| Server IP : 216.92.14.13 / Your IP : 216.73.216.171 Web Server : Apache System : Linux vps4089.pairvps.com 5.15.0-190-generic #200-Ubuntu SMP Fri Aug 7 15:06:04 UTC 2026 x86_64 User : rmlac2fmr ( 1040637) PHP Version : 8.2.32 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /etc/ |
Upload File : |
#!/bin/sh
# This is a totally rewritten version of the firewall script, to support
# iptables. See RT #32432 for more information.
# Figure out some configuration:
# set a sane path to start with:
export PATH="/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin"
DEBUG=''
if [ ! -z $1 ]; then
if [ $1 = 'debug' ]; then
DEBUG=1
fi
fi
# suck in some FreeBSD config variables
if [ -z "${source_rc_confs_defined}" ] ; then
if [ -r /etc/defaults/rc.conf ] ; then
. /etc/defaults/rc.conf
source_rc_confs
elif [ -r /etc/rc.conf ] ; then
. /etc/rc.conf
fi
fi
serverinfo="/etc/serverinfo"
# get the server series
series=`sed -E 's/\.[0-9]+//;q' "${serverinfo}"`
grep -q INTERNAL=YES "${serverinfo}" && series=0
# and the main server IP
main_ip=`sed -nE 's/^IP=//p' "${serverinfo}"`
main_ipv6=`sed -nE 's/^IPV6=//p' "${serverinfo}"`
# extra_ips from consolidation
extra_ips=`sed -nE 's/^EXTRA_IPS=//p' "${serverinfo}"`
# firewall flush
firewall_flush=`sed -nE 's/^FIREWALL_FLUSH=//p' "${serverinfo}"`
# hostname
hostname=`sed -nE 's/^HOSTNAME=//p' "${serverinfo}"`
# monarx security
monarx=`sed -nE 's/^MONARX=//p' "${serverinfo}"`
# FRR location
frr=`sed -nE 's/^FRR=//p' "${serverinfo}"`
if [ -z $frr ]; then frr=none; fi
# deny by default
default_deny=`sed -nE 's/^FIREWALL_DENY=//p' "${serverinfo}"`
default_in=ACCEPT
default_out=ACCEPT
case "$default_deny" in
IN)
default_in=DROP
default_out=ACCEPT
;;
OUT)
default_in=ACCEPT
default_out=DROP
;;
ALL)
default_in=DROP
default_out=DROP
;;
*)
default_in=ACCEPT
default_out=ACCEPT
;;
esac
# figure out the OS name & version
os=`uname -s`
case "${os}" in
FreeBSD)
# gives us '7.3', etc
osver=`uname -r |sed 's/-.*//'`
loopback="lo0"
;;
Linux)
# gives us ubuntu or fedora for example
linux_variant=`grep ^ID= /etc/os-release|cut -d = -f2`
# gives us, say '10.04' or '12.04'
osver=`grep ^VERSION_ID /etc/os-release|cut -d = -f2|sed 's/"//g'|sed "s/'//g"`
loopback="lo"
;;
*)
osver=`uname -r`
;;
esac
# firewall command paths
ipfw="/sbin/ipfw"
iptables="/sbin/iptables"
ip6tables="/sbin/ip6tables"
ipset="/sbin/ipset"
# ipset restorer
ipsetsave="/usr/pair/bin/ipset-save.pl"
# figure out which firewall tool should be used
if [ -x "${ipfw}" ] && ${ipfw} print >/dev/null 2>&1 ; then
firewall_tool="ipfw"
elif [ -x "${iptables}" -a -x "${ip6tables}" ] && ${iptables} -L -n >/dev/null 2>&1 ; then
firewall_tool="iptables"
else
echo "No firewall tool found! (Tried ipfw, iptables)" 1>&2
exit 1
fi
# Print to stdout instead
if [ ! -z $DEBUG ] ; then
ipfw="echo /sbin/ipfw"
iptables="echo /sbin/iptables"
ip6tables="echo /sbin/ip6tables"
ipset="echo /usr/sbin/ipset"
fi
# always use "quiet mode" for ipfw
ipfw="${ipfw} -q"
# for compatibility with older rc.firewall.local, rc.firewall.acc files:
fwcmd="${ipfw}"
# avoid iptables race lock (for u14+)
if [ ${osver%.*} -gt 12 ]; then
iptables="${iptables} -w"
fi
# are we a container?
container=`grep lxc /proc/1/environ 2>/dev/null`
local_firewall_conf="/etc/rc.firewall.local"
acc_firewall_conf="/etc/rc.firewall.acc"
post_script="/etc/rc.firewall.post"
if [ -x $post_script -a -z $DEBUG ]; then
# Only run betwen 3:00 and 6:59
# Create a touch file so puppet continually tries again until the time is right
case $(date +%H:%M) in
(0[3-6]:*) ;;
(*) touch /etc/rc.firewall.later; exit ;;
esac
fi
# initial firewall table setup
case "${firewall_tool}" in
ipfw)
# flush out the list before we begin
${ipfw} -f flush
${ipfw} enable verbose
# block ipv6 by default
${ipfw} add 65000 deny ipv6 from any to any in
if [ -z "${main_ipv6}" ] ; then
${ipfw} add 65000 deny ipv6 from any to any out
else
${ipfw} add 65000 pass ipv6 from any to any out
fi
# default policy: pass everything else through
${ipfw} add 65000 pass all from any to any
;;
iptables)
if [ "${firewall_flush}" = "NO" ]; then
# Flush only our chains
${iptables} -F INPUT
${iptables} -F FORWARD
${iptables} -F OUTPUT
${iptables} -F INPUT-acc
${iptables} -F INPUT-custom
${iptables} -F INPUT-custom-pre
${iptables} -F INPUT-pre-acc
${iptables} -F LOG-and-ACCEPT
${iptables} -F LOG-and-DROP
${iptables} -F LOG-and-REJECT
${iptables} -F OUTPUT-custom
${iptables} -F OUTPUT-custom-pre
${ip6tables} -F INPUT
${ip6tables} -F FORWARD
${ip6tables} -F OUTPUT
${ip6tables} -F INPUT-acc
${ip6tables} -F INPUT-custom
${ip6tables} -F INPUT-custom-pre
${ip6tables} -F INPUT-pre-acc
${ip6tables} -F LOG-and-ACCEPT
${ip6tables} -F LOG-and-DROP
${ip6tables} -F LOG-and-REJECT
${ip6tables} -F OUTPUT-custom
${ip6tables} -F OUTPUT-custom-pre
# Delete only our non-builtin chains
${iptables} -X INPUT-acc
${iptables} -X INPUT-custom
${iptables} -X INPUT-custom-pre
${iptables} -X INPUT-pre-acc
${iptables} -X LOG-and-ACCEPT
${iptables} -X LOG-and-DROP
${iptables} -X LOG-and-REJECT
${iptables} -X OUTPUT-custom
${iptables} -X OUTPUT-custom-pre
${ip6tables} -X INPUT-acc
${ip6tables} -X INPUT-custom
${ip6tables} -X INPUT-custom-pre
${ip6tables} -X INPUT-pre-acc
${ip6tables} -X LOG-and-ACCEPT
${ip6tables} -X LOG-and-DROP
${ip6tables} -X LOG-and-REJECT
${ip6tables} -X OUTPUT-custom
${ip6tables} -X OUTPUT-custom-pre
else
# Flush the chains.
${iptables} -F
${iptables} -t raw -F
${ip6tables} -F
${ip6tables} -t raw -F
# Delete all non-builtin chains.
${iptables} -X
${ip6tables} -X
fi
# set default policies
# allow all incoming/outgoing IPv4 traffic
# we may want to try to make the INPUT policy 'DROP' at some point
${iptables} -P INPUT $default_in
${iptables} -P OUTPUT $default_out
# drop all incoming IPv6 traffic by default
${ip6tables} -P INPUT DROP
# Previously we only allowed IPv6 OUT if $main_ip was set
# We are now opening this up by default for routing reasons
${ip6tables} -P OUTPUT ACCEPT
# drop all forwarded traffic (these servers shouldn't be acting like
# routers/gateways)
${iptables} -P FORWARD DROP
${ip6tables} -P FORWARD DROP
# Add some convenience chains.
# log info about the matched packet, and then drop it:
${iptables} -N LOG-and-DROP
if [ -z "$container" ]; then
${iptables} -A LOG-and-DROP -j LOG --log-uid
else
${iptables} -A LOG-and-DROP -j NFLOG
fi
${iptables} -A LOG-and-DROP -j DROP
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -N LOG-and-DROP
if [ -z "$container" ]; then
${ip6tables} -A LOG-and-DROP -j LOG --log-uid
else
${ip6tables} -A LOG-and-DROP -j NFLOG
fi
${ip6tables} -A LOG-and-DROP -j DROP
fi
# log info about the matched packet, and then reject it:
${iptables} -N LOG-and-REJECT
if [ -z "$container" ]; then
${iptables} -A LOG-and-REJECT -j LOG --log-uid
else
${iptables} -A LOG-and-REJECT -j NFLOG
fi
${iptables} -A LOG-and-REJECT -j REJECT
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -N LOG-and-REJECT
if [ -z "$container" ]; then
${ip6tables} -A LOG-and-REJECT -j LOG --log-uid
else
${ip6tables} -A LOG-and-REJECT -j NFLOG
fi
${ip6tables} -A LOG-and-REJECT -j REJECT
fi
# log info about the matched packet, and then accept it:
${iptables} -N LOG-and-ACCEPT
if [ -z "$container" ]; then
${iptables} -A LOG-and-ACCEPT -j LOG --log-uid
else
${iptables} -A LOG-and-ACCEPT -j NFLOG
fi
${iptables} -A LOG-and-ACCEPT -j ACCEPT
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -N LOG-and-ACCEPT
if [ -z "$container" ]; then
${ip6tables} -A LOG-and-ACCEPT -j LOG --log-uid
else
${ip6tables} -A LOG-and-ACCEPT -j NFLOG
fi
${ip6tables} -A LOG-and-ACCEPT -j ACCEPT
fi
# chains for custom rules, called at the end of their respective builtin
# chains:
${iptables} -N INPUT-custom
${iptables} -N INPUT-custom-pre
${iptables} -N OUTPUT-custom
${iptables} -N OUTPUT-custom-pre
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -N INPUT-custom
${ip6tables} -N INPUT-custom-pre
${ip6tables} -N OUTPUT-custom
${ip6tables} -N OUTPUT-custom-pre
fi
# chains for ACC firewall rules, and their preamble (so that a customer
# can't lock us out of the server). called after INPUT-custom
${iptables} -N INPUT-pre-acc
${iptables} -N INPUT-acc
[ "$monarx" = "YES" ] && ${iptables} -N MONARX_AGENT
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -N INPUT-pre-acc
${ip6tables} -N INPUT-acc
[ "$monarx" = "YES" ] && ${ip6tables} -N MONARX_AGENT
fi
;;
esac
# Add some useful global rules
# allow all traffic on the loopback device
case "${firewall_tool}" in
ipfw)
${ipfw} add 100 pass all from any to any via "${loopback}"
# XXX block loopback traffic from any other interface (is this necessary?)
${ipfw} add 200 deny all from any to 127.0.0.0/8
;;
iptables)
# note: anything coming in on lo is going out on it too, so we
# shouldn't need more complicated rules here
${iptables} -A INPUT -i "${loopback}" -j ACCEPT
${iptables} -A OUTPUT -o "${loopback}" -j ACCEPT
${ip6tables} -A INPUT -i "${loopback}" -j ACCEPT
${ip6tables} -A OUTPUT -o "${loopback}" -j ACCEPT
# XXX block loopback traffic from any other interface (is this necessary?)
${iptables} -A INPUT -d 127.0.0.0/8 -j DROP
${iptables} -A OUTPUT -d 127.0.0.0/8 -j DROP
;;
esac
# KJM 2/3/02 - block non-TCP fragment attacks
# LOG and DROP ICMP, UDP traffic fragments. We can't tell the
# source or destination ports, or ICMP type, of these packets, so any
# rules about those won't match these.
case "${firewall_tool}" in
ipfw)
${ipfw} add 300 deny icmp from any to any frag
${ipfw} add 305 deny udp from any to any frag
;;
iptables)
${iptables} -A INPUT -p icmp -f -j DROP
${iptables} -A OUTPUT -p icmp -f -j DROP
${iptables} -A INPUT -p udp -f -j DROP
${iptables} -A OUTPUT -p udp -f -j DROP
;;
esac
# block loopback traffic from any other interface, again (is this necessary?)
case "${firewall_tool}" in
ipfw)
${ipfw} add 350 deny ip from 127.0.0.0/8 to any
;;
iptables)
${iptables} -A INPUT -s 127.0.0.0/8 -j DROP
${iptables} -A OUTPUT -s 127.0.0.0/8 -j DROP
;;
esac
# enable connection tracking to allow ESTABLISHED traffic to flow inward.
case "${firewall_tool}" in
ipfw)
${ipfw} add 1000 check-state
${ipfw} add 1000 allow tcp from any to any established
;;
iptables)
${iptables} -A INPUT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
${iptables} -A INPUT -p udp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
fi
;;
esac
# allow icmp (ping, etc)
case "${firewall_tool}" in
ipfw)
${ipfw} add 1100 allow icmp from any to any
# Routed network config, allow INPUT from the router's fe80
if [ $frr = 'ts1' -o $frr = 'den' ]; then
${ipfw} add 1099 allow all from fe80::/64 to any in
#${ipfw} add 1099 allow ipv6-icmp from fe80::/64 to any icmp6types 134 in
fi
if [ -n "${main_ipv6}" ] ; then
${ipfw} add 1100 deny ipv6-icmp from any to any icmp6types 134 in
${ipfw} add 1100 allow ipv6-icmp from any to any
${ipfw} add 1100 allow udp from fc00::1 to any in
fi
;;
iptables)
${iptables} -A INPUT -p icmp -j ACCEPT
${iptables} -A OUTPUT -p icmp -j ACCEPT
if [ $frr = 'ts1' -o $frr = 'den' ]; then
${ip6tables} -A INPUT -p icmpv6 --icmpv6-type 134 -s fe80::/64 -j ACCEPT
${ip6tables} -A INPUT -p tcp --dport 179 -s fe80::/64 -j ACCEPT
${ip6tables} -A INPUT -s fc00::1 -j ACCEPT
${ip6tables} -A INPUT -d fc00::1 -j ACCEPT
fi
if [ $frr = 'rpc' ]; then
${ip6tables} -A OUTPUT-custom -d ff00::/8 -j DROP
fi
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -A INPUT -p icmpv6 --icmpv6-type 134 -j DROP
${ip6tables} -A INPUT -p ipv6-icmp -j ACCEPT
fi
;;
esac
# block nfs-related ports
case "${firewall_tool}" in
ipfw)
# Explicitly allow pair-vpn
${ipfw} add 2008 allow ip from 10.8.0.0/24 to any in
${ipfw} add 2008 allow ip from 10.8.2.0/24 to any in
# Explicitly deny other vpn group ranges (add later with .local)
${ipfw} add 2010 deny ip from 10.8.8.0/21 to any in
# We want to eventually remove this
${ipfw} add 2100 allow ip from 10.0.0.0/8 to any
${ipfw} add 2101 deny ip from any to any 111,800 in
;;
iptables)
# Explicitly allow pair-vpn
${iptables} -A INPUT -p tcp -s 10.8.0.0/24 -j ACCEPT
${iptables} -A INPUT -p tcp -s 10.8.2.0/24 -j ACCEPT
# Explicitly deny other vpn group ranges (add later with .local)
${iptables} -A INPUT -p tcp -s 10.8.8.0/21 -j DROP
# We want to eventually remove this
${iptables} -A INPUT -s 10.0.0.0/8 -j ACCEPT
${iptables} -A INPUT -p tcp -m multiport --dports 111,800 -j DROP
${iptables} -A INPUT -p udp -m multiport --dports 111,800 -j DROP
${iptables} -A OUTPUT -d 10.0.0.0/8 -j ACCEPT
;;
esac
# block all FRR over IPv4
case "${firewall_tool}" in
ipfw)
${ipfw} add 2150 deny ip4 from any to any 179,2601,2605,2617,2623,3784,3785,4784 in
;;
iptables)
${iptables} -A INPUT -p tcp -m multiport --dports 179,2601,2605,2617,2623,3784,3785,4784 -j DROP
${iptables} -A INPUT -p udp -m multiport --dports 179,2601,2605,2617,2623,3784,3785,4784 -j DROP
;;
esac
# allow udp packets we need (dns, stethoscope)
case "${firewall_tool}" in
ipfw)
# allow any outgoing UDP (traceroute,DNS) by root
${ipfw} add 2201 allow udp from any to any 53 out uid 0 keep-state
${ipfw} add 2201 allow udp from any to any 53 out gid 20 keep-state
${ipfw} add 2201 allow udp from any to any out uid 0
# allow DNS requests/responses
${ipfw} add 2202 allow udp from any to 216.92.61.16 53 out
${ipfw} add 2202 allow udp from any to 216.92.61.41 53 out
${ipfw} add 2202 allow udp from any to 216.92.61.84 53 out
${ipfw} add 2202 allow udp from any to 216.92.61.68 53 out
${ipfw} add 2202 allow udp from any to 216.92.4.184 53 out
${ipfw} add 2202 allow udp from any to 216.92.4.234 53 out
${ipfw} add 2202 allow udp from any to 216.146.195.25 53 out
${ipfw} add 2202 allow udp from any to 216.146.192.71 53 out
