arno-iptables-firewall 2.0.1.c-1 / usr / share / arno-iptables-firewall / plugins / 50dsl-ppp-modem.plugin

# ------------------------------------------------------------------------------
#            -= Arno's iptables firewall - (A)DSL PPP Modem plugin =-
#
PLUGIN_NAME="(A)DSL PPP Modem plugin"
PLUGIN_VERSION="1.0g"
PLUGIN_CONF_FILE="dsl-ppp-modem.conf"
#
# Last changed          : October 20, 2011
# Requirements          : aif 1.9.2i+ & kernel 2.6 & iptable_nat & ip_nat & ipt_MASQUERADE
# Comments              : This implements support to (A)DSL PPP modems
#
# Author                : (C) Copyright 2008-2011 by Arno van Amersfoort
# Homepage              : http://rocky.eld.leidenuniv.nl/
# Freshmeat homepage    : http://freshmeat.net/projects/iptables-firewall/?topic_id=151
# Email                 : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l
#                         (note: you must remove all spaces and substitute the @ and the .
#                         at the proper locations!)
# ------------------------------------------------------------------------------
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# version 2 as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
# ------------------------------------------------------------------------------

# Plugin start function
plugin_start()
{
  echo "${INDENT}Applying rules for (A)DSL modem on interface: $MODEM_IF"

  if [ -n "$MODEM_IF_IP" ]; then
    echo "${INDENT}Setting up (antispoof) MODEM net: $MODEM_IF_IP/24"

    # Anti spoof protection for the modem net
    #########################################
    ip4tables -A SPOOF_CHK ! -i $MODEM_IF -s "$MODEM_IF_IP/24" \
        -m limit --limit 3/m -j LOG --log-level $LOGLEVEL --log-prefix "AIF:Spoofed (MODEM) packet: "
    ip4tables -A SPOOF_CHK ! -i $MODEM_IF -s "$MODEM_IF_IP/24" -j DROP
  fi

  # Create & flush our modem chain
  ip4tables -N MODEM_CHAIN 2>/dev/null
  ip4tables -F MODEM_CHAIN
  ip4tables -N MODEM_CHAIN_HOOK 2>/dev/null
  ip4tables -F MODEM_CHAIN_HOOK


  # This is only used if you have a (A)DSL modem using ppp (connected to an
  # ethernet interface)
  #########################################################################
  if [ -n "$MODEM_IF_IP" ]; then
    if [ -n "$MODEM_IP" ]; then
      echo "${INDENT}Using MODEM IP $MODEM_IP"

      # Only allow traffic from the MODEM (check IP) to this machine
      ##############################################################
      ip4tables -A MODEM_CHAIN -s $MODEM_IP -d $MODEM_IF_IP -j ACCEPT
    else
      # Only allow traffic from the MODEM (no IP, so no checking) to this machine
      ###########################################################################
      ip4tables -A MODEM_CHAIN -d $MODEM_IF_IP -j ACCEPT
    fi
  elif [ -n "$MODEM_IP" ]; then
    echo "${INDENT}Using MODEM IP $MODEM_IP"

    # Only allow traffic from the MODEM (check IP) to this machine
    ##############################################################
    ip4tables -A MODEM_CHAIN -s $MODEM_IP -j ACCEPT
  else
    # Only allow traffic from the MODEM (no IP, so no checking) to this machine
    ###########################################################################
    ip4tables -A MODEM_CHAIN -j ACCEPT
  fi

  # Allow DHCP packets
  ip4tables -A MODEM_CHAIN -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j ACCEPT
  
  # Everything else is logged & dropped
  ip4tables -A MODEM_CHAIN \
    -m limit --limit 1/s -j LOG --log-level $LOGLEVEL --log-prefix "AIF:Dropped MODEM packet: "
  ip4tables -A MODEM_CHAIN -j DROP
  
  IFS=' ,'
  for interface in $MODEM_IF; do
    ip4tables -A MODEM_CHAIN_HOOK -i $interface -j MODEM_CHAIN
  done

