|
@@ -20,12 +20,12 @@ base() {
|
|
|
|
|
|
|
|
final(){
|
|
final(){
|
|
|
if $loginput; then
|
|
if $loginput; then
|
|
|
- droplog "FINAL"
|
|
|
|
|
|
|
+ _droplog "FINAL"
|
|
|
${iptables} -A INPUT -j FINAL-LOG-DROP
|
|
${iptables} -A INPUT -j FINAL-LOG-DROP
|
|
|
fi
|
|
fi
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
-droplog() {
|
|
|
|
|
|
|
+_droplog() {
|
|
|
${iptables} -N ${1}-LOG-DROP
|
|
${iptables} -N ${1}-LOG-DROP
|
|
|
if $debugtcp; then
|
|
if $debugtcp; then
|
|
|
${iptables} -A ${1}-LOG-DROP -p tcp -j LOG --log-prefix "${1}-LOG-DROP TCP: " --log-level 7
|
|
${iptables} -A ${1}-LOG-DROP -p tcp -j LOG --log-prefix "${1}-LOG-DROP TCP: " --log-level 7
|
|
@@ -66,7 +66,7 @@ forward() {
|
|
|
done < $confd/FORWARD.udp
|
|
done < $confd/FORWARD.udp
|
|
|
|
|
|
|
|
if $logforward ; then
|
|
if $logforward ; then
|
|
|
- droplog "FORWARD"
|
|
|
|
|
|
|
+ _droplog "FORWARD"
|
|
|
${iptables} -A FORWARD -j FORWARD-LOG-DROP
|
|
${iptables} -A FORWARD -j FORWARD-LOG-DROP
|
|
|
fi
|
|
fi
|
|
|
${iptables} -A FORWARD -j END-RESET
|
|
${iptables} -A FORWARD -j END-RESET
|
|
@@ -90,7 +90,7 @@ whitenets() {
|
|
|
badips() {
|
|
badips() {
|
|
|
ipset create -! $banset hash:ip hashsize 4096 timeout $banttl maxelem $badmaxelems
|
|
ipset create -! $banset hash:ip hashsize 4096 timeout $banttl maxelem $badmaxelems
|
|
|
if $logbad ; then
|
|
if $logbad ; then
|
|
|
- droplog "BAD"
|
|
|
|
|
|
|
+ _droplog "BAD"
|
|
|
${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j BAD-LOG-DROP
|
|
${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j BAD-LOG-DROP
|
|
|
${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j BAD-LOG-DROP
|
|
${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j BAD-LOG-DROP
|
|
|
fi
|
|
fi
|
|
@@ -103,7 +103,7 @@ scanips() {
|
|
|
${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j SET --add-set $scanset src --exist --timeout $scanttl
|
|
${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j SET --add-set $scanset src --exist --timeout $scanttl
|
|
|
${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j SET --add-set $scanset src --exist --timeout $scanttl
|
|
${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j SET --add-set $scanset src --exist --timeout $scanttl
|
|
|
if $logscan ; then
|
|
if $logscan ; then
|
|
|
- droplog "SCAN"
|
|
|
|
|
|
|
+ _droplog "SCAN"
|
|
|
${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j SCAN-LOG-DROP
|
|
${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j SCAN-LOG-DROP
|
|
|
${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j SCAN-LOG-DROP
|
|
${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j SCAN-LOG-DROP
|
|
|
fi
|
|
fi
|