Merge branch 'devel'

config

@@ -39,6 +39,9 @@ scanttl=172800
 ## DEBUG ##
 loginput=true
 logforward=true
+logbad=true
+logscan=true
+logcast=true
 debugtcp=true
 debugudp=true
 debugicmp=true
@@ -47,8 +50,6 @@ debugicmp=true
 hooks=(
 base
 lan
-wandroplog
-fordroplog
 whitenets
 forward
 badips

e-router

@@ -12,47 +12,33 @@ base() {
     ${iptables} -A INPUT -i lo -j ACCEPT
     ${iptables} -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
     ${iptables} -A INPUT -m conntrack --ctstate INVALID -j DROP
+    ${iptables} -N END-RESET
+    ${iptables} -A END-RESET -p tcp -j REJECT --reject-with tcp-reset
+    ${iptables} -A END-RESET -p udp -j REJECT --reject-with icmp-port-unreachable
+    ${iptables} -A END-RESET -j REJECT --reject-with icmp-proto-unreachable
 }
 
 final(){
-    if $loginput ; then
-        ${iptables} -A INPUT -j WAN-LOG-DROP
+    if $loginput; then
+        droplog "FINAL" "INPUT"
     fi
-    ${iptables} -A INPUT -p tcp -j REJECT --reject-with tcp-reset
-    ${iptables} -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-    ${iptables} -A INPUT -j REJECT --reject-with icmp-proto-unreachable
 }
 
-wandroplog() {
-    ${iptables} -N WAN-LOG-DROP
+droplog() {
+    ${iptables} -N ${1}-LOG-DROP
     if $debugtcp; then
-        ${iptables} -A WAN-LOG-DROP -p tcp  -j LOG --log-prefix  "WAN-LOG-DROP TCP: " --log-level 7
+        ${iptables} -A ${1}-LOG-DROP -p tcp  -j LOG --log-prefix "${1}-LOG-DROP TCP: " --log-level 7
     fi
     if $debugudp; then
-        ${iptables} -A WAN-LOG-DROP -p udp  -j LOG --log-prefix  "WAN-LOG-DROP UDP: " --log-level 7
+        ${iptables} -A ${1}-LOG-DROP -p udp  -j LOG --log-prefix "${1}-LOG-DROP UDP: " --log-level 7
     fi
     if $debugicmp; then
-        ${iptables} -A WAN-LOG-DROP -p icmp -j LOG --log-prefix  "WAN-LOG-DROP ICMP: " --log-level 7
+        ${iptables} -A ${1}-LOG-DROP -p icmp -j LOG --log-prefix "${1}-LOG-DROP ICMP: " --log-level 7
     fi
+    ${iptables} -A ${2} -j ${1}-LOG-DROP
 }
 
-fordroplog() {
-    ${iptables} -N FORWARD-LOG-DROP
-    if $debugtcp; then
-        ${iptables} -A FORWARD-LOG-DROP -p tcp  -j LOG --log-prefix "FORWARD-LOG-DROP TCP: " --log-level 7
-    fi
-    if $debugudp; then
-        ${iptables} -A FORWARD-LOG-DROP -p udp  -j LOG --log-prefix "FORWARD-LOG-DROP UDP: " --log-level 7
-    fi
-    if $debugicmp; then
-        ${iptables} -A FORWARD-LOG-DROP -p icmp -j LOG --log-prefix "FORWARD-LOG-DROP ICMP: " --log-level 7
-    fi
-}
-
-
 forward() {
-    ${iptables} -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-    ${iptables} -A FORWARD -i ${eth0} -o ${wan} -j ACCEPT
     while read -r ip public private ; do
         [[ "$ip" =~ ^[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-9]{1,}$ ]] || continue
         [[ "$public" =~ ^[0-9]{1,}|[0-9]{1,}:[0-9]{1,}$ ]] || continue
@@ -80,16 +66,16 @@ forward() {
     done < $confd/FORWARD.udp
 
