 |
|
6. Common Machine Configuration
6.1 /etc/cipe/ip-up
Kernel 2.0, ipfwadm, cipe 1.0.x
#!/bin/bash
# ip-up <interface> <myaddr> <daemon-pid> <local> <remote> <arg>
#3/29/1999
#An example ip-up script for the older 1.x 2.x kernels using ipfwadm that
#will setup routes and firewall rules to connect your local class c network
#to a remote class c network.
#The rules are configured to prevent spoofing and stuffed routing between
#the networks. There are also additional security enhancements commented
#out towards the bottom of the script.
#Send questions or comments to acj@home.com.
#--------------------------------------------------------------------------
#Set some script variables
device=$1 # the CIPE interface
me=$2 # our UDP address
pid=$3 # the daemon's process ID
ipaddr=$4 # IP address of our CIPE device
vptpaddr=$5 # IP address of the remote CIPE device
option=$6 # argument supplied via options
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#comment/uncomment to enable/disbale kernel logging for all unauthorized
#access attempts. Must be same as ip-down script in order to remove rules.
log="-o"
#--------------------------------------------------------------------------
umask 022
# just a logging example
#echo "UP $*" >> /var/adm/cipe.log
# many systems like these pid files
#echo $3 > /var/run/$device.pid
#--------------------------------------------------------------------------
#add route entry for remote cipe network
network=`expr $ptpaddr : '\([0-9]*\.[0-9]*\.[0-9]*\.\)'`0
route add -net $network netmask 255.255.255.0 dev $device
#need to add route entry for host in 2.0 kernels
route add -host $ptpaddr dev $device
#--------------------------------------------------------------------------
#cipe interface incoming firewall rules
#must be inserted into list in reverse order
#deny all other incoming packets to cipe interface
ipfwadm -I -i deny -W $device -S 0/0 -D 0/0 $log
#accept incoming packets from remotenet to localnet on cipe interface
ipfwadm -I -i accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#accept incoming packets from localnet to remotenet on cipe interface
ipfwadm -I -i accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#deny incoming packets, cipe interface, claiming to be from localnet; log
ipfwadm -I -i deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#cipe interface outgoing firewall rules
#must be inserted into list in reverse order
#deny all other outgoing packets from cipe interface
ipfwadm -O -i deny -W $device -S 0/0 -D 0/0 $log
#accept outgoing from remotenet to localnet on cipe interface
ipfwadm -O -i accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#accept outgoing from localnet to remotenet on cipe interface
ipfwadm -O -i accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#deny outgoing to localnet from localnet, cipe interface, deny; log
ipfwadm -O -i deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#The forwarding is configured so machines on your local network do not get
#masqueraded to the remote network. This provides better access control
#between networks. Must be inserted into list in reverse order
#deny all other forwarding through cipe interface; log
ipfwadm -F -i deny -W $device -S 0/0 -D 0/0 $log
#accept forwarding from remotenet to localnet on cipe interfaces
ipfwadm -F -i accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#accept forwarding from localnet to remotenet on cipe interfaces
ipfwadm -F -i accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#--------------------------------------------------------------------------
#Make sure forwarding is enabled in the kernel. The kernel by default may
#have forwarding disabled.
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
#--------------------------------------------------------------------------
#Optional security enhancement - set default forward policy to
#DENY or REJECT. If your forwarding default policy is DENY/REJECT
#you will need to add the following rules to your main forward chain. It
#is a good idea to have all default policies set for DENY or
#REJECT.
#define machine interfaces
#localif="eth0"
#staticif="eth1" ;cable modem users
#staticif="ppp0" ;dialup users
#a real sloppy way to get the peer ip address from the options file - a new
#argument with peer ip:port passed to script would be nice.
