protections burst 50.
----------------------------
revision 1.38
date: 2002/12/10 23:08:07; author: ktsaou; state: Exp; lines: +5 -3
Added FIREHOL_LOG_FREQUENCY and FIREHOL_LOG_BURST to allow control on
the frequency of the loglimit rule parameter.
----------------------------
revision 1.37
date: 2002/12/10 18:10:38; author: ktsaou; state: Exp; lines: +4 -4
Fixed a bug in netbios_ns
----------------------------
revision 1.36
date: 2002/12/09 21:13:35; author: ktsaou; state: Exp; lines: +9 -9
Fixed a typo in protections, that made them unusable in the previous
version.
----------------------------
revision 1.35
date: 2002/12/08 22:05:40; author: ktsaou; state: Exp; lines: +8 -2
The command line argument stop was not working. Fixed.
----------------------------
revision 1.34
date: 2002/12/07 18:12:43; author: ktsaou; state: Exp; lines: +26 -13
Now protections can be applied on both directions of a router.
When running firehol with a configuration file as the first argument, now
you can specify an action (start, debug, try, etc) as the second argument.
----------------------------
revision 1.33
date: 2002/12/07 00:47:30; author: ktsaou; state: Exp; lines: +27 -174
Re-organized parameters parsing to prevent processing a possible file
in the current directory with filename the name of the FireHOL command.
Now FireHOL locks the subsys firehol, in addition to iptables.
----------------------------
revision 1.32
date: 2002/12/05 09:23:36; author: ktsaou; state: Exp; lines: +31 -2
Added many new services.
----------------------------
revision 1.31
date: 2002/12/05 09:03:37; author: ktsaou; state: Exp; lines: +13 -3
The problem with line numbers on debian systems found to be an awk
alternative those systems use. Now FireHOL uses gawk instead of awk.
Added service SUBMISSION (SMTP or SSL/TLS).
----------------------------
revision 1.30
date: 2002/12/04 23:12:10; author: ktsaou; state: Exp; lines: +35 -2
Fixed a problem where empty parameters to src, dst, etc where not giving
an error and where not producing any iptables statements.
This was happening because FireHOL relies on nested BASH loops, and bash
does not loop with empty iterations...
----------------------------
revision 1.29
date: 2002/12/04 22:41:13; author: ktsaou; state: Exp; lines: +155 -114
Re-wrote the negative expressions handling to archieve near hand-made
(i.e. optimum) quality of iptables firewall.
Now, instead of the linked-list that was created for negative expressions,
we match all positive expressions before the negatives and all the
negatives are together in one chain.
This also fixed possible performance problems due to the large number
of chains and rules that the packets had to traverse in order to get
matched (or not matched).
The fact that now positive rules are matched before negatives has also the
benefit that not all traffic has to be matched against the negatives. Now,
first we select what might be good for a rule, and then we check if this
breaks the negative expressions.
Last, this made the iptables firewall much more clear and human readable.
----------------------------
revision 1.28
date: 2002/12/04 21:32:26; author: ktsaou; state: Exp; lines: +17 -14
Fixed a bug that FireHOL was incorrectly choosing LOCAL_CLIENT_PORTS on
router configurations. This bug appeared when the router configurations
were made to accept normal server/client statements.
----------------------------
revision 1.27
date: 2002/12/04 07:20:19; author: ktsaou; state: Exp; lines: +13 -2
Error handler now works on protections too.
----------------------------
revision 1.26
date: 2002/12/03 22:49:16; author: ktsaou; state: Exp; lines: +75 -20
Changed the banner to be much more descriptive. It now also shows the
services FireHOL supports (removed the services parameter).
----------------------------
revision 1.25
date: 2002/12/03 22:07:09; author: ktsaou; state: Exp; lines: +12 -3
Fixed the usage banner to show the "services" parameter.
----------------------------
revision 1.24
date: 2002/12/03 22:03:00; author: ktsaou; state: Exp; lines: +87 -7
Another work around to fix the problem of LINENO not working in debian
systems.
Added command line argument "services" which shows all the service
definitions firehol knows about.
----------------------------
revision 1.23
date: 2002/12/02 17:48:41; author: ktsaou; state: Exp; lines: +13 -8
Fixed a bug where some versions of BASH do not handle correctly cat >>"EOF".
They treat it as cat >>EOF and thus they do variable substitution on the
text.
Now, FireHOL uses cat >>EOF but the text has been escaped in order to avoid
variable substitution.
The problem has been reported by Florian Thiel <thiel@ksan.de>.
----------------------------
revision 1.22
date: 2002/12/02 00:01:24; author: ktsaou; state: Exp; lines: +14 -7
Fixed parameter 'custom' processing. It is not an array now, but it is
treated specially to support BASH special characters such as !
