Updating firewall scripts.

11 files changed, 94 insertions, 67 deletions

diff --git a/bindleadmin.xcodeproj/project.pbxproj b/bindleadmin.xcodeproj/project.pbxproj
index 9d1a595..261e5e5 100644
--- a/bindleadmin.xcodeproj/project.pbxproj
+++ b/bindleadmin.xcodeproj/project.pbxproj
@@ -22,9 +22,9 @@
                 A0519DB817CE458900400A39 /* git-proj-cleanup.sh.in */ = {isa = PBXFileReference; explicitFileType = text.script.sh; path = "git-proj-cleanup.sh.in"; sourceTree = "<group>"; };
                 A0664F0118FD87D400A1AC67 /* cronmail.sh.in */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = cronmail.sh.in; sourceTree = "<group>"; };
                 A0664F0218FD87D400A1AC67 /* rc.firewall */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = rc.firewall; sourceTree = "<group>"; };
-                A0664F0318FD87D400A1AC67 /* rc.firewall.rules */ = {isa = PBXFileReference; lastKnownFileType = text; path = rc.firewall.rules; sourceTree = "<group>"; };
-                A0664F0418FD87D400A1AC67 /* rc.firewall.rules4 */ = {isa = PBXFileReference; lastKnownFileType = text; path = rc.firewall.rules4; sourceTree = "<group>"; };
-                A0664F0518FD87D400A1AC67 /* rc.firewall.rules6 */ = {isa = PBXFileReference; lastKnownFileType = text; path = rc.firewall.rules6; sourceTree = "<group>"; };
+                A0664F0318FD87D400A1AC67 /* rc.firewall.rules-example */ = {isa = PBXFileReference; explicitFileType = text.script; path = "rc.firewall.rules-example"; sourceTree = "<group>"; };
+                A0664F0418FD87D400A1AC67 /* rc.firewall.rules4-example */ = {isa = PBXFileReference; explicitFileType = text.script; path = "rc.firewall.rules4-example"; sourceTree = "<group>"; };
+                A0664F0518FD87D400A1AC67 /* rc.firewall.rules6-example */ = {isa = PBXFileReference; explicitFileType = text.script; path = "rc.firewall.rules6-example"; sourceTree = "<group>"; };
                 A0664F0618FD87D400A1AC67 /* rc.inet1_local */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = rc.inet1_local; sourceTree = "<group>"; };
                 A0664F0718FD87D400A1AC67 /* rc.inet1_local_down.example */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = rc.inet1_local_down.example; sourceTree = "<group>"; };
                 A0664F0818FD87D400A1AC67 /* rc.inet1_local_up.example */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = rc.inet1_local_up.example; sourceTree = "<group>"; };
@@ -33,6 +33,9 @@
                 A0664F0B18FD87D400A1AC67 /* slack-pkg-audit.sh.in */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = "slack-pkg-audit.sh.in"; sourceTree = "<group>"; };
                 A0664F0C18FD87D400A1AC67 /* slack-sync-auth.sh.in */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = "slack-sync-auth.sh.in"; sourceTree = "<group>"; };
                 A0664F0D18FD87D400A1AC67 /* slack-update-mirrors.sh.in */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = "slack-update-mirrors.sh.in"; sourceTree = "<group>"; };
+                A0D314B319097585008EDE75 /* rc.firewall.policy-example */ = {isa = PBXFileReference; explicitFileType = text.script; path = "rc.firewall.policy-example"; sourceTree = "<group>"; };
+                A0D314B419097585008EDE75 /* rc.firewall.policy4-example */ = {isa = PBXFileReference; explicitFileType = text.script; path = "rc.firewall.policy4-example"; sourceTree = "<group>"; };
+                A0D314B519097585008EDE75 /* rc.firewall.policy6-example */ = {isa = PBXFileReference; explicitFileType = text.script; path = "rc.firewall.policy6-example"; sourceTree = "<group>"; };
                 A0D52C9317C2E43C001352CA /* bindletools.xcodeproj */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.pb-project"; name = bindletools.xcodeproj; path = bindletools/bindletools.xcodeproj; sourceTree = "<group>"; };
                 A0D52C9E17C2E486001352CA /* git-proj-stats.sh.in */ = {isa = PBXFileReference; explicitFileType = text.script.sh; path = "git-proj-stats.sh.in"; sourceTree = "<group>"; };
                 A0D52C9F17C2E486001352CA /* pub-generate-readme.sh.in */ = {isa = PBXFileReference; lastKnownFileType = text.script.sh; path = "pub-generate-readme.sh.in"; sourceTree = "<group>"; };
@@ -52,9 +55,12 @@
                         isa = PBXGroup;
                         children = (
                                 A0664F0218FD87D400A1AC67 /* rc.firewall */,
-                                A0664F0318FD87D400A1AC67 /* rc.firewall.rules */,
-                                A0664F0418FD87D400A1AC67 /* rc.firewall.rules4 */,
-                                A0664F0518FD87D400A1AC67 /* rc.firewall.rules6 */,
+                                A0D314B319097585008EDE75 /* rc.firewall.policy-example */,
+                                A0D314B419097585008EDE75 /* rc.firewall.policy4-example */,
+                                A0D314B519097585008EDE75 /* rc.firewall.policy6-example */,
+                                A0664F0318FD87D400A1AC67 /* rc.firewall.rules-example */,
+                                A0664F0418FD87D400A1AC67 /* rc.firewall.rules4-example */,
+                                A0664F0518FD87D400A1AC67 /* rc.firewall.rules6-example */,
                                 A0664F0618FD87D400A1AC67 /* rc.inet1_local */,
                                 A0664F0718FD87D400A1AC67 /* rc.inet1_local_down.example */,
                                 A0664F0818FD87D400A1AC67 /* rc.inet1_local_up.example */,
diff --git a/src/slack/rc.firewall b/src/slack/rc.firewall
index 595e2a1..45e4a31 100755
--- a/src/slack/rc.firewall
+++ b/src/slack/rc.firewall
@@ -32,6 +32,14 @@
 #
 #   @BINDLE_BINARIES_BSD_LICENSE_END@
 #
+#   rc.firewall         - Firewall init script for Slackware
+#   rc.firewall.policy  - IPv4/IPv6 rules mandated by organization's policies
+#   rc.firewall.policy4 - IPv4 rules mandated by organization's policies
+#   rc.firewall.policy6 - IPv6 rules mandated by organization's policies
+#   rc.firewall.rules   - IPv4/IPv6 host specific firewall rules
+#   rc.firewall.rules4  - IPv4 host specific firewall rules
+#   rc.firewall.rules6  - IPv6 host specific firewall rules
+#
 