#both lines need to be uncommented
#peerfile=`grep $device /etc/cipe/options.* | cut -f1 -d:`
#peer=`grep peer $peerfile | cut -f1 -d: | awk '{print $2}'`
#must log peer ip address for ip-down script
#echo $peer > /var/run/$device.peerip
#accept forwarding from localnet to remotenet on internal network interface
#ipfwadm -F -i accept -W $localif -S $ipaddr/24 -D $ptpaddr/24
#accept forwarding from remotenet to localnet on internal network interface
#ipfwadm -F -i accept -W $localif -S $ptpaddr/24 -D $ipaddr/24
#accept forwarding on staticif from me to peer
#myaddr=`echo $me | cut -f1 -d:`
#ipfwadm -F -i accept -W $staticif -S $myaddr -D $peer
#--------------------------------------------------------------------------
#Other optional security enhancement
#block all incoming requests from everywhere to our cipe udp port
#except our peer's udp port
#need to determine udp ports for the cipe interfaces
#get our udp port
#if [ "$option" = "" ]; then
# myport=`echo $me | cut -f2 -d:`
#else
# myport=$option
#fi
#get remote udp port -- peerfile variable must be set above
#peerport=`grep peer $peerfile | cut -f2 -d:`
#must log peer udp port for ip-down script
#echo $peerport > /var/run/$device.peerport
#get our ip address
#myaddr=`echo $me | cut -f1 -d:`
#deny and log all requests to cipe udp port must be inserted first
#ipfwadm -I -i deny -P udp -W $staticif -S 0/0 -D $myaddr $myport $log
#accept udp packets from peer at udp cipe port to my udp cipe port
#ipfwadm -I -i accept -P udp -W $staticif -S $peer $peerport \
#-D $myaddr $myport
exit 0
Kernel 2.1/2.2, ipchains, cipe 1.2.x
#!/bin/bash
# ip-up <interface> <myaddr> <daemon-pid> <local> <remote> <arg>
#3/29/1999
#An example ip-up script for the newer 2.1/2.2 kernels using ipchains that
#will setup routes and firewall rules to connect your local class c network
#to a remote class c network. This script creates 3 user defined chains
#-input, output, and forward - for each cipe interface, based on the
#interface name. It will then insert a rule into each of the built-in
#input, output, and forward chains to use the user defined chains. The
#rules are configured to prevent spoofing and stuffed routing between the
#networks. There are also additional security enhancements commented out
#towards the bottom of the script.
#Send questions or comments to acj@home.com.
#--------------------------------------------------------------------------
#Set some script variables
device=$1 # the CIPE interface
me=$2 # our UDP address
pid=$3 # the daemon's process ID
ipaddr=$4 # IP address of our CIPE device
ptpaddr=$5 # IP address of the remote CIPE device
option=$6 # argument supplied via options
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#comment/uncomment to enable/disbale kernel logging for all unauthorized
#access attempts. Must be same as ip-down script in order to remove rules.
log="-l"
#--------------------------------------------------------------------------
umask 022
# just a logging example
#echo "UP $*" >> /var/adm/cipe.log
# many systems like these pid files
#echo $3 > /var/run/$device.pid
#--------------------------------------------------------------------------
#add route entry for remote cipe network
network=`expr $ptpaddr : '\([0-9]*\.[0-9]*\.[0-9]*\.\)'`0
route add -net $network netmask 255.255.255.0 dev $device
#--------------------------------------------------------------------------
#create new ipchain for cipe interface input rules
ipchains -N $device"i"
#flush all rules in chain (sanity flush)
ipchains -F $device"i"
#deny incoming packets, cipe interface, claiming to be from localnet; log
ipchains -A $device"i" -j DENY -i $device -s $ipaddr/24 -d $ipaddr/24 $log
#accept incoming packets from localnet to remotenet on cipe interface
ipchains -A $device"i" -j ACCEPT -i $device -s $ipaddr/24 -d $ptpaddr/24
#accept incoming packets from remotenet to localnet on cipe interface
ipchains -A $device"i" -j ACCEPT -i $device -s $ptpaddr/24 -d $ipaddr/24
#deny all other incoming packets
ipchains -A $device"i" -j DENY -s 0/0 -d 0/0 $log
#--------------------------------------------------------------------------
#create new ipchain for cipe interface output rules
ipchains -N $device"o"
#flush all rules in chain (sanity flush)
ipchains -F $device"o"
#deny outgoing to localnet from localnet, cipe interface, deny; log
ipchains -A $device"o" -j DENY -i $device -s $ipaddr/24 -d $ipaddr/24 $log
#accept outgoing from localnet to remotenet on cipe interface
ipchains -A $device"o" -j ACCEPT -i $device -s $ipaddr/24 -d $ptpaddr/24
#accept outgoing from remotenet to localnet on cipe interface
ipchains -A $device"o" -j ACCEPT -i $device -s $ptpaddr/24 -d $ipaddr/24
#deny all other outgoing packets
ipchains -A $device"o" -j DENY -s 0/0 -d 0/0 $log
#--------------------------------------------------------------------------
#The forward chain is configured so machines on your local network do not
#get masqueraded to the remote network. This provides better access
#control between networks.
