From a2a75bb34b591af8cb8050828e1fdd8895a32e77 Mon Sep 17 00:00:00 2001 From: bolvan Date: Tue, 14 May 2019 11:50:19 +0300 Subject: [PATCH] sysv helper functions : APPLY_FW=1 to override INIT_APPLY_FW --- docs/readme.txt | 8 +++++++- init.d/sysv/functions | 26 ++++++++++++++------------ 2 files changed, 21 insertions(+), 13 deletions(-) diff --git a/docs/readme.txt b/docs/readme.txt index 8a10bcb..1842326 100644 --- a/docs/readme.txt +++ b/docs/readme.txt @@ -307,8 +307,14 @@ IFACE_WAN=eth1 Параметр INIT_APPLY_FW=1 разрешает init скрипту самостоятельно применять правила iptables. При иных значениях или если параметр закомментирован, правила применены не будут. Это полезно, если у вас есть система управления фаерволом, в настройки которой и следует прикрутить правила. -Хелпер-функции для настройки фаервола вынесены в отдельный shell include : /opt/zapret/init.d/sysv/functions. +Хелпер-функции для настройки фаервола вынесены в отдельный shell include Чтобы не копировать текст и не изобретать велосипед можно подключить include из ваших скриптов. +В своем скрипте необходимо выставить переменную APPLY_FW=1, чтобы принудительно разрешить применение правил iptales +вне зависимости от параметра INIT_APPLY_FW. +Пример : +./opt/zapret/init.d/sysv/functions +APPLY_FW=1 +fw_tpws_add "--dport 80 -m set --match-set zapret dst" "--dport 80 -m set --match-set zapret6 dst" $TPPORT_HTTP Пример установки на debian-подобную систему ------------------------------------------- diff --git a/init.d/sysv/functions b/init.d/sysv/functions index cc350c4..0c575ea 100644 --- a/init.d/sysv/functions +++ b/init.d/sysv/functions @@ -28,6 +28,8 @@ TPWS_OPT_BASE_HTTPS="--port=$TPPORT_HTTPS" [ -n "$IFACE_WAN" ] && IPT_IWAN="-i $IFACE_WAN" [ -n "$IFACE_LAN" ] && IPT_ILAN="-i $IFACE_LAN" +[ -n "$APPLY_FW" ] || APPLY_FW=$INIT_APPLY_FW + exists() { which $1 >/dev/null 2>/dev/null @@ -86,14 +88,14 @@ fw_tpws_add() # $1 - iptable filter for ipv4 # $2 - iptable filter for ipv6 # $3 - tpws port - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { echo "Adding iptables rule for tpws : $1" [ -n "$IFACE_LAN" ] && { ipt PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3 } ipt OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3 } - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { echo "Adding ip6tables rule for tpws : $2" [ -n "$IFACE_LAN" ] && { dnat6_target @@ -107,14 +109,14 @@ fw_tpws_del() # $1 - iptable filter for ipv4 # $2 - iptable filter for ipv6 # $3 - tpws port - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { echo "Deleting iptables rule for tpws : $1" [ -n "$IFACE_LAN" ] && { ipt_del PREROUTING -t nat $IPT_ILAN -p tcp $1 -j DNAT --to 127.0.0.1:$3 } ipt_del OUTPUT -t nat $IPT_OWAN -m owner ! --uid-owner $TPWS_USER -p tcp $1 -j DNAT --to 127.0.0.1:$3 } - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { echo "Deleting ip6tables rule for tpws : $2" [ -n "$IFACE_LAN" ] && { dnat6_target @@ -128,11 +130,11 @@ fw_nfqws_add_pre() { # $1 - iptable filter for ipv4 # $2 - iptable filter for ipv6 - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { echo "Adding iptables rule for nfqws prerouting : $1" ipt PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass } - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { echo "Adding ip6tables rule for nfqws prerouting : $2" ipt6 PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass } @@ -141,11 +143,11 @@ fw_nfqws_del_pre() { # $1 - iptable filter for ipv4 # $2 - iptable filter for ipv6 - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { echo "Deleting iptables rule for nfqws prerouting : $1" ipt_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $1 -j NFQUEUE --queue-num $QNUM --queue-bypass } - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { echo "Deleting ip6tables rule for nfqws prerouting : $2" ipt6_del PREROUTING -t raw $IPT_IWAN -p tcp --tcp-flags SYN,ACK SYN,ACK $2 -j NFQUEUE --queue-num $QNUM --queue-bypass } @@ -154,11 +156,11 @@ fw_nfqws_add_post() { # $1 - iptable filter for ipv4 # $2 - iptable filter for ipv6 - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { echo "Adding iptables rule for nfqws postrouting : $1" ipt POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass } - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { echo "Adding ip6tables rule for nfqws postrouting : $2" ipt6 POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass } @@ -167,11 +169,11 @@ fw_nfqws_del_post() { # $1 - iptable filter for ipv4 # $2 - iptable filter for ipv6 - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV4" != "1" ] && { echo "Deleting iptables rule for nfqws postrouting : $1" ipt_del POSTROUTING -t mangle $IPT_OWAN -p tcp $1 -j NFQUEUE --queue-num $QNUM --queue-bypass } - [ "$INIT_APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { + [ "$APPLY_FW" = "1" ] && [ "$DISABLE_IPV6" != "1" ] && { echo "Deleting ip6tables rule for nfqws postrouting : $2" ipt6_del POSTROUTING -t mangle $IPT_OWAN -p tcp $2 -j NFQUEUE --queue-num $QNUM --queue-bypass }