 ###########
 # LOGGING #
@@ -48,21 +56,36 @@ fi
 
 # Function to start the network:
 start() {
-   # local rules
+   # apply host specific firewall rules
    if test -f /etc/rc.d/rc.firewall.rules;then
-      echo "/etc/rc.d/rc.firewall:  adding IPv4/IPv6 rules (local)"
+      echo "/etc/rc.d/rc.firewall:  adding IPv4/IPv6 host rules"
       /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.rules | /usr/sbin/iptables-restore  -n
       /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.rules | /usr/sbin/ip6tables-restore -n
    fi
    if test -f /etc/rc.d/rc.firewall.rules4;then
-      echo "/etc/rc.d/rc.firewall:  adding IPv4 rules (local)"
+      echo "/etc/rc.d/rc.firewall:  adding IPv4 host rules"
       /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.rules4 | /usr/sbin/iptables-restore -n
    fi
    if test -f /etc/rc.d/rc.firewall.rules6;then
-      echo "/etc/rc.d/rc.firewall:  adding IPv6 rules (local)"
+      echo "/etc/rc.d/rc.firewall:  adding IPv6 host rules"
       /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.rules6 | /usr/sbin/ip6tables-restore -n
    fi
 
+   # apply company policy for firewall rules
+   if test -f /etc/rc.d/rc.firewall.policy;then
+      echo "/etc/rc.d/rc.firewall:  adding IPv4/IPv6 organization policy"
+      /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.policy | /usr/sbin/iptables-restore  -n
+      /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.policy | /usr/sbin/ip6tables-restore -n
+   fi
+   if test -f /etc/rc.d/rc.firewall.policy4;then
+      echo "/etc/rc.d/rc.firewall:  adding IPv4 organization policy"
+      /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.policy4 | /usr/sbin/iptables-restore -n
+   fi
+   if test -f /etc/rc.d/rc.firewall.policy6;then
+      echo "/etc/rc.d/rc.firewall:  adding IPv6 organization policy"
+      /usr/bin/cut -d# -f1 /etc/rc.d/rc.firewall.policy6 | /usr/sbin/ip6tables-restore -n
+   fi
+
 