Quoting things in parameters 'custom' needs tweaking still.
----------------------------
revision 1.21
date: 2002/12/01 04:34:00; author: ktsaou; state: Exp; lines: +48 -61
More quoting issues fixed. Changed the core to work with BASH arrays in
order to handle quoted arguments accurately.
Fixed a bug in postprocessing error handler that did not present the
command line that produced the error.
----------------------------
revision 1.20
date: 2002/11/30 22:53:55; author: ktsaou; state: Exp; lines: +235 -186
Fixed various problems related to quoted arguments.
Fixed iptables generation to support quoted arguments.
Made chain names shorter.
Every single element in the firehol config now gets its own chain.
Previously, the same services (e.g. smtp servers) were implemented using
only one pair of chains.
Enhanced the error handler of logical and syntactical error. Now it says
were and why an error has occured.
----------------------------
revision 1.19
date: 2002/11/30 14:33:33; author: ktsaou; state: Exp; lines: +77 -57
As suggested by Florian Thiel <thiel@ksan.de>:
a. Fixed service IRC to work on TCP instead of UDP.
b. Added services: UUCP, VNC, WEBCACHE, IMAPS, IKE.
Also fixed the home-router.conf example (it was outdated).
----------------------------
revision 1.18
date: 2002/11/03 13:17:39; author: ktsaou; state: Exp; lines: +30 -10
Minor aesthetic changes.
----------------------------
revision 1.17
date: 2002/11/01 19:37:20; author: ktsaou; state: Exp; lines: +82 -1
Added service: any
Any allows the administrator to define any stateful rule to match services
that cannot have source and destination ports, such as unusual protocols,
etc.
Syntax: type any name action [optional rule parameters]
type: server/client/route
name: the name for the service (used for the chain)
action: accept, reject, etc.
Added service: multicast
Multicast allows the administrator to match packets with destination
224.0.0.0/8 in both directions (input/output).
----------------------------
revision 1.16
date: 2002/10/31 15:31:52; author: ktsaou; state: Exp; lines: +61 -13
Added command line parameter 'try' (in addition to 'start', 'stop', etc)
that when used it activates the firewall and waits 30 seconds for the
administrator to type 'commit' in order to keep the firewall active.
If the administrator does not write 'commit' or the timeout passes, FireHOL
restores the previous firewall.
Also, if you break (Ctrl-C) FireHOL while activating the new firewall,
FireHOL will restore the old firewall.
----------------------------
revision 1.15
date: 2002/10/30 23:25:07; author: ktsaou; state: Exp; lines: +80 -61
Rearranged default RELATED rules to match after normal processing and
protections.
Made the core of FireHOL operate on multiple tables (not assuming the
rules refer to the 'filter' table). This will allow FireHOL to support
all kinds of NAT chains in the future.
----------------------------
revision 1.14
date: 2002/10/29 22:20:41; author: ktsaou; state: Exp; lines: +79 -27
Client and server keywords now work on routers too.
(The old 'route' subcommand is an alias for the 'server' subcommand -
within a router).
Protection can be reversed on routers to match outface instead of inface.
Masquerade can be used in interfaces, routers (matches outface - but can
be reverse(ed) to match inface) or as a primary command with all the
interfaces to be masqueraded in an argument.
----------------------------
revision 1.13
date: 2002/10/28 19:47:02; author: ktsaou; state: Exp; lines: +31 -27
Protection has been extented to work on routers too.
Made a few minor aesthetic changes on the generated code. Now in/out chains
on routers match the inface/outface correctly.
----------------------------
revision 1.12
date: 2002/10/28 18:45:54; author: ktsaou; state: Exp; lines: +35 -14
Added support for ICMP floods protection and from BAD TCP flags protection.
This was suggested by: Fco.Felix Belmonte (ffelix@gescosoft.com).
----------------------------
revision 1.11
date: 2002/10/27 12:47:48; author: ktsaou; state: Exp; lines: +5 -0
Added CVS versioning to all files.
----------------------------
revision 1.10
date: 2002/10/27 02:49:34; author: ktsaou; state: Exp; lines: +66 -5
Added service IRC.
Extended kernel modules handling to simple services too.
Simple services can now have:
require_myservice_modules="module"
require_myservice_nat_modules="module"
in order to have these modules installed if and when "myservice" is
used.
Added the "masquerade" interfaces subcommand, that gives a shortcut to
masquerade on the output of an interface.
FireHOL, now have a separate rule to match all RELATED sockets on all
chains. This is always added at the top of the firewall.
FireHOL, now DROPs all INVALID packets, as suggested by the iptables
HOW-TO.
Various other minor enhancements.