#create new ipchain for cipe interface forward rules
ipchains -N $device"f"
#flush all rules in chain (sanity flush)
ipchains -F $device"f"
#accept forwarding from localnet to remotenet on cipe interfaces
ipchains -A $device"f" -j ACCEPT -i $device -s $ipaddr/24 -d $ptpaddr/24
#accept forwarding from remotenet to localnet on cipe interfaces
ipchains -A $device"f" -j ACCEPT -i $device -s $ptpaddr/24 -d $ipaddr/24
#deny all other forwarding; log
ipchains -A $device"f" -j DENY -s 0/0 -d 0/0 $log
#--------------------------------------------------------------------------
#Make sure forwarding is enabled in the kernel. New kernels by default have
#forwarding disabled.
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
#--------------------------------------------------------------------------
#insert rules to main input, output, and forward chains to enable new rules
#for the cipe interface
ipchains -I input -i $device -j $device"i"
ipchains -I output -i $device -j $device"o"
ipchains -I forward -i $device -j $device"f"
#--------------------------------------------------------------------------
#Optional security enhancement - set built-in forward chain policy to
#DENY or REJECT. If your main forward chain default policy is DENY/REJECT
#you will need to add the following rules to your main forward chain. It
#is a good idea to have all built-in chain default policies set for DENY or
#REJECT.
#define machine interfaces
#localif="eth0"
#staticif="eth1" ;cable modem users
#staticif="ppp0" ;dialup users
#a real sloppy way to get the peer ip address from the options file - a new
#argument with peer ip:port passed to script would be nice.
#both lines need to be uncommented
#peerfile=`grep $device /etc/cipe/options.* | cut -f1 -d:`
#peer=`grep peer $peerfile | cut -f1 -d: | awk '{print $2}'`
#must log peer ip address for ip-down script
#echo $peer > /var/run/$device.peerip
#accept forwarding from localnet to remotenet on internal network interface
#ipchains -I forward -j ACCEPT -i $localif -s $ipaddr/24 -d $ptpaddr/24
#accept forwarding from remotenet to localnet on internal network interface
#ipchains -I forward -j ACCEPT -i $localif -s $ptpaddr/24 -d $ipaddr/24
#accept forwarding on staticif from me to peer
#myaddr=`echo $me | cut -f1 -d:`
#ipchains -I forward -j ACCEPT -i $staticif -s $myaddr -d $peer
#--------------------------------------------------------------------------
#Other optional security enhancement
#block all incoming requests from everywhere to our cipe udp port
#except our peer's udp port
#need to determine udp ports for the cipe interfaces
#get our udp port
#if [ "$option" = "" ]; then
# myport=`echo $me | cut -f2 -d:`
#else
# myport=$option
#fi
#get remote udp port -- peerfile variable must be set above
#peerport=`grep peer $peerfile | cut -f2 -d:`
#must log peer udp port for ip-down script
#echo $peerport > /var/run/$device.peerport
#get our ip address
#myaddr=`echo $me | cut -f1 -d:`
#deny and log all requests to cipe udp port must be inserted first
#ipchains -I input -j DENY -p udp -i $staticif -s 0/0 \
#-d $myaddr $myport $log
#accept udp packets from peer at udp cipe port to my udp cipe port
#ipchains -I input -j ACCEPT -p udp -i $staticif -s $peer $peerport \
# -d $myaddr $myport
#--------------------------------------------------------------------------
# Set up spoofing protection in kernel as an additional security measure
#--------------------------------------------------------------------------
#Why do I have spoofing protection in the firewall rules in addition to
#this script that sets up spoof protection for each interface in the
#kernel? Guess I'm paranoid.
