mirror of
https://github.com/Ysurac/openmptcprouter-vps.git
synced 2025-03-09 15:50:00 +00:00
OpenMPTCProuter VPS script 0.14 initial commit
This commit is contained in:
Ycarus (Yannick Chabanois)
commit
5a2f5390c6
24 changed files with 1293 additions and 0 deletions
53
shorewall4/conntrack
Normal file
53
shorewall4/conntrack
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
#
|
||||
# Shorewall -- /etc/shorewall/conntrack
|
||||
#
|
||||
# For information about entries in this file, type "man shorewall-conntrack"
|
||||
#
|
||||
?FORMAT 3
|
||||
######################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DPORT SPORT USER SWITCH
|
||||
|
||||
?if $AUTOHELPERS && __CT_TARGET
|
||||
|
||||
?if __AMANDA_HELPER
|
||||
CT:helper:amanda:PO - - udp 10080
|
||||
?endif
|
||||
|
||||
?if __FTP_HELPER
|
||||
CT:helper:ftp:PO - - tcp 21
|
||||
?endif
|
||||
|
||||
?if __H323_HELPER
|
||||
CT:helper:RAS:PO - - udp 1719
|
||||
CT:helper:Q.931:PO - - tcp 1720
|
||||
?endif
|
||||
|
||||
?if __IRC_HELPER
|
||||
CT:helper:irc:PO - - tcp 6667
|
||||
?endif
|
||||
|
||||
?if __NETBIOS_NS_HELPER
|
||||
CT:helper:netbios-ns:PO - - udp 137
|
||||
?endif
|
||||
|
||||
?if __PPTP_HELPER
|
||||
CT:helper:pptp:PO - - tcp 1723
|
||||
?endif
|
||||
|
||||
?if __SANE_HELPER
|
||||
CT:helper:sane:PO - - tcp 6566
|
||||
?endif
|
||||
|
||||
?if __SIP_HELPER
|
||||
CT:helper:sip:PO - - udp 5060
|
||||
?endif
|
||||
|
||||
?if __SNMP_HELPER
|
||||
CT:helper:snmp:PO - - udp 161
|
||||
?endif
|
||||
|
||||
?if __TFTP_HELPER
|
||||
CT:helper:tftp:PO - - udp 69
|
||||
?endif
|
||||
|
||||
?endif
|
||||
19
shorewall4/interfaces
Normal file
19
shorewall4/interfaces
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Interfaces File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-interfaces"