----------------------------
revision 1.9
date: 2002/10/26 15:14:52; author: ktsaou; state: Exp; lines: +40 -26
Added logging options support as suggested by:
Fco.Felix Belmonte <ffelix@gescosoft.com>
----------------------------
revision 1.8
date: 2002/10/24 21:10:01; author: ktsaou; state: Exp; lines: +86 -9
Removed service TFTP since this requires a kernel module for stateful
operation.
After suggestions by Fco.Felix Belmonte (ffelix@gescosoft.com),
I have added:
a) RESERVED_IPS, PRIVATE_IPS, MULTICAST_IPS and UNROUTABLE_IPS
You can use the above in SRC (not) parameters to match them.
The use of UNROUTABLE_IPS is suggested for cases where an interface is
exclusivelly public.
b) kernel module requirements per complex service and for the
configuration file as a whole.
Now you can use:
# one line for each module, somewhere in your config file
require_kernel_module <kernel_module>
to have FireHOL require some kernel module to succesfully complete
the firewall configuration.
As an option for those running NAT, you can use:
FIREHOL_NAT=1 # put this at the top of your config file
to make the complex services require also the NAT modules for the
services they implement.
Finally, I have added a get-iana.sh script that produces one BASH
statement for RESERVED_IPS.
----------------------------
revision 1.7
date: 2002/10/20 19:09:18; author: ktsaou; state: Exp; lines: +1 -1
Changed TFTP from TCP to UDP.
----------------------------
revision 1.6
date: 2002/10/11 21:09:11; author: ktsaou; state: Exp; lines: +18 -0
Added services RNDC, FINGER, ECHO, DAYTIME, NNTP
----------------------------
revision 1.5
date: 2002/10/04 17:35:49; author: ktsaou; state: Exp; lines: +137 -7
Fixed negative expressions in FireHOL statements.
By default, when multiple instances of interfaces/ports/addresses exist
FireHOL produces one rule for each instance. However when negative
expressions were defined the previous approach was producing ORed iptables
statements instead of ANDed statements.
The new code, now produces linked lists of iptables chains for all negative
expressions so that only if ALL the negative are matched, one rule for each
positive expression will be produced.
Example: interface eth0 myname src "1.1.1.1 2.2.2.2"
This will correctly produce two indepedent rules, one for each IP address.
But:
interface eth0 myname src NOT "1.1.1.1 2.2.2.2"
was incorrectly producing two indepedent rules. Now the later statement
produces a linked list that first matches that the source of the packets
is not 1.1.1.1, in which case it forwards the packets to the second chain
in the lists that confirms that the packets are not comming from 2.2.2.2,
which finally sends the packets to their destination to be checked if they
are comming from eth0.
Note: I don't know the overhead of this linked list thing. I hope iptables
is fast enough...
----------------------------
revision 1.4
date: 2002/10/03 23:53:09; author: ktsaou; state: Exp; lines: +68 -58
Added control for unmatched packets using:
UNMATCHED_INPUT_POLICY=
UNMATCHED_OUTPUT_POLICY=
UNMATCHED_ROUTER_POLICY=
and removed DEFAULT_ROUTER_POLICY since iptables accepts only DROP and ACCEPT.
To control what will happen to unmatched packets just set the above variables
in /etc/firehol.conf
Note that in any case (e.g. UMATCHED_ROUTER_POLICY=ACCEPT) the packets will
still be logged to syslog.
Made also various aesthetic changes in the code.
Rules programmers can now include their service names in the
ALL_SHOULD_ALSO_RUN variable and the "all" service will run them
automatically.
----------------------------
revision 1.3
date: 2002/10/03 16:28:16; author: ktsaou; state: Exp; lines: +60 -7
Service ntp is now both TCP and UDP and accepts clients from default ports.
DNS over TCP is stateful but over UDP is now not stateful. This will not bother your syslog if your DNS server fails to reply within the stateful UDP timeout of iptables.
Added service rsync.
Added service vmwareauth.
Added service vmwareweb.
Added DEFAULT_ROUTER_POLICY to control how firehol handles its routing.
Fixed a bug where firehol script arguments were not passed to /etc/init.d/iptables.
Increased version number to 5.
----------------------------
revision 1.2
date: 2002/09/08 12:05:10; author: ktsaou; state: Exp; lines: +28 -18
Release 4.
Made it work on non RedHat systems.
client/server/route now accept many services on the same line.
Other minor fixes and enhancements.
Verified NFS operation.
----------------------------
revision 1.1
date: 2002/09/05 20:57:59; author: ktsaou; state: Exp;
branches: 1.1.1;
Initial revision
----------------------------
revision 1.1.1.1
date: 2002/09/05 20:57:59; author: ktsaou; state: Exp; lines: +0 -0
First Public Release
=============================================================================
|