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
echo -n "Setting up IP spoofing protection..."
iface="/proc/sys/net/ipv4/conf/$device/rp_filter"
echo 1 > $iface
echo "done."
else
echo "Cannot setup spoof protection in kernel for $device" \
| mail -s"Security Warning: $device" root
exit 1
fi
exit 0
6.2 /etc/cipe/ip-down
Kernel 2.0, ipfwadm, cipe 1.0.x
#!/bin/bash
# ip-down <interface> <myaddr> <daemon-pid> <local> <remote> <arg>
#3/29/1999
#An example ip-down script for the older 1.x 2.x kernels using ipfwadm that
#will remove firewall rules that were setup to connect your local class c
#network to a remote class c network.
#--------------------------------------------------------------------------
#Set some script variables
device=$1 # the CIPE interface
me=$2 # our UDP address
pid=$3 # the daemon's process ID
ipaddr=$4 # IP address of our CIPE device
ptpaddr=$5 # IP address of the remote CIPE device
option=$6 # argument supplied via options
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#comment/uncomment to enable/disbale kernel logging for all unauthorized
#access attempts. Must be same as ip-down script in order to remove rules.
log="-o"
#--------------------------------------------------------------------------
umask 022
# just a logging example
#echo "DOWN $*" >> /var/adm/cipe.log
# many systems like these pid files
#rm -f /var/run/$device.pid
#--------------------------------------------------------------------------
#cipe interface incoming firewall rules
#delete (deny all other incoming packets to cipe interface)
ipfwadm -I -d deny -W $device -S 0/0 -D 0/0 $log
#delete (accept incoming packets from remotenet to localnet on cipe
#interface)
ipfwadm -I -d accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#delete (accept incoming packets from localnet to remotenet on cipe
#interface)
ipfwadm -I -d accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#delete (deny incoming packets, cipe interface, claiming to be from
#localnet and log)
ipfwadm -I -d deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#cipe interface incoming firewall rules
#delete (deny all other outgoing packets from cipe interface)
ipfwadm -O -d deny -W $device -S 0/0 -D 0/0 $log
#delete (accept outgoing from remotenet to localnet on cipe interface)
ipfwadm -O -d accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#delete (accept outgoing from localnet to remotenet on cipe interface)
ipfwadm -O -d accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#delete (deny outgoing to localnet from localnet, cipe interface, deny
#and log)
ipfwadm -O -d deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#cipe interface forwarding firewall rules
#delete (deny all other forwarding through cipe interface; log)
ipfwadm -F -d deny -W $device -S 0/0 -D 0/0 $log
#delete (accept forwarding from remotenet to localnet on cipe interfaces)
ipfwadm -F -d accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#delete (accept forwarding from localnet to remotenet on cipe interfaces)
ipfwadm -F -d accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#--------------------------------------------------------------------------
#Optional security enhancement - set default forward policy to
#DENY or REJECT. If your forwarding default policy is DENY/REJECT
#you will need to add the following rules to your main forward chain. It
#is a good idea to have all default policies set for DENY or
#REJECT.
#define machine interfaces
#localif="eth0"
#staticif="eth1" ;cable modem users
#staticif="ppp0" ;dialup users
#a real sloppy way to get the peer ip address from the options file - a new
#argument with peer ip:port passed to script would be nice.
#both lines need to be uncommented
#peerfile=`grep $device /etc/cipe/options.* | cut -f1 -d:`
#peer=`grep peer $peerfile | cut -f1 -d: | awk '{print $2}'`
#must log peer ip address for ip-down script
#echo $peer > /var/run/$device.peerip
#delete (accept forwarding from localnet to remotenet on internal network
interface)
#ipfwadm -F -d accept -W $localif -S $ipaddr/24 -D $ptpaddr/24
#delete (accept forwarding from remotenet to localnet on internal network
interface)
#ipfwadm -F -d accept -W $localif -S $ptpaddr/24 -D $ipaddr/24
#delete (accept forwarding on staticif from me to peer)
#myaddr=`echo $me | cut -f1 -d:`
#ipfwadm -F -d accept -W $staticif -S $myaddr -D $peer
#--------------------------------------------------------------------------
#Other optional security enhancement
#block all incoming requests from everywhere to our cipe udp port
#except our peer's udp port
#need to determine udp ports for the cipe interfaces
#get our udp port
#if [ "$option" = "" ]; then
# myport=`echo $me | cut -f2 -d:`
#else
# myport=$option
#fi
#get remote udp port -- peerfile variable must be set above
#peerport=`grep peer $peerfile | cut -f2 -d:`
#must log peer udp port for ip-down script
#echo $peerport > /var/run/$device.peerport
#get our ip address
#myaddr=`echo $me | cut -f1 -d:`
#delete (deny and log all requests to cipe udp port must be inserted first)
#ipfwadm -I -d deny -P udp -W $staticif -S 0/0 -D $myaddr $myport $log
#delete (accept udp packets from peer at udp cipe port to my udp cipe port)
#ipfwadm -I -d accept -P udp -W $staticif -S $peer $peerport \
#-D $myaddr $myport
exit 0
Kernel 2.1/2.2, ipchains, cipe 1.2.x
#!/bin/sh
# ip-down <interface> <myaddr> <daemon-pid> <local> <remote> <arg>
#3/29/1999
#An example ip-down script for the newer 2.1/2.2 kernels using ipchains
#that will remove firewall rules that were setup to connect your local
#class c network to a remote class c network. Optional security
#enhancement rules removal is also added and commented towards end of
#script.
