mirror of
https://github.com/Ysurac/openmptcprouter-vps.git
synced 2025-03-09 15:50:00 +00:00
OpenMPTCProuter VPS script 0.14 initial commit
This commit is contained in:
Ycarus (Yannick Chabanois)
commit
5a2f5390c6
24 changed files with 1293 additions and 0 deletions
53
shorewall6/conntrack
Normal file
53
shorewall6/conntrack
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
#
|
||||
# Shorewall6 -- /etc/shorewall6/conntrack
|
||||
#
|
||||
# For information about entries in this file, type "man shorewall6-conntrack"
|
||||
#
|
||||
?FORMAT 3
|
||||
##############################################################################################
|
||||
#ACTION SOURCE DEST PROTO DPORT SPORT USER SWITCH
|
||||
|
||||
?if $AUTOHELPERS && __CT_TARGET
|
||||
|
||||
?if __AMANDA_HELPER
|
||||
CT:helper:amanda:PO - - udp 10080
|
||||
?endif
|
||||
|
||||
?if __FTP_HELPER
|
||||
CT:helper:ftp:PO - - tcp 21
|
||||
?endif
|
||||
|
||||
?if __H323_HELPER
|
||||
CT:helper:RAS:PO - - udp 1719
|
||||
CT:helper:Q.931:PO - - tcp 1720
|
||||
?endif
|
||||
|
||||
?if __IRC_HELPER
|
||||
CT:helper:irc:PO - - tcp 6667
|
||||
?endif
|
||||
|
||||
?if __NETBIOS_NS_HELPER
|
||||
CT:helper:netbios-ns:PO - - udp 137
|
||||
?endif
|
||||
|
||||
?if __PPTP_HELPER
|
||||
CT:helper:pptp:PO - - tcp 1723
|
||||
?endif
|
||||
|
||||
?if __SANE_HELPER
|
||||
CT:helper:sane:PO - - tcp 6566
|
||||
?endif
|
||||
|
||||
?if __SIP_HELPER
|
||||
CT:helper:sip:PO - - udp 5060
|
||||
?endif
|
||||
|
||||
?if __SNMP_HELPER
|
||||
CT:helper:snmp:PO - - udp 161
|
||||
?endif
|
||||
|
||||
?if __TFTP_HELPER
|
||||
CT:helper:tftp:PO - - udp 69
|
||||
?endif
|
||||
|
||||
?endif
|
||||
19
shorewall6/interfaces
Normal file
19
shorewall6/interfaces
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Interfaces File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-interfaces"
|
||||
###############################################################################
|
||||
?FORMAT 2
|
||||
###############################################################################
|
||||
#ZONE INTERFACE OPTIONS
|
||||
net eth0 dhcp,tcpflags,nosmurfs,sourceroute=0
|
||||
vpn gt-tun0 nosmurfs,tcpflags
|
||||
|
||||
23
shorewall6/params
Normal file
23
shorewall6/params
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
#
|
||||
# Shorewall6 -- /etc/shorewall6/params
|
||||
#
|
||||
# Assign any variables that you need here.
|
||||
#
|
||||
# It is suggested that variable names begin with an upper case letter
|
||||
# to distinguish them from variables used internally within the
|
||||
# Shorewall6 programs
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# NET_IF=eth0
|
||||
# NET_OPTIONS=dhcp,nosmurfs
|
||||
#
|
||||
# Example (/etc/shorewall6/interfaces record):
|
||||
#
|
||||
# net $NET_IF - $NET_OPTIONS
|
||||
#
|
||||
# The result will be the same as if the record had been written
|
||||
#
|
||||
# net eth0 - dhcp,nosmurfs
|
||||
#
|
||||
###############################################################################
|
||||
23
shorewall6/policy
Normal file
23
shorewall6/policy
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Policy File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-policy"
|
||||
###############################################################################
|
||||
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
|
||||
|
||||
vpn net ACCEPT
|
||||
vpn fw ACCEPT
|
||||
fw vpn ACCEPT
|
||||
fw net ACCEPT
|
||||
net all DROP info
|
||||
# THE FOLLOWING POLICY MUST BE LAST
|
||||
all all REJECT info
|
||||
|
||||
60
shorewall6/rules
Normal file
60
shorewall6/rules
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Rules File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014,2007 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-rules"
|
||||
######################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
?SECTION ALL
|
||||
?SECTION ESTABLISHED
|
||||
?SECTION RELATED
|
||||
?SECTION INVALID
|
||||
?SECTION UNTRACKED
|
||||
?SECTION NEW
|
||||
|
||||
# Don't allow connection pickup from the net
|
||||
#
|
||||
Invalid(DROP) net all tcp
|
||||
#
|
||||
# Accept DNS connections from the firewall to the network
|
||||
#
|
||||
DNS(ACCEPT) $FW net
|
||||
#
|
||||
# Allow Ping from/to the VPN
|
||||
#
|
||||
Ping(ACCEPT) vpn $FW
|
||||
Ping(ACCEPT) $FW vpn
|
||||
#
|
||||
# Allow Ping from the firewall to the network
|
||||
#
|
||||
Ping(ACCEPT) $FW net
|
||||
#
|
||||
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded..