    # LXC rules
    if test -d /var/lib/lxc/;then
@@ -82,45 +105,6 @@ start() {
          fi
       done
    fi
-
-
-   echo "/etc/rc.d/rc.firewall:  adding IPv4 INPUT rules"
-   /usr/sbin/iptables  -t filter -P INPUT DROP
-   /usr/sbin/iptables  -t filter -I INPUT           -s 10.19.80.1/32                   -j ACCEPT
-   /usr/sbin/iptables  -t filter -I INPUT           -s 10.19.80.33/32                  -j ACCEPT
-   /usr/sbin/iptables  -t filter -I INPUT           -s 63.140.112.161/32               -j ACCEPT
-   /usr/sbin/iptables  -t filter -I INPUT           -s 127.0.0.0/8                     -j ACCEPT
-   /usr/sbin/iptables  -t filter -I INPUT -p icmp   -s 0.0.0.0/0                       -j ACCEPT
-   /usr/sbin/iptables  -t filter -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED   -j ACCEPT
-   /usr/sbin/iptables  -t filter -I INPUT -p tcp --dport ident                         -j REJECT --reject-with tcp-reset
-   /usr/sbin/iptables  -t filter -A INPUT -m limit --limit 60/minute -j LOG --log-level 7 --log-prefix "iptables drop input: "
-
-
-   echo "/etc/rc.d/rc.firewall:  adding IPv4 FORWARD rules"
-   /usr/sbin/iptables  -t filter -P FORWARD DROP
-   /usr/sbin/iptables  -t filter -I FORWARD -p icmp   -s 0.0.0.0/0                        -j ACCEPT
-   /usr/sbin/iptables  -t filter -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED    -j ACCEPT
-   /usr/sbin/iptables  -t filter -I FORWARD -p tcp --dport ident                          -j REJECT --reject-with tcp-reset
-   /usr/sbin/iptables  -t filter -A FORWARD -m limit --limit 60/minute -j LOG --log-level 7 --log-prefix "iptables drop forward: "
-
-
-   echo "/etc/rc.d/rc.firewall:  adding IPv6 INPUT rules"
-   /usr/sbin/ip6tables -t filter -P INPUT DROP
-   /usr/sbin/ip6tables -t filter -I INPUT           -s 2001:470:b:84a::1/128                     -j ACCEPT
-   /usr/sbin/ip6tables -t filter -I INPUT           -s 2001:470:b:84a::33/128                    -j ACCEPT
-   /usr/sbin/ip6tables -t filter -I INPUT           -s 2001:470:ea85:c::1/128                    -j ACCEPT
-   /usr/sbin/ip6tables -t filter -I INPUT           -s ::1/128                                   -j ACCEPT
-   /usr/sbin/ip6tables -t filter -I INPUT -p icmpv6 -s ::/0                                      -j ACCEPT
-   /usr/sbin/ip6tables -t filter -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED             -j ACCEPT
-   /usr/sbin/ip6tables -t filter -I INPUT -p tcp --dport ident                                   -j REJECT --reject-with tcp-reset
-   /usr/sbin/ip6tables -t filter -A INPUT -m limit --limit 60/minute -j LOG --log-level 7 --log-prefix "iptables drop input: "
-
-
-   echo "/etc/rc.d/rc.firewall:  adding IPv6 FORWARD rules"
-   /usr/sbin/ip6tables -t filter -P FORWARD DROP
-   /usr/sbin/ip6tables -t filter -I FORWARD -p icmpv6 -s ::/0                          -j ACCEPT
-   /usr/sbin/ip6tables -t filter -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-   /usr/sbin/ip6tables -t filter -A FORWARD -m limit --limit 60/minute -j LOG --log-level 7 --log-prefix "iptables drop forward: "
 }
 
