From 27594eeae6f40a402bc3110f06d57975168e74e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Parm=C3=A9nides=20GV?= Date: Thu, 4 Jun 2015 19:20:15 +0200 Subject: ics-openvpn as a submodule! beautiful ics-openvpn is now officially on GitHub, and they track openssl and openvpn as submodules, so it's easier to update everything. Just a git submodule update --recursive. I've also set up soft links to native modules from ics-openvpn in app, so that we don't copy files in Gradle (which was causing problems with the submodules .git* files, not being copied). That makes the repo cleaner. --- app/openvpn/sample/sample-config-files/firewall.sh | 108 --------------------- 1 file changed, 108 deletions(-) delete mode 100755 app/openvpn/sample/sample-config-files/firewall.sh (limited to 'app/openvpn/sample/sample-config-files/firewall.sh') diff --git a/app/openvpn/sample/sample-config-files/firewall.sh b/app/openvpn/sample/sample-config-files/firewall.sh deleted file mode 100755 index 19d75ee9..00000000 --- a/app/openvpn/sample/sample-config-files/firewall.sh +++ /dev/null @@ -1,108 +0,0 @@ -#!/bin/sh - -# A Sample OpenVPN-aware firewall. - -# eth0 is connected to the internet. -# eth1 is connected to a private subnet. - -# Change this subnet to correspond to your private -# ethernet subnet. Home will use HOME_NET/24 and -# Office will use OFFICE_NET/24. -PRIVATE=10.0.0.0/24 - -# Loopback address -LOOP=127.0.0.1 - -# Delete old iptables rules -# and temporarily block all traffic. -iptables -P OUTPUT DROP -iptables -P INPUT DROP -iptables -P FORWARD DROP -iptables -F - -# Set default policies -iptables -P OUTPUT ACCEPT -iptables -P INPUT DROP -iptables -P FORWARD DROP - -# Prevent external packets from using loopback addr -iptables -A INPUT -i eth0 -s $LOOP -j DROP -iptables -A FORWARD -i eth0 -s $LOOP -j DROP -iptables -A INPUT -i eth0 -d $LOOP -j DROP -iptables -A FORWARD -i eth0 -d $LOOP -j DROP - -# Anything coming from the Internet should have a real Internet address -iptables -A FORWARD -i eth0 -s 192.168.0.0/16 -j DROP -iptables -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP -iptables -A FORWARD -i eth0 -s 10.0.0.0/8 -j DROP -iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP -iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP -iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP - -# Block outgoing NetBios (if you have windows machines running -# on the private subnet). This will not affect any NetBios -# traffic that flows over the VPN tunnel, but it will stop -# local windows machines from broadcasting themselves to -# the internet. -iptables -A FORWARD -p tcp --sport 137:139 -o eth0 -j DROP -iptables -A FORWARD -p udp --sport 137:139 -o eth0 -j DROP -iptables -A OUTPUT -p tcp --sport 137:139 -o eth0 -j DROP -iptables -A OUTPUT -p udp --sport 137:139 -o eth0 -j DROP - -# Check source address validity on packets going out to internet -iptables -A FORWARD -s ! $PRIVATE -i eth1 -j DROP - -# Allow local loopback -iptables -A INPUT -s $LOOP -j ACCEPT -iptables -A INPUT -d $LOOP -j ACCEPT - -# Allow incoming pings (can be disabled) -iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT - -# Allow services such as www and ssh (can be disabled) -iptables -A INPUT -p tcp --dport http -j ACCEPT -iptables -A INPUT -p tcp --dport ssh -j ACCEPT - -# Allow incoming OpenVPN packets -# Duplicate the line below for each -# OpenVPN tunnel, changing --dport n -# to match the OpenVPN UDP port. -# -# In OpenVPN, the port number is -# controlled by the --port n option. -# If you put this option in the config -# file, you can remove the leading '--' -# -# If you taking the stateful firewall -# approach (see the OpenVPN HOWTO), -# then comment out the line below. - -iptables -A INPUT -p udp --dport 1194 -j ACCEPT - -# Allow packets from TUN/TAP devices. -# When OpenVPN is run in a secure mode, -# it will authenticate packets prior -# to their arriving on a tun or tap -# interface. Therefore, it is not -# necessary to add any filters here, -# unless you want to restrict the -# type of packets which can flow over -# the tunnel. - -iptables -A INPUT -i tun+ -j ACCEPT -iptables -A FORWARD -i tun+ -j ACCEPT -iptables -A INPUT -i tap+ -j ACCEPT -iptables -A FORWARD -i tap+ -j ACCEPT - -# Allow packets from private subnets -iptables -A INPUT -i eth1 -j ACCEPT -iptables -A FORWARD -i eth1 -j ACCEPT - -# Keep state of connections from local machine and private subnets -iptables -A OUTPUT -m state --state NEW -o eth0 -j ACCEPT -iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -iptables -A FORWARD -m state --state NEW -o eth0 -j ACCEPT -iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT - -# Masquerade local subnet -iptables -t nat -A POSTROUTING -s $PRIVATE -o eth0 -j MASQUERADE -- cgit v1.2.3