|
||||
###############################################################################
|
||||
?FORMAT 2
|
||||
###############################################################################
|
||||
#ZONE INTERFACE OPTIONS
|
||||
net eth0 dhcp,tcpflags,routefilter,nosmurfs,logmartians,sourceroute=0
|
||||
vpn gt-tun0 nosmurfs,routefilter,logmartians,tcpflags
|
||||
|
||||
24
shorewall4/params
Normal file
24
shorewall4/params
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
#
|
||||
# Shorewall -- /etc/shorewall/params
|
||||
#
|
||||
# Assign any variables that you need here.
|
||||
#
|
||||
# It is suggested that variable names begin with an upper case letter
|
||||
# to distinguish them from variables used internally within the
|
||||
# Shorewall programs
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# NET_IF=eth0
|
||||
# NET_BCAST=130.252.100.255
|
||||
# NET_OPTIONS=routefilter,norfc1918
|
||||
#
|
||||
# Example (/etc/shorewall/interfaces record):
|
||||
#
|
||||
# net $NET_IF $NET_BCAST $NET_OPTIONS
|
||||
#
|
||||
# The result will be the same as if the record had been written
|
||||
#
|
||||
# net eth0 130.252.100.255 routefilter,norfc1918
|
||||
#
|
||||
###############################################################################
|
||||
23
shorewall4/policy
Normal file
23
shorewall4/policy
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Policy File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-policy"
|
||||
###############################################################################
|
||||
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
|
||||
|
||||
vpn net ACCEPT
|
||||
vpn fw ACCEPT
|
||||
fw vpn ACCEPT
|
||||
fw net ACCEPT
|
||||
net all DROP info
|
||||
# THE FOLLOWING POLICY MUST BE LAST
|
||||
all all REJECT info
|
||||
|
||||
61
shorewall4/rules
Normal file
61
shorewall4/rules
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Rules File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014,2007 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-rules"
|
||||
######################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
?SECTION ALL
|
||||
?SECTION ESTABLISHED
|
||||
?SECTION RELATED
|
||||
?SECTION INVALID
|
||||
?SECTION UNTRACKED
|
||||
?SECTION NEW
|
||||
|
||||
# Don't allow connection pickup from the net
|
||||
#
|
||||
Invalid(DROP) net all tcp
|
||||
#
|
||||
# Accept DNS connections from the firewall to the network
|
||||
#
|
||||
DNS(ACCEPT) $FW net
|
||||
#
|
||||
# Allow Ping from/to the VPN
|
||||
#
|
||||
Ping(ACCEPT) vpn $FW
|
||||
Ping(ACCEPT) $FW vpn
|
||||
#
|
||||
# Allow Ping from the firewall to the network
|
||||
#
|
||||
Ping(ACCEPT) $FW net
|
||||
#
|
||||
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
|
||||
#
|
||||
#Ping(DROP) net $FW
|
||||
Ping(ACCEPT) net $FW
|
||||
#
|
||||
# Accept connection from port > 65000 for shadowsocks and glorytun on the firewall
|
||||
#
|
||||
ACCEPT net $FW tcp 65000-65535
|
||||
ACCEPT net $FW udp 65000-65535
|
||||
#
|
||||
# Accept connection from SSH to the firewall
|
||||
#
|
||||
ACCEPT net $FW tcp 65222
|
||||
#
|
||||
# DHCP forward to the VPN from the firewall
|
||||
#
|
||||
DHCPfwd(ACCEPT) $FW vpn
|
||||
#
|
||||
# Redirect all port from 1 to 64999 to the VPN client from the network
|
||||
#
|
||||
#DNAT net vpn:10.0.0.2 tcp 1-64999
|
||||
#DNAT net vpn:10.0.0.2 udp 1-64999
|
||||
295
shorewall4/shorewall.conf
Normal file
295
shorewall4/shorewall.conf
Normal file
|
|
@ -0,0 +1,295 @@
|
|||
###############################################################################
|
||||
#
|
||||
# Shorewall Version 5 -- /etc/shorewall/shorewall.conf
|
||||
#
|
||||
# For information about the settings in this file, type "man shorewall.conf"
|
||||
#
|
||||
# Manpage also online at http://www.shorewall.net/manpages/shorewall.conf.html
|
||||
###############################################################################
|
||||
# S T A R T U P E N A B L E D
|
||||