 
diff --git a/src/slack/rc.firewall.policy-example b/src/slack/rc.firewall.policy-example
new file mode 100644
index 0000000..2250d17
--- /dev/null
+++ b/src/slack/rc.firewall.policy-example
@@ -0,0 +1,13 @@
+
+# Adding office rules to filter table
+*filter
+:INPUT DROP
+:FORWARD DROP
+:OUTPUT ACCEPT
+-I INPUT -i lo                                        -j ACCEPT
+-I INPUT -m conntrack --ctstate ESTABLISHED,RELATED   -j ACCEPT
+-I INPUT -p tcp --dport ident                         -j REJECT --reject-with tcp-reset
+-A INPUT -m limit --limit 10/minute -j LOG --log-level 7 --log-prefix "iptables drop input: "
+COMMIT
+
+# end of rules
diff --git a/src/slack/rc.firewall.policy4-example b/src/slack/rc.firewall.policy4-example
new file mode 100644
index 0000000..56c11c7
--- /dev/null
+++ b/src/slack/rc.firewall.policy4-example
@@ -0,0 +1,9 @@
+
+# Adding rules to filter table
+*filter
+-I INPUT   -p icmp           -j ACCEPT
+
+-I FORWARD -p icmp           -j ACCEPT
+COMMIT
+
+# end of rules
diff --git a/src/slack/rc.firewall.policy6-example b/src/slack/rc.firewall.policy6-example
new file mode 100644
index 0000000..c3c3486
--- /dev/null
+++ b/src/slack/rc.firewall.policy6-example
@@ -0,0 +1,9 @@
+
+# Adding local rules to filter table (IPv6)
+*filter
+-I INPUT   -p icmpv6                   -j ACCEPT
+
+-I FORWARD -p icmpv6                   -j ACCEPT
+COMMIT
+
+# end of rules
diff --git a/src/slack/rc.firewall.rules b/src/slack/rc.firewall.rules
deleted file mode 100644
index 146ceff..0000000
--- a/src/slack/rc.firewall.rules
+++ /dev/null
@@ -1,6 +0,0 @@
-
-# Adding office rules to filter table
-*filter
-COMMIT
-
-# end of rules
diff --git a/src/slack/rc.firewall.rules-example b/src/slack/rc.firewall.rules-example
new file mode 100644
index 0000000..2095190
--- /dev/null
+++ b/src/slack/rc.firewall.rules-example
@@ -0,0 +1,8 @@
+
+# Adding office rules to filter table
+*filter
+-A INPUT -p tcp --dport http   -j  ACCEPT
+-A INPUT -p tcp --dport domain -j  ACCEPT
+COMMIT
+
+# end of rules
diff --git a/src/slack/rc.firewall.rules4 b/src/slack/rc.firewall.rules4
deleted file mode 100644
index b5939db..0000000
--- a/src/slack/rc.firewall.rules4
+++ /dev/null
@@ -1,6 +0,0 @@
-
-# Adding rules to filter table
-*filter
-COMMIT
-
-# end of rules
diff --git a/src/slack/rc.firewall.rules4-example b/src/slack/rc.firewall.rules4-example
new file mode 100644
index 0000000..02889cc
--- /dev/null
+++ b/src/slack/rc.firewall.rules4-example
@@ -0,0 +1,8 @@
+
+# Adding rules to filter table
+*filter
+-A INPUT -p tcp -s 127.0.0.1 --dport ssh   -j  ACCEPT
+-A INPUT -p tcp -s 127.0.0.1 --dport snmp  -j  ACCEPT
+COMMIT
+
+# end of rules
diff --git a/src/slack/rc.firewall.rules6 b/src/slack/rc.firewall.rules6
deleted file mode 100644
index 6566a62..0000000
--- a/src/slack/rc.firewall.rules6
+++ /dev/null
@@ -1,6 +0,0 @@
-
-# Adding local rules to filter table (IPv6)
-*filter
-COMMIT
-
-# end of rules
diff --git a/src/slack/rc.firewall.rules6-example b/src/slack/rc.firewall.rules6-example
new file mode 100644
index 0000000..058ce45
--- /dev/null
+++ b/src/slack/rc.firewall.rules6-example
@@ -0,0 +1,8 @@
+
+# Adding local rules to filter table (IPv6)
+*filter
+-A INPUT -p tcp -s ::1 --dport ssh   -j  ACCEPT
+-A INPUT -p tcp -s ::1 --dport snmp  -j  ACCEPT
+COMMIT
+
+# end of rules