     if $logforward ; then
-        ${iptables} -A FORWARD -j FORWARD-LOG-DROP
+        droplog "FORWARD" "FORWARD"
     fi
-    ${iptables} -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
-    ${iptables} -A FORWARD -p udp -j REJECT --reject-with icmp-port-unreachable
-    ${iptables} -A FORWARD -j REJECT --reject-with icmp-proto-unreachable
+    ${iptables} -A FORWARD -j END-RESET
 }
 
 lan() {
     ${iptables} -A INPUT -i ${eth0} -j ACCEPT
     ${iptables} -t nat -A POSTROUTING -o ${wan} -s ${locnet} -j MASQUERADE
+    ${iptables} -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+    ${iptables} -A FORWARD -i ${eth0} -o ${wan} -j ACCEPT
 }
 
 whitenets() {
@@ -102,18 +88,22 @@ whitenets() {
 
 badips() {
     ipset create -! $banset hash:ip hashsize 4096 timeout $banttl  maxelem $badmaxelems
-    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j REJECT --reject-with icmp-port-unreachable
-    ${iptables} -A INPUT -i ${wan} -p tcp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j REJECT --reject-with tcp-reset
+    if $logbad ; then
+        droplog "BAD" "INPUT"
+    fi
+    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j END-RESET
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j END-RESET
 }
 
 scanips() {
     ipset create -! $scanset hash:ip hashsize 4096 timeout $scanttl maxelem $scanmaxelems
-    ${iptables} -A INPUT -i ${wan} -j SET --add-set $scanset src --exist  --timeout $scanttl
-    if $loginput ; then
-        ${iptables} -A INPUT -j WAN-LOG-DROP
+    ${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j SET --add-set $scanset src --exist  --timeout $scanttl
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j SET --add-set $scanset src --exist  --timeout $scanttl
+    if $logscan ; then
+        droplog "SCAN" "INPUT"
     fi
-    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j REJECT --reject-with icmp-port-unreachable
-    ${iptables} -A INPUT -i ${wan} -p tcp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j REJECT --reject-with tcp-reset
+    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j END-RESET
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j END-RESET
 }
 
 white() {
@@ -127,7 +117,7 @@ white() {
         ${iptables} -A FW-FILTERED -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
     done < $confd/WHITE.tcp
     ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto UDP -j FW-FILTERED
-    ${iptables} -A INPUT -i ${wan} -p tcp -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto TCP -j FW-FILTERED
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto TCP -j FW-FILTERED
     ${iptables} -A INPUT -i ${wan} -p icmp --icmp-type 8 -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto ICMP -j ACCEPT
 }
 
@@ -142,13 +132,17 @@ public() {
         ${iptables} -A FW-PUBLIC -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
     done < $confd/PUBLIC.tcp
     ${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j FW-PUBLIC
-    ${iptables} -A INPUT -i ${wan} -p tcp -m conntrack --ctstate NEW --ctproto TCP -j FW-PUBLIC
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j FW-PUBLIC
 }
 
 cast() {
     ${iptables} -N FW-CAST
-    ${iptables} -A FW-CAST -m pkttype --pkt-type broadcast -j ACCEPT
-    ${iptables} -A FW-CAST -m pkttype --pkt-type multicast -j ACCEPT
+    if $logcast; then
+        ${iptables} -A FW-CAST -m pkttype --pkt-type multicast -m conntrack --ctstate NEW  -j LOG --log-prefix "CAST-LOG MULTI: " --log-level 7
+        ${iptables} -A FW-CAST -m pkttype --pkt-type broadcast -m conntrack --ctstate NEW  -j LOG --log-prefix "CAST-LOG BROAD: " --log-level 7
+    fi
+    ${iptables} -A FW-CAST -m pkttype --pkt-type multicast -m conntrack --ctstate NEW -j ACCEPT
+    ${iptables} -A FW-CAST -m pkttype --pkt-type broadcast -m conntrack --ctstate NEW -j ACCEPT
     ${iptables} -A INPUT -i ${wan} -j FW-CAST
 }