###############################################################################
|
||||
|
||||
STARTUP_ENABLED=Yes
|
||||
|
||||
###############################################################################
|
||||
# V E R B O S I T Y
|
||||
###############################################################################
|
||||
|
||||
VERBOSITY=1
|
||||
|
||||
###############################################################################
|
||||
# P A G E R
|
||||
###############################################################################
|
||||
|
||||
PAGER=
|
||||
|
||||
###############################################################################
|
||||
# F I R E W A L L
|
||||
###############################################################################
|
||||
|
||||
FIREWALL=
|
||||
|
||||
###############################################################################
|
||||
# L O G G I N G
|
||||
###############################################################################
|
||||
|
||||
BLACKLIST_LOG_LEVEL=
|
||||
|
||||
INVALID_LOG_LEVEL=
|
||||
|
||||
LOG_BACKEND=
|
||||
|
||||
LOG_MARTIANS=Yes
|
||||
|
||||
LOG_VERBOSITY=2
|
||||
|
||||
LOGALLNEW=
|
||||
|
||||
LOGFILE=/var/log/messages
|
||||
|
||||
LOGFORMAT="Shorewall:%s:%s:"
|
||||
|
||||
LOGTAGONLY=No
|
||||
|
||||
LOGLIMIT=
|
||||
|
||||
MACLIST_LOG_LEVEL=info
|
||||
|
||||
RELATED_LOG_LEVEL=
|
||||
|
||||
RPFILTER_LOG_LEVEL=info
|
||||
|
||||
SFILTER_LOG_LEVEL=info
|
||||
|
||||
SMURF_LOG_LEVEL=info
|
||||
|
||||
STARTUP_LOG=/var/log/shorewall-init.log
|
||||
|
||||
TCP_FLAGS_LOG_LEVEL=info
|
||||
|
||||
UNTRACKED_LOG_LEVEL=
|
||||
|
||||
###############################################################################
|
||||
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
|
||||
###############################################################################
|
||||
|
||||
ARPTABLES=
|
||||
|
||||
CONFIG_PATH="${CONFDIR}/shorewall:${SHAREDIR}/shorewall"
|
||||
|
||||
GEOIPDIR=/usr/share/xt_geoip/LE
|
||||
|
||||
IPTABLES=
|
||||
|
||||
IP=
|
||||
|
||||
IPSET=
|
||||
|
||||
LOCKFILE=
|
||||
|
||||
MODULESDIR=
|
||||
|
||||
NFACCT=
|
||||
|
||||
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
|
||||
|
||||
PERL=/usr/bin/perl
|
||||
|
||||
RESTOREFILE=restore
|
||||
|
||||
SHOREWALL_SHELL=/bin/sh
|
||||
|
||||
SUBSYSLOCK=""
|
||||
|
||||
TC=
|
||||
|
||||
###############################################################################
|
||||
# D E F A U L T A C T I O N S / M A C R O S
|
||||
###############################################################################
|
||||
|
||||
ACCEPT_DEFAULT=none
|
||||
DROP_DEFAULT=Drop
|
||||
NFQUEUE_DEFAULT=none
|
||||
QUEUE_DEFAULT=none
|
||||
REJECT_DEFAULT=Reject
|
||||
|
||||
###############################################################################
|
||||
# R S H / R C P C O M M A N D S
|
||||
###############################################################################
|
||||
|
||||
RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
|
||||
RSH_COMMAND='ssh ${root}@${system} ${command}'
|
||||
|
||||
###############################################################################
|
||||
# F I R E W A L L O P T I O N S
|
||||
###############################################################################
|
||||
|
||||
ACCOUNTING=Yes
|
||||
|
||||
ACCOUNTING_TABLE=filter
|
||||
|
||||
ADD_IP_ALIASES=No
|
||||
|
||||
ADD_SNAT_ALIASES=No
|
||||
|
||||
ADMINISABSENTMINDED=Yes
|
||||
|
||||
AUTOCOMMENT=Yes
|
||||
|
||||
AUTOHELPERS=Yes
|
||||
|
||||
AUTOMAKE=No
|
||||
|
||||
BASIC_FILTERS=No
|
||||
|
||||
BLACKLIST="NEW,INVALID,UNTRACKED"
|
||||
|
||||
CHAIN_SCRIPTS=Yes
|
||||
|
||||
CLAMPMSS=No
|
||||
|
||||
CLEAR_TC=Yes
|
||||
|
||||
COMPLETE=No
|
||||
|
||||
DEFER_DNS_RESOLUTION=Yes
|
||||
|
||||
DELETE_THEN_ADD=Yes
|
||||
|
||||
DETECT_DNAT_IPADDRS=No
|
||||
|
||||
DISABLE_IPV6=No
|
||||
|
||||
DOCKER=No
|
||||
|
||||
DONT_LOAD=
|
||||
|
||||
DYNAMIC_BLACKLIST=Yes
|
||||
|
||||
EXPAND_POLICIES=Yes
|
||||
|
||||
EXPORTMODULES=Yes
|
||||
|
||||
FASTACCEPT=No
|
||||
|
||||
FORWARD_CLEAR_MARK=
|
||||
|
||||
HELPERS=
|
||||
|
||||
IGNOREUNKNOWNVARIABLES=No
|
||||
|
||||
IMPLICIT_CONTINUE=No
|
||||
|
||||
INLINE_MATCHES=No
|
||||
|
||||
IPSET_WARNINGS=Yes
|
||||
|
||||
IP_FORWARDING=On
|
||||
|
||||
KEEP_RT_TABLES=No
|
||||
|
||||
LOAD_HELPERS_ONLY=Yes
|
||||
|
||||
MACLIST_TABLE=filter
|
||||
|
||||
MACLIST_TTL=
|
||||
|
||||
MANGLE_ENABLED=Yes
|
||||
|
||||
MAPOLDACTIONS=No
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MINIUPNPD=No
|
||||
|
||||
MODULE_SUFFIX=ko
|
||||
|
||||
MULTICAST=No
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
NULL_ROUTE_RFC1918=No
|
||||
|
||||
OPTIMIZE=0
|
||||
|
||||
OPTIMIZE_ACCOUNTING=No
|
||||
|
||||
REJECT_ACTION=
|
||||
|
||||
REQUIRE_INTERFACE=No
|
||||
|
||||
RESTART=restart
|
||||
|
||||
RESTORE_DEFAULT_ROUTE=Yes
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
RETAIN_ALIASES=No
|
||||
|
||||
ROUTE_FILTER=Yes
|
||||
|
||||
SAVE_ARPTABLES=No
|
||||
|
||||
SAVE_IPSETS=No
|
||||
|
||||
TC_ENABLED=Internal
|
||||
|
||||
TC_EXPERT=No
|
||||
|
||||
TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
|
||||
|
||||
TRACK_PROVIDERS=No
|
||||
|
||||
TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
||||
VERBOSE_MESSAGES=Yes
|
||||
|
||||
WARNOLDCAPVERSION=Yes
|
||||
|
||||
WORKAROUNDS=No
|
||||
|
||||
ZERO_MARKS=No
|
||||
|
||||
ZONE2ZONE=-
|
||||
|
||||
###############################################################################
|
||||
# P A C K E T D I S P O S I T I O N
|
||||
###############################################################################
|
||||
|
||||
BLACKLIST_DISPOSITION=DROP
|
||||
|
||||
INVALID_DISPOSITION=CONTINUE
|
||||
|
||||
MACLIST_DISPOSITION=REJECT
|
||||
|
||||
RELATED_DISPOSITION=ACCEPT
|
||||
|
||||
RPFILTER_DISPOSITION=DROP
|
||||
|
||||
SMURF_DISPOSITION=DROP
|
||||
|
||||
SFILTER_DISPOSITION=DROP
|
||||
|
||||
TCP_FLAGS_DISPOSITION=DROP
|
||||
|
||||
UNTRACKED_DISPOSITION=CONTINUE
|
||||
|
||||
################################################################################
|
||||
# P A C K E T M A R K L A Y O U T
|
||||
################################################################################
|
||||
|
||||
TC_BITS=
|
||||
|
||||
PROVIDER_BITS=
|
||||
|
||||
PROVIDER_OFFSET=
|
||||
|
||||
MASK_BITS=
|
||||
|
||||
ZONE_BITS=0
|
||||
23
shorewall4/snat
Normal file
23
shorewall4/snat
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
#
|
||||
# Shorewall - Sample SNAT/Masqueradee File for two-interface configuration.
|
||||
# Copyright (C) 2006-2016 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-snat"
|
||||
#
|
||||
# See http://shorewall.net/manpages/shorewall-snat.html for more information
|
||||
###########################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
#
|
||||
MASQUERADE 10.0.0.0/8,\
|
||||
169.254.0.0/16,\
|
||||
172.16.0.0/12,\
|
||||
192.168.0.0/16 eth0
|
||||
# SNAT from VPN server for all VPN clients
|
||||
SNAT(10.0.0.1) 0.0.0.0/0 gt-tun0
|
||||
18
shorewall4/stoppedrules
Normal file
18
shorewall4/stoppedrules
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
#
|
||||
# Shorewall version 4.5 - Sample Stoppedrules File for two-interface configuration.
|
||||
# Copyright (C) 2012 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-stoppedrules"
|
||||
###############################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE
|
||||
# PORT(S) PORT(S)
|
||||
ACCEPT gt-tun0 -
|
||||
ACCEPT - gt-tun0
|
||||
|
||||
19
shorewall4/zones
Normal file
19
shorewall4/zones
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Zones File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-zones"
|
||||
###############################################################################
|
||||
#ZONE TYPE OPTIONS IN OUT
|
||||
# OPTIONS OPTIONS
|
||||
fw firewall
|
||||
net ipv4
|
||||
vpn ipv4
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue