WEBLIB.RE/vpnclient_ynh
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Add firewalling

Browse Source
This commit is contained in:
Julien Vaubourg
2015-09-27 16:03:01 +02:00
parent 67d17653fb
commit 7b05614b3c
6 changed files with 119 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
conf/hook_post-iptable-rules Normal file
View File

@@ -0,0 +1,58 @@
#!/bin/bash
host6=$(dig AAAA +short <TPL:SERVER_NAME> | tail -n1)
host4=$(dig A +short <TPL:SERVER_NAME> | tail -n1)
# IPv6
sudo ip6tables -N vpnclient_in
sudo ip6tables -N vpnclient_out
sudo ip6tables -N vpnclient_fwd
sudo ip6tables -A vpnclient_in -p icmpv6 -j ACCEPT
sudo ip6tables -A vpnclient_in -s fd00::/8,fe80::/10 -j ACCEPT
sudo ip6tables -A vpnclient_in -p tcp --dport 22 -j ACCEPT
sudo ip6tables -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo ip6tables -A vpnclient_in -j DROP
if [ ! -z "${host6}" ]; then
sudo ip6tables -A vpnclient_out -d ${host6} -p <TPL:PROTO> --dport <TPL:SERVER_PORT> -j ACCEPT
fi
sudo ip6tables -A vpnclient_out -d fd00::/8,fe80::/10 -j ACCEPT
sudo ip6tables -A vpnclient_out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo ip6tables -A vpnclient_out -j DROP
sudo ip6tables -A vpnclient_fwd -j DROP
sudo ip6tables -I INPUT 1 -i <TPL:WIRED_DEVICE> -j vpnclient_in
sudo ip6tables -I OUTPUT 1 -o <TPL:WIRED_DEVICE> -j vpnclient_out
sudo ip6tables -I FORWARD 1 -o <TPL:WIRED_DEVICE> -j vpnclient_fwd
# IPv4
sudo iptables -N vpnclient_in
sudo iptables -N vpnclient_out
sudo iptables -N vpnclient_fwd
sudo iptables -A vpnclient_in -p icmp -j ACCEPT
sudo iptables -A vpnclient_in -s 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16 -j ACCEPT
sudo iptables -A vpnclient_in -p tcp --dport 22 -j ACCEPT
sudo iptables -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A vpnclient_in -j DROP
if [ ! -z "${host4}" ]; then
sudo iptables -A vpnclient_out -d ${host4} -p <TPL:PROTO> --dport <TPL:SERVER_PORT> -j ACCEPT
fi
sudo iptables -A vpnclient_out -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16 -j ACCEPT
sudo iptables -A vpnclient_out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A vpnclient_out -j DROP
sudo iptables -A vpnclient_fwd -j DROP
sudo iptables -I INPUT 1 -i <TPL:WIRED_DEVICE> -j vpnclient_in
sudo iptables -I OUTPUT 1 -o <TPL:WIRED_DEVICE> -j vpnclient_out
sudo iptables -I FORWARD 1 -o <TPL:WIRED_DEVICE> -j vpnclient_fwd
exit 0

46
conf/ynh-vpnclient
View File

@@ -38,6 +38,13 @@ is_hotspot_knowme() {
[ "${hotspot_vpnclient}" == yes ]
}
is_firewall_set() {
wired_device=${1}
ip6tables -nvL OUTPUT | grep vpnclient_out | grep -q "${wired_device}"\
&& iptables -nvL OUTPUT | grep vpnclient_out | grep -q "${wired_device}"
}
is_ip6addr_set() {
ip address show dev tun0 2> /dev/null | grep -q "${ynh_ip6_addr}/128"
}
@@ -59,7 +66,7 @@ is_openvpn_running() {
is_running() {
((has_nativeip6 && is_serverip6route_set "${new_server_ip6}") || ! has_nativeip6)\
&& ((! has_hotspot_app && has_ip6delegatedprefix && is_ip6addr_set) || has_hotspot_app || ! has_ip6delegatedprefix)\
&& is_openvpn_running
&& is_firewall_set && is_openvpn_running
}
## Setters
@@ -68,6 +75,19 @@ set_ip6addr() {
ip address add "${ynh_ip6_addr}/128" dev tun0
}
set_firewall() {
wired_device=${1}
cp /etc/yunohost/hooks.d/{90-vpnclient.tpl,post_iptable_rules/90-vpnclient}
sed "s|<TPL:SERVER_NAME>|${ynh_server_name}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
sed "s|<TPL:SERVER_PORT>|${ynh_server_port}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
sed "s|<TPL:PROTO>|${ynh_server_proto}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
sed "s|<TPL:WIRED_DEVICE>|${wired_device}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
yunohost firewall reload
}
set_serverip6route() {
server_ip6=${1}
ip6_gw=${2}
@@ -121,6 +141,11 @@ unset_ip6addr() {
ip address delete "${ynh_ip6_addr}/128" dev tun0
}
unset_firewall() {
rm -f /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient
yunohost firewall reload
}
unset_serverip6route() {
server_ip6=${1}
ip6_gw=${2}
@@ -255,6 +280,12 @@ case "${1}" in
set_ip6addr
fi
# Set ipv6/ipv4 firewall
if ! is_firewall_set "${new_wired_device}"; then
echo "Set IPv6/IPv4 firewall"
set_firewall "${new_wired_device}"
fi
# Update dynamic settings
ynh_setting_set vpnclient server_ip6 "${new_server_ip6}"
ynh_setting_set vpnclient ip6_gw "${new_ip6_gw}"
@@ -280,6 +311,11 @@ case "${1}" in
unset_serverip6route "${old_server_ip6}" "${old_ip6_gw}" "${old_wired_device}"
fi
if is_firewall_set "${old_wired_device}"; then
echo "Unset IPv6/IPv4 firewall"
unset_firewall
fi
if is_openvpn_running; then
echo "Stop openvpn"
stop_openvpn
@@ -347,6 +383,12 @@ case "${1}" in
echo "[INFO] No IPv6 server route to set"
fi
if is_firewall_set "${new_wired_device}"; then
echo "[OK] IPv6/IPv4 firewall set"
else
echo "[ERR] No IPv6/IPv4 firewall set"
fi
if is_openvpn_running; then
echo "[OK] Openvpn is running"
else
@@ -357,7 +399,7 @@ case "${1}" in
exit ${exitcode}
;;
*)
echo "Usage: $0 {start|stop|litestop|restart|status}"
echo "Usage: $0 {start|stop|restart|status}"
exit 1
;;
esac