${ipfw} add 2202 allow udp from any to 216.146.194.3 53 out
${ipfw} add 2202 allow udp from any to 216.146.196.7 53 out
${ipfw} add 2202 allow udp from any to 66.39.4.57 53 out
${ipfw} add 2202 allow udp from any to 209.68.59.100 53 out
${ipfw} add 2202 allow udp from any to 172.16.1.100 53 out
${ipfw} add 2202 allow udp from any to 172.16.86.1 53 out
${ipfw} add 2202 allow udp from any to 76.75.192.19 53 out
${ipfw} add 2202 allow udp from any to 76.75.192.21 53 out
${ipfw} add 2202 allow udp from 216.92.61.16 53 to any in
${ipfw} add 2202 allow udp from 216.92.61.41 53 to any in
${ipfw} add 2202 allow udp from 216.92.61.84 53 to any in
${ipfw} add 2202 allow udp from 216.92.61.68 53 to any in
${ipfw} add 2202 allow udp from 216.92.4.184 53 to any in
${ipfw} add 2202 allow udp from 216.92.4.234 53 to any in
${ipfw} add 2202 allow udp from 216.146.195.25 53 to any in
${ipfw} add 2202 allow udp from 216.146.192.71 53 to any in
${ipfw} add 2202 allow udp from 216.146.194.3 53 to any in
${ipfw} add 2202 allow udp from 216.146.196.7 53 to any in
${ipfw} add 2202 allow udp from 66.39.4.57 53 to any in
${ipfw} add 2202 allow udp from 209.68.59.100 53 to any in
${ipfw} add 2202 allow udp from 172.16.1.100 53 to any in
${ipfw} add 2202 allow udp from 172.16.86.1 53 to any in
${ipfw} add 2202 allow udp from 76.75.192.19 53 to any in
${ipfw} add 2202 allow udp from 76.75.192.21 53 to any in
case "${series}" in
1)
${ipfw} add 2202 allow udp from any to any 53 in
${ipfw} add 2202 allow udp from any 53 to any out uid 53
;;
esac
# allow ntp from ntp[013].pair.com/ntp0.den.pair.net
${ipfw} add 2205 allow udp from 209.68.5.14 123 to any in
${ipfw} add 2205 allow udp from 209.68.5.11 123 to any in
${ipfw} add 2205 allow udp from 216.146.195.40 123 to any in
${ipfw} add 2205 allow udp from 172.16.33.4 123 to any in
${ipfw} add 2205 allow udp from 216.92.199.36 123 to any in
${ipfw} add 2205 allow udp from any to 209.68.5.14 123 out
${ipfw} add 2205 allow udp from any to 209.68.5.11 123 out
${ipfw} add 2205 allow udp from any to 216.146.195.40 123 out
${ipfw} add 2205 allow udp from any to 172.16.33.4 123 out
${ipfw} add 2205 allow udp from any to 216.92.199.36 123 out
# allow outgoing relay packets to the pair SMTP relay server
${ipfw} add 2206 allow udp from any to 209.68.1.20 dst-port 4225 out
if [ -n "${main_ipv6}" ]; then
# allow all IPv6 traffic since we can't differentiate by UID
${ipfw} add 2207 allow udp from ${main_ipv6} to any out
fi
# Always allow MRUBS
${ipfw} add 2208 allow tcp from 216.92.129.0/24 to any 306 in
${ipfw} add 2208 allow tcp from 216.146.195.0/24 to any 306 in
# Backups to sback
${ipfw} add 2208 allow tcp from 172.16.99.5 to any 22 in
${ipfw} add 2208 allow tcp from 172.16.47.6 to any 22 in
${ipfw} add 2208 allow tcp from 216.92.65.21 to any 22 in
# Puppet
${ipfw} add 2209 allow tcp from 209.68.6.43 8140 to any in
${ipfw} add 2209 allow tcp from 216.92.40.4 8140 to any in
# Orwell/Icinga
${ipfw} add 2209 allow ip from 66.39.2.218 to any in
${ipfw} add 2209 allow ip from 66.39.2.219 to any in
${ipfw} add 2209 allow ip from 216.92.36.47 to any in
${ipfw} add 2209 allow ip from 216.146.193.20 to any in
${ipfw} add 2209 deny all from any to any 5666 in
# Whitelisted Hosts (Netbird, jumpbox3.pit, jumpbox3.den, birdnode1, birdnode2, OpenVPN, deploy, mcp, cbs, intraweb, vps150)
${ipfw} add 2210 allow ip from 100.79.0.0/16 to any in
${ipfw} add 2210 allow ip from 216.92.130.193 to any in
${ipfw} add 2210 allow ip from 172.16.108.5 to any in
${ipfw} add 2210 allow ip from 172.16.23.6 to any in
${ipfw} add 2210 allow ip from 66.39.3.27 to any in
${ipfw} add 2210 allow ip from 209.68.2.252 to any in
${ipfw} add 2210 allow ip from 66.39.3.1 to any in
${ipfw} add 2210 allow ip from 66.39.3.3 to any in
${ipfw} add 2210 allow ip from 66.39.3.98 to any in
${ipfw} add 2210 allow ip from 172.16.41.4 to any in
${ipfw} add 2210 allow ip from 216.146.198.80 to any in
${ipfw} add 2210 allow ip from 216.146.198.85 to any in
# Allow Vault access to MySQL for password rotation
for vault_ip in 172.16.21.5 172.16.62.5 172.16.16.7 172.16.62.13; do
${ipfw} add 2212 allow ip from $vault_ip to any 3306 in
done
# Allow UDP connections to DCC server
${ipfw} add 2211 allow ip from any to 216.92.102.235 6277 out
# Don't allow klogin to shared servers
${ipfw} add 2250 deny tcp from any to any 2105 in
case "${series}" in
1|2|12|21)
# block outgoing evil TCP ports and all other UDP
${ipfw} add 2300 deny tcp from any to any 31335-31339,6667,7000,7001,7007,7777,161
${ipfw} add 2300 deny udp from any to any out
;;
esac
;;
iptables)
# allow any outgoing UDP (traceroute,DNS) by root
${iptables} -A OUTPUT -p udp -m owner --uid-owner root -j ACCEPT
${iptables} -A OUTPUT -p udp -m owner --gid-owner staff -j ACCEPT
# allow DNS requests/responses
${iptables} -A OUTPUT -p udp --dport 53 -d 216.92.61.16 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.92.61.41 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.92.61.84 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.92.61.68 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.92.4.184 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.92.4.234 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.146.195.25 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.146.192.71 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.146.194.3 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 216.146.196.7 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 66.39.4.57 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 209.68.59.100 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 172.16.1.100 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 172.16.86.1 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 76.75.192.19 -j ACCEPT
${iptables} -A OUTPUT -p udp --dport 53 -d 76.75.192.21 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.92.61.16 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.92.61.41 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.92.61.84 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.92.61.68 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.92.4.184 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.92.4.234 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.146.195.25 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.146.192.71 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.146.194.3 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 216.146.196.7 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 66.39.4.57 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 209.68.59.100 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 172.16.1.100 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 172.16.86.1 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 76.75.192.19 -j ACCEPT
${iptables} -A INPUT -p udp --sport 53 -s 76.75.192.21 -j ACCEPT
case "${series}" in
1)
${iptables} -A INPUT -p udp --dport 53 -j ACCEPT
${iptables} -A OUTPUT -p udp --sport 53 -m owner --uid-owner bind -j ACCEPT
;;
esac
# allow ntp from ntp[013].pair.com/ntp0.den.pair.net
${iptables} -A INPUT -p udp -s 209.68.5.14 --sport 123 -j ACCEPT
${iptables} -A INPUT -p udp -s 209.68.5.11 --sport 123 -j ACCEPT
${iptables} -A INPUT -p udp -s 216.146.195.40 --sport 123 -j ACCEPT
${iptables} -A INPUT -p udp -s 172.16.33.4 --sport 123 -j ACCEPT
${iptables} -A OUTPUT -p udp -d 209.68.5.14 --dport 123 -j ACCEPT
${iptables} -A OUTPUT -p udp -d 209.68.5.11 --dport 123 -j ACCEPT
${iptables} -A OUTPUT -p udp -d 216.146.195.40 --dport 123 -j ACCEPT
${iptables} -A OUTPUT -p udp -d 172.16.33.4 --dport 123 -j ACCEPT
# allow outgoing relay packets to the pair SMTP relay server
${iptables} -A OUTPUT -d 209.68.1.20 -p udp --dport 4225 -j ACCEPT
# Always allow MRUBS
${iptables} -A INPUT -p tcp -s 216.92.129.0/24 --dport 306 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.146.195.0/24 --dport 306 -j ACCEPT
# Backups to sback
${iptables} -A INPUT -p tcp -s 172.16.99.5 --dport 22 -j ACCEPT
${iptables} -A INPUT -p tcp -s 172.16.47.6 --dport 22 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.92.65.21 --dport 22 -j ACCEPT
# Puppet
${iptables} -A INPUT -p tcp -s 209.68.6.43 --sport 8140 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.92.40.4 --sport 8140 -j ACCEPT
# Orwell/Icinga
${iptables} -A INPUT -p tcp -s 66.39.2.218 -j ACCEPT
${iptables} -A INPUT -p udp -s 66.39.2.218 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.2.219 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.92.36.47 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.146.193.20 -j ACCEPT
${iptables} -A INPUT -p tcp -s 172.16.86.2 -j ACCEPT
${iptables} -A INPUT -p tcp --dport 5666 -j DROP
# Whitelisted Hosts (Netbird, jumpbox3.pit, jumpbox3.den, birdnode1, birdnode2, OpenVPN, deploy, mcp, cbs, intraweb, vps150)
${iptables} -A INPUT -p tcp -s 100.79.0.0/16 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.92.130.193 -j ACCEPT
${iptables} -A INPUT -p tcp -s 172.16.108.5 -j ACCEPT
${iptables} -A INPUT -p tcp -s 172.16.23.6 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.27 -j ACCEPT
${iptables} -A INPUT -p tcp -s 209.68.2.252 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.1 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.3 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.98 -j ACCEPT
${iptables} -A INPUT -p tcp -s 172.16.41.4 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.146.198.80 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.146.198.85 -j ACCEPT
# Allow servers to reach DEN Ceph via miser.den
${iptables} -A INPUT -p tcp -s 216.146.194.82 -d 10.81.0.0/20 -j ACCEPT
# Allow Vault access to MySQL for password rotation
for vault_ip in 172.16.21.5 172.16.62.5 172.16.16.7 172.16.62.13; do
${iptables} -A INPUT -p tcp -s $vault_ip --dport 3306 -j ACCEPT
done