|
||||
#
|
||||
#Ping(DROP) net $FW
|
||||
Ping(ACCEPT) net $FW
|
||||
#
|
||||
# Accept connection from port > 65000 for shadowsocks and glorytun on the firewall
|
||||
#
|
||||
ACCEPT net $FW tcp 65000-65535
|
||||
ACCEPT net $FW udp 65000-65535
|
||||
#
|
||||
# Accept connection from SSH to the firewall
|
||||
#
|
||||
ACCEPT net $FW tcp 65222
|
||||
#
|
||||
# DHCP forward to the VPN from the firewall
|
||||
#
|
||||
DHCPfwd(ACCEPT) $FW vpn
|
||||
#
|
||||
# Redirect all port from 1 to 64999 to the VPN client from the network
|
||||
#
|
||||
#DNAT net vpn:10.0.0.2 tcp 1-64999
|
||||
268
shorewall6/shorewall6.conf
Normal file
268
shorewall6/shorewall6.conf
Normal file
|
|
@ -0,0 +1,268 @@
|
|||
###############################################################################
|
||||
#
|
||||
# Shorewall Version 5 -- /etc/shorewall6/shorewall6.conf
|
||||
#
|
||||
# For information about the settings in this file, type "man shorewall6.conf"
|
||||
#
|
||||
# Manpage also online at
|
||||
# http://www.shorewall.net/manpages6/shorewall6.conf.html
|
||||
###############################################################################
|
||||
# S T A R T U P E N A B L E D
|
||||
###############################################################################
|
||||
|
||||
STARTUP_ENABLED=Yes
|
||||
|
||||
###############################################################################
|
||||
# V E R B O S I T Y
|
||||
###############################################################################
|
||||
|
||||
VERBOSITY=1
|
||||
|
||||
###############################################################################
|
||||
# P A G E R
|
||||
###############################################################################
|
||||
|
||||
PAGER=
|
||||
|
||||
###############################################################################
|
||||
# F I R E W A L L
|
||||
###############################################################################
|
||||
|
||||
FIREWALL=
|
||||
|
||||
###############################################################################
|
||||
# L O G G I N G
|
||||
###############################################################################
|
||||
|
||||
BLACKLIST_LOG_LEVEL=
|
||||
|
||||
INVALID_LOG_LEVEL=
|
||||
|
||||
LOG_BACKEND=
|
||||
|
||||
LOG_VERBOSITY=2
|
||||
|
||||
LOGALLNEW=
|
||||
|
||||
LOGFILE=/var/log/messages
|
||||
|
||||
LOGFORMAT="Shorewall:%s:%s:"
|
||||
|
||||
LOGLIMIT=
|
||||
|
||||
LOGTAGONLY=No
|
||||
|
||||
MACLIST_LOG_LEVEL=info
|
||||
|
||||
RELATED_LOG_LEVEL=
|
||||
|
||||
RPFILTER_LOG_LEVEL=info
|
||||
|
||||
SFILTER_LOG_LEVEL=info
|
||||
|
||||
SMURF_LOG_LEVEL=info
|
||||
|
||||
STARTUP_LOG=/var/log/shorewall6-init.log
|
||||
|
||||
TCP_FLAGS_LOG_LEVEL=info
|
||||
|
||||
UNTRACKED_LOG_LEVEL=
|
||||
|
||||
###############################################################################
|
||||
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
|
||||
###############################################################################
|
||||
|
||||
CONFIG_PATH="${CONFDIR}/shorewall6:/usr/share/shorewall6:${SHAREDIR}/shorewall"
|
||||
|
||||
GEOIPDIR=/usr/share/xt_geoip/LE
|
||||
|
||||
IP6TABLES=
|
||||
|
||||
IP=
|
||||
|
||||
IPSET=
|
||||
|
||||
LOCKFILE=
|
||||
|
||||
MODULESDIR=
|
||||
|
||||
NFACCT=
|
||||
|
||||
PERL=/usr/bin/perl
|
||||
|
||||
PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin"
|
||||
|
||||
RESTOREFILE=restore
|
||||
|
||||
SHOREWALL_SHELL=/bin/sh
|
||||