  # Add our MODEM chain hook
  ip4tables -A INPUT -j MODEM_CHAIN_HOOK

  # Manage your modemsettings from computers on your LAN. For example with your browser via http://{MODEM_IP}
  ###########################################################################################################
  if [ -n "$MODEM_IP" -a -n "$MODEM_INTERNAL_NET" ]; then
    echo "${INDENT}Enabling (ADSL) modem (@$MODEM_IP) management for hosts(s): $MODEM_INTERNAL_NET"
    IFS=' ,'
    for net in `ip_range "$MODEM_INTERNAL_NET"`; do
      ip4tables -A FORWARD -o $MODEM_IF -s $net -j ACCEPT
      ip4tables -t nat -A POSTROUTING -o $MODEM_IF -s $net -d $MODEM_IP -j MASQUERADE
    done
  fi

  return 0
}


# Plugin stop function
plugin_stop()
{
  ip4tables -D INPUT -j MODEM_CHAIN_HOOK 2>/dev/null
  
  ip4tables -F MODEM_CHAIN_HOOK
  ip4tables -X MODEM_CHAIN_HOOK 2>/dev/null

  ip4tables -F MODEM_CHAIN
  ip4tables -X MODEM_CHAIN 2>/dev/null
  
  return 0
}


# Plugin status function
plugin_status()
{
  return 0
}


# Check sanity of eg. environment
plugin_sanity_check()
{
  if [ -z "$MODEM_IF" ]; then
    printf "\033[40m\033[1;31m${INDENT}ERROR: The plugin config file is not properly set!\033[0m\n" >&2
    return 1
  fi

  # Check whether MODEM_IF exists
  ###############################
  if ! check_interface $MODEM_IF; then
    printf "\033[40m\033[1;31m${INDENT}NOTE: Modem interface \"$MODEM_IF\" does NOT exist (yet?)\033[0m\n" >&2
  fi

  # Make sure EXT_IF != MODEM_IF
  ##############################
  IFS=' ,'
  for eif in $EXT_IF; do
    if [ "$eif" = "$MODEM_IF" ]; then
      printf "\033[40m\033[1;31m${INDENT}ERROR: One or more interfaces specified in EXT_IF is the same as the\033[0m\n" >&2
      printf "\033[40m\033[1;31m${INDENT}       MODEM_IF! Please, check the configuration file.\033[0m\n" >&2
      return 2
    fi
  done

  # Make sure INT_IF != MODEM_IF
  ##############################
  IFS=' ,'
  for iif in $INT_IF; do
    if [ "$iif" = "$MODEM_IF" ]; then
      printf "\033[40m\033[1;31m${INDENT}ERROR: One or more interfaces specified in INT_IF is the same as the one in\033[0m\n" >&2
      printf "\033[40m\033[1;31m${INDENT}       MODEM_IF! Please, check the configuration file.\033[0m\n" >&2
      return 3
    fi
  done

  # Make sure MODEM_IF != lo / 127.0.0.1
  ######################################
  if [ "$MODEM_IF" = "lo" -o "$MODEM_IF" = "127.0.0.1" ]; then
    printf "\033[40m\033[1;31m${INDENT}ERROR: The interface specified in MODEM_IF has the address or name of the local\033[0m\n" >&2
    printf "\033[40m\033[1;31m${INDENT}       loopback device! Please, check the configuration file.\033[0m\n" >&2
    return 4
  fi

  return 0
}


############
# Mainline #
############

# Check where to find the config file
CONF_FILE=""
if [ -n "$PLUGIN_CONF_PATH" ]; then
  CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE"
fi

# Check if the config file exists
if [ ! -e "$CONF_FILE" ]; then
  printf "NOTE: Config file \"$CONF_FILE\" not found!\n        Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2
  PLUGIN_RET_VAL=0
else
  # Source the plugin config file
  . "$CONF_FILE"

  if [ "$ENABLED" = "1" ] ||
     [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] ||
     [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then
    # Show who we are:
    echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION"
    
    # Increment indention
    INDENT="$INDENT "

    # Only proceed if environment ok
    if plugin_sanity_check; then
      case $PLUGIN_CMD in
        start|'') plugin_start; PLUGIN_RET_VAL=$?;;
        stop    ) plugin_stop; PLUGIN_RET_VAL=$?;;
        status  ) plugin_status; PLUGIN_RET_VAL=$?;;
        *       ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;;
      esac
    fi
  else
    PLUGIN_RET_VAL=0
  fi
fi