# Allow UDP connections to DCC server
${iptables} -A OUTPUT -p udp --dport 6277 -d 216.92.102.235 -j ACCEPT
# Don't allow klogin to shared servers
${iptables} -A INPUT -p tcp --dport 2105 -j DROP
case "${series}" in
1|2|12|21)
# block outgoing "evil" TCP ports and all other UDP
${iptables} -A OUTPUT -p tcp -m multiport --dports 31335:31339,6667,7000,7001,7007,7777,161 -j DROP
${iptables} -A OUTPUT -p udp -j DROP
;;
esac
;;
esac
# load sgrubs
sgrubs_rules=`sed -nE 's/^(SNAP_REPLICATE|IBACKUP)=//p' "${serverinfo}"`
if [ "$sgrubs_rules" ]; then
case "${firewall_tool}" in
iptables)
${ipset} -exist create 124 hash:net
${iptables} -A INPUT -m set --match-set 124 src -p tcp --dport 22 -m comment --comment SGRUBS -j ACCEPT
;;
ipfw)
${ipfw} add 2212 allow tcp from "table(124)" to any 22 in // SGRUBS
;;
esac
for sgrubs_ip in 172.16.1.5 172.16.108.4 172.16.110.2 172.16.69.5 172.16.69.5 172.16.122.3 172.16.30.1 \
172.16.30.7 172.16.69.4 172.16.7.1 172.16.7.1 172.16.70.3 172.16.70.6 172.16.8.10 172.16.80.2 \
172.16.84.4 172.16.88.3 172.16.96.2 216.146.194.61 216.146.195.104 216.146.196.32 216.146.198.37 \
172.16.7.14 172.16.26.8 172.16.8.13 172.16.87.2 172.16.89.2 172.16.76.2 172.16.90.2 172.16.127.3
do
case "${firewall_tool}" in
iptables)
${ipset} -exist add 124 $sgrubs_ip
;;
ipfw)
${ipfw} table 124 add $sgrubs_ip
;;
esac
done
fi
case "${series}" in
1) # legacy
# Block incoming SMTP to customer IPs
case "${firewall_tool}" in
ipfw)
for mail_ip in $main_ip $extra_ips; do
${ipfw} add 2500 allow tcp from any to "${mail_ip}" 25 in
done
${ipfw} add 2550 deny tcp from any to any 25 in
;;
iptables)
for mail_ip in $main_ip $extra_ips; do
${iptables} -A INPUT -p tcp -d "${mail_ip}" --dport 25 -j ACCEPT
done
${iptables} -A INPUT -p tcp --dport 25 -j DROP
;;
esac
;;
esac
# Only allow outgoing SMTP from non-customer UIDs
case "${series}" in
1|2|7|12|21)
case "${firewall_tool}" in
ipfw)
${ipfw} add 2600 allow tcp from any to any 25 out uid qmailr
${ipfw} add 2600 allow tcp from any to any 25 out uid postfix
${ipfw} add 2600 allow tcp from any to any 25 out uid root
if [ -n "${main_ipv6}" ]; then
# allow all IPv6 traffic since we can't differentiate by UID
${ipfw} add 2600 allow tcp from ${main_ipv6} to any 25 out
fi
${ipfw} add 2650 deny tcp from any to any 25 out
;;
iptables)
${iptables} -A OUTPUT -p tcp --dport 25 -m owner --uid-owner qmailr -j ACCEPT
${iptables} -A OUTPUT -p tcp --dport 25 -m owner --uid-owner postfix -j ACCEPT
${iptables} -A OUTPUT -p tcp --dport 25 -m owner --uid-owner root -j ACCEPT
${iptables} -A OUTPUT -p tcp --dport 25 -m state --stat NEW -j DROP
;;
esac
esac
# Block annoying and erroneous attempts by facter to reach AWS EC2 link-local address
case "${firewall_tool}" in
ipfw)
${ipfw} add 2700 unreach host ip from any to 169.254.169.254 out
;;
iptables)
${iptables} -A OUTPUT -d 169.254.169.254 -j REJECT --reject-with icmp-host-unreachable
;;
esac
# Allow webmail servers to IMAPS, pair_poppass
case "${series}" in
1|2|12|22)
case "${firewall_tool}" in
ipfw)
${ipfw} add 3600 allow tcp from 209.68.6.94 to any 993,40040 in
${ipfw} add 3600 allow tcp from 66.39.3.96 to any 993,40040 in
${ipfw} add 3600 allow tcp from 66.39.3.34 to any 993,40040 in
${ipfw} add 3600 allow tcp from 66.39.3.58 to any 993,40040 in
${ipfw} add 3600 allow tcp from 66.39.3.83 to any 993,40040 in
${ipfw} add 3600 allow tcp from 216.146.198.15 to any 993,40040 in
${ipfw} add 3601 deny tcp from any to any 40040 in
;;
iptables)
${iptables} -A INPUT -p tcp -s 209.68.6.94 -m multiport --dports 993,40040 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.96 -m multiport --dports 993,40040 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.34 -m multiport --dports 993,40040 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.58 -m multiport --dports 993,40040 -j ACCEPT
${iptables} -A INPUT -p tcp -s 66.39.3.83 -m multiport --dports 993,40040 -j ACCEPT
${iptables} -A INPUT -p tcp -s 216.146.198.15 -m multiport --dports 993,40040 -j ACCEPT
${iptables} -A INPUT -p tcp --dport 40040 -j DROP
;;
esac
esac
# Block memcached on user servers
case "${series}" in
1|2|12|22)
case "${firewall_tool}" in
ipfw)
${ipfw} add 3700 deny tcp from any to any 11211 in // memcached
${ipfw} add 3700 deny udp from any to any 11211 in // memcached
;;
iptables)
${iptables} -A INPUT -p tcp --dport 11211 -m comment --comment memcached -j DROP
${iptables} -A INPUT -p udp --dport 11211 -m comment --comment memcached -j DROP
;;
esac
esac
# Block broadcast and multicast packets by default
case "${firewall_tool}" in
ipfw)
${ipfw} add 4000 deny ip from any to 209.68.63.255
${ipfw} add 4000 deny ip from any to 216.92.255.255
${ipfw} add 4000 deny ip from any to 66.39.127.255
${ipfw} add 4000 deny ip from any to 66.39.159.255
${ipfw} add 4000 deny ip from any to 65.181.191.255
${ipfw} add 4000 deny ip from any to 224.0.0.0/3
;;
iptables)
${iptables} -A INPUT -d 209.68.63.255 -j DROP
${iptables} -A INPUT -d 216.92.255.255 -j DROP
${iptables} -A INPUT -d 66.39.127.255 -j DROP
${iptables} -A INPUT -d 66.39.159.255 -j DROP
${iptables} -A INPUT -d 65.181.191.255 -j DROP
${iptables} -A INPUT -d 224.0.0.0/3 -j DROP
;;
esac
# load the ACC firewall preamble rules, if any, and the custom ACC
# firewall rules
# on ipfw, these use rule numbers 12000 and 12001
case "${firewall_tool}" in
iptables)
${iptables} -A INPUT -j INPUT-pre-acc -m comment --comment "anti-lockout from customer rules"
${iptables} -A INPUT -j INPUT-acc -m comment --comment "customer rules"
[ "$monarx" = "YES" ] && ${iptables} -A INPUT -j MONARX_AGENT
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -A INPUT -j INPUT-pre-acc
${ip6tables} -A INPUT -j INPUT-acc
[ "$monarx" = "YES" ] && ${ip6tables} -A INPUT -j MONARX_AGENT
fi
;;
esac
if [ -f "${acc_firewall_conf}" ] ; then
. "${acc_firewall_conf}"
fi
case "${series}" in
1|2|12|21)
# Whitelist SecurityMetrics, CloudFlare, Securi, Bunny
case "${firewall_tool}" in
ipfw)
${ipfw} add 13000 allow tcp from "table(125)" to any in // SecurityMetrics
${ipfw} add 13001 allow tcp from "table(126)" to any in // CloudFlare
${ipfw} add 13002 allow tcp from "table(127)" to any in // Sucuri
${ipfw} add 13003 allow tcp from "table(128)" to any in // Bunny
${ipfw} add 13004 allow tcp from "table(129)" to any in // HackerGuardian
${ipfw} add 13005 allow tcp from "table(126v6)" to any in // CloudFlare
${ipfw} add 13006 allow tcp from "table(127v6)" to any in // Sucuri
${ipfw} add 13007 allow tcp from "table(128v6)" to any in // Bunny
# SecurityMetrics
${ipfw} table 125 add 63.235.131.192/26
${ipfw} table 125 add 204.238.82.0/26
# Sucuri
${ipfw} table 127 add 192.88.134.0/23
${ipfw} table 127 add 185.93.228.0/22
${ipfw} table 127 add 66.248.200.0/22
${ipfw} table 127 add 208.109.0.0/22
${ipfw} table 127v6 add 2a02:fe80::/29
# Cloudflare
if [ -f "/etc/rc.firewall-CLOUDFLARE" ]; then
for NET in `egrep '^[0-9\./]+$' /etc/rc.firewall-CLOUDFLARE`; do
${ipfw} table 126 add $NET
done
for NET in `egrep '^[0-9a-f:/]+$' /etc/rc.firewall-CLOUDFLARE`; do
${ipfw} table 126v6 add $NET
done
fi
# Bunny
if [ -f "/etc/rc.firewall-BUNNY" ]; then
for NET in `egrep '^[0-9\./]+$' /etc/rc.firewall-BUNNY`; do
${ipfw} table 128 add $NET
done
for NET in `egrep '^[0-9a-f:/]+$' /etc/rc.firewall-BUNNY`; do
${ipfw} table 128v6 add $NET
done
fi
# Sectigo HackerGuardian
${ipfw} table 129 add 64.39.96.0/20
${ipfw} table 129 add 139.87.112.0/23
;;
iptables)
${ipset} -exist create 125 hash:net
${ipset} -exist create 126 hash:net
${ipset} -exist create 127 hash:net
${ipset} -exist create 128 hash:net
${ipset} -exist create 129 hash:net
${ipset} -exist create 126v6 hash:net family inet6
${ipset} -exist create 127v6 hash:net family inet6
${ipset} -exist create 128v6 hash:net family inet6
${iptables} -A INPUT -m set --match-set 125 src -p tcp -m comment --comment SecurityMetrics -j ACCEPT
${iptables} -A INPUT -m set --match-set 126 src -p tcp -m comment --comment CloudFlare -j ACCEPT
${iptables} -A INPUT -m set --match-set 127 src -p tcp -m comment --comment Sucuri -j ACCEPT
${iptables} -A INPUT -m set --match-set 128 src -p tcp -m comment --comment Bunny -j ACCEPT
${iptables} -A INPUT -m set --match-set 129 src -p tcp -m comment --comment HackerGuardian -j ACCEPT
${ip6tables} -A INPUT -m set --match-set 126v6 src -p tcp -m comment --comment CloudFlare -j ACCEPT
${ip6tables} -A INPUT -m set --match-set 127v6 src -p tcp -m comment --comment Sucuri -j ACCEPT
${ip6tables} -A INPUT -m set --match-set 128v6 src -p tcp -m comment --comment Bunny -j ACCEPT
# SecurityMetrics
${ipset} -exist add 125 63.235.131.192/26
${ipset} -exist add 125 204.238.82.0/26
# Sucuri
${ipset} -exist add 127 192.88.134.0/23
${ipset} -exist add 127 185.93.228.0/22
${ipset} -exist add 127 66.248.200.0/22
${ipset} -exist add 127 208.109.0.0/22
${ipset} -exist add 127v6 2a02:fe80::/29
# Cloudflare
if [ -f "/etc/rc.firewall-CLOUDFLARE" ]; then
for NET in `egrep '^[0-9\./]+$' /etc/rc.firewall-CLOUDFLARE`; do
${ipset} -exist add 126 $NET
done
for NET in `egrep '^[0-9a-f:/]+$' /etc/rc.firewall-CLOUDFLARE`; do
${ipset} -exist add 126v6 $NET
done
fi
# Bunny
if [ -f "/etc/rc.firewall-BUNNY" ]; then
for NET in `egrep '^[0-9\./]+$' /etc/rc.firewall-BUNNY`; do
${ipset} -exist add 128 $NET
done
for NET in `egrep '^[0-9a-f:/]+$' /etc/rc.firewall-BUNNY`; do
${ipset} -exist add 128v6 $NET
done
fi
# Sectigo HackerGuardian
${ipset} -exist add 129 64.39.96.0/20
${ipset} -exist add 129 139.87.112.0/23
;;
esac
;;
esac
# load any fail2ban rules
case "${firewall_tool}" in
iptables)
${ipset} -exist create 22 hash:net
${ipset} -exist create 25 hash:net
${ipset} -exist create 80 hash:net
${ipset} -exist create 0 hash:net maxelem 98304
${iptables} -A INPUT -m set --match-set 22 src -p tcp -m multiport --dports 22,21 -j DROP
${iptables} -A INPUT -m set --match-set 25 src -p tcp -m multiport --dports 25,110,143,465,587,993,995,2525,4190 -j DROP
${iptables} -A INPUT -m set --match-set 80 src -p tcp -m multiport --dports 80,443 -j DROP
${iptables} -A INPUT -m set --match-set 0 src -j DROP
${ipset} -exist create 22v6 hash:net family inet6
${ipset} -exist create 25v6 hash:net family inet6
${ipset} -exist create 80v6 hash:net family inet6
${ipset} -exist create 0v6 hash:net family inet6
${ip6tables} -A INPUT -m set --match-set 22v6 src -p tcp -m multiport --dports 22,21 -j DROP
${ip6tables} -A INPUT -m set --match-set 25v6 src -p tcp -m multiport --dports 25,110,143,465,587,993,995,2525,4190 -j DROP
${ip6tables} -A INPUT -m set --match-set 80v6 src -p tcp -m multiport --dports 80,443 -j DROP
${ip6tables} -A INPUT -m set --match-set 0v6 src -j DROP
;;
ipfw)
${ipfw} add 57000 deny all from "table(0)" to any in // deny everything
${ipfw} add 57022 deny tcp from "table(22)" to any 22,21 in // ssh
${ipfw} add 57025 deny tcp from "table(25)" to any 25,110,143,465,587,993,995,2525,4190 in // mail
${ipfw} add 57080 deny tcp from "table(80)" to any 80,443 in // web
;;
esac
# Permanent blocks
case "${firewall_tool}" in
iptables)
${ipset} -exist create 150 hash:net maxelem 98304
${iptables} -A INPUT -m set --match-set 150 src -m comment --comment binaryedge-scanner -j DROP
if [ -f "/etc/rc.firewall-BINARYEDGE" ]; then
for NET in `cat /etc/rc.firewall-BINARYEDGE`; do
${ipset} -exist add 150 $NET
done
fi
# Spamhaus DROP
${ipset} -exist create 151 hash:net maxelem 98304
${ipset} -exist create 151v6 hash:net family inet6 maxelem 98304
${iptables} -A INPUT -m set --match-set 151 src -m comment --comment spamhaus-drop -j DROP
${ip6tables} -A INPUT -m set --match-set 151v6 src -m comment --comment spamhaus-drop -j DROP
if [ -f "/etc/rc.firewall-SPAMHAUS" ]; then
for NET in `egrep '^[0-9\./]+$' /etc/rc.firewall-SPAMHAUS`; do
${ipset} -exist add 151 $NET
done
for NET in `egrep '^[0-9a-f:/]+$' /etc/rc.firewall-SPAMHAUS`; do
${ipset} -exist add 151v6 $NET
done
fi
;;
ipfw)
${ipfw} add 57150 deny all from "table(150)" to any in // deny binaryedge
if [ -f "/etc/rc.firewall-BINARYEDGE" ]; then
for NET in `cat /etc/rc.firewall-BINARYEDGE`; do
${ipfw} table 150 add $NET
done
fi
# Spamhaus DROP
${ipfw} add 57151 deny all from "table(151)" to any in // deny spamhaus
${ipfw} add 57152 deny all from "table(151v6)" to any in // deny spamhaus
if [ -f "/etc/rc.firewall-SPAMHAUS" ]; then
for NET in `egrep '^[0-9\./]+$' /etc/rc.firewall-SPAMHAUS`; do
${ipfw} table 151 add $NET
done
for NET in `egrep '^[0-9a-f:/]+$' /etc/rc.firewall-SPAMHAUS`; do
${ipfw} table 151v6 add $NET
done
fi
;;
esac
# restore ipset rules
case "${firewall_tool}" in
iptables)
test -f ${ipsetsave} && ${ipsetsave} -restore
;;
esac
# IPv6 is using a 'deny by default' policy. to allow overriding it with
# acc rules, etc, we do our 'ACCEPT's here at the end
# ssh access is handled by rate-limiting rules later
if [ -n "${main_ipv6}" ] ; then
case "${series}" in
1|2|12|21)
case "${firewall_tool}" in
ipfw)
${ipfw} add 59000 allow tcp from any to me6 80,443 in
${ipfw} add 59000 allow tcp from any to me6 25,465,587,2525,4190 in
${ipfw} add 59000 allow tcp from any to me6 110,143,993,995 in
${ipfw} add 59000 allow tcp from any to me6 53 in
${ipfw} add 59000 allow udp from any to me6 53 in
;;
iptables)
${ip6tables} -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
${ip6tables} -A INPUT -p tcp -m multiport --dports 25,465,587,2525,4190 -j ACCEPT
${ip6tables} -A INPUT -p tcp -m multiport --dports 110,143,993,995 -j ACCEPT
${ip6tables} -A INPUT -p tcp --dport 53 -j ACCEPT
${ip6tables} -A INPUT -p udp --dport 53 -j ACCEPT
;;
esac
esac
fi
# load any custom rules for this server:
case "${firewall_tool}" in
iptables)
${iptables} -A INPUT -j INPUT-custom -m comment --comment "Custom server rules"
${iptables} -I INPUT 1 -j INPUT-custom-pre -m comment --comment "Default rule overrides"
${iptables} -A OUTPUT -j OUTPUT-custom
${iptables} -I OUTPUT 1 -j OUTPUT-custom-pre
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -A INPUT -j INPUT-custom
${ip6tables} -I INPUT 1 -j INPUT-custom-pre
${ip6tables} -A OUTPUT -j OUTPUT-custom
${ip6tables} -I OUTPUT 1 -j OUTPUT-custom-pre
fi
;;
esac
# rc.firewall.local should be last and take precedence
if [ -f "${local_firewall_conf}" ] ; then
. "${local_firewall_conf}"
fi
# Connection Limits for SSH (after acc rules)
case "${series}" in
1|2|12|21)
case "${firewall_tool}" in
ipfw)
${ipfw} add 58000 allow tcp from any to any dst-port 22 in limit src-addr 10
;;
iptables)
${iptables} -A INPUT -p tcp --dport 22 -m connlimit --connlimit-above 10 -j REJECT
if [ -n "${main_ipv6}" ] ; then
${ip6tables} -A INPUT -p tcp --dport 22 -m connlimit --connlimit-above 10 -j REJECT
${ip6tables} -A INPUT -p tcp --dport 22 -j ACCEPT
fi
;;
esac
esac
# Stop here if in debug mode
if [ ! -z $DEBUG ]; then
exit
fi
# run this at the end, typically used to restart necessary services
if [ -x $post_script ]; then
$post_script
rm -f /etc/rc.firewall.later
fi
: # true return value