#Send questions or comments to acj@home.com.
#--------------------------------------------------------------------------
#Set some script variables
device=$1 # the CIPE interface
me=$2 # our UDP address
pid=$3 # the daemon's process ID
ipaddr=$4 # IP address of our CIPE device
ptpaddr=$5 # IP address of the remote CIPE device
option=$6 # argument supplied via options
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#comment/uncomment to enable/disbale kernel logging for all unauthorized
#access attempts
#must be same as ip-up script in order to remove rules
log="-l"
#--------------------------------------------------------------------------
umask 022
# Logging example
#echo "DOWN $*" >> /var/adm/cipe.log
# remove the daemon pid file
#rm -f /var/run/$device.pid
#--------------------------------------------------------------------------
#remove rules from main input, output, and forward chains for cipe
#interface
ipchains -D input -i $device -j $device"i"
ipchains -D output -i $device -j $device"o"
ipchains -D forward -i $device -j $device"f"
#--------------------------------------------------------------------------
#flush all rules in cipe interface input chain
ipchains -F $device"i"
#remove cipe interface input chain
ipchains -X $device"i"
#--------------------------------------------------------------------------
#flush all rules in cipe interface output chain
ipchains -F $device"o"
#remove cipe interface output chain
ipchains -X $device"o"
#--------------------------------------------------------------------------
#flush all rules in cipe interface forward chain
ipchains -F $device"f"
#remove cipe interface forward chain
ipchains -X $device"f"
#--------------------------------------------------------------------------
#Remove optional security enhancement rules
#get peer ip address
#peer=`cat /var/run/$device.peerip`
#define machine interfaces
#localif="eth0"
#staticif="eth1" ;cable modem users
#staticif="ppp0" ;dialup users
#get our ip address
#myaddr=`echo $me |cut -f1 -d:`
#delete (accept forwarding from localnet to remotenet on internal network
#interface)
#ipchains -D forward -j ACCEPT -i $localif -s $ipaddr/24 -d $ptpaddr/24
#delete (accept forwarding from remotenet to localnet on internal network
#interface)
#ipchains -D forward -j ACCEPT -i $localif -s $ptpaddr/24 -d $ipaddr/24
#delete (accept forwarding on staticif from me to peer)
#ipchains -D forward -j ACCEPT -i $staticif -s $myaddr -d $peer
#remove peer ip file
#rm /var/run/$device.peerip
#--------------------------------------------------------------------------
#Remove other optional security enhancement rules
#get peer udp port
#peerport=`cat /var/run/$device.peerport`
#get our udp port
#if [ "$option" = "" ]; then
# myport=`echo $me | cut -f2 -d:`
#else
# myport=$option
#fi
#delete (deny and log all requests to cipe udp port must be inserted first)
#ipchains -D input -j DENY -p udp -i $staticif -s 0/0 \
#-d $myaddr $myport $log
#delete (accept udp packets from peer at udp cipe port to my udp cipe port)
#ipchains -D input -j ACCEPT -p udp -i $staticif -s $peer $peerport \
#-d $myaddr $myport
#remove peer port file
#rm /var/run/$device.peerport
#--------------------------------------------------------------------------
exit 0
Next Previous Contents
Hosting by: Hurra Communications Ltd.
Generated: 2007-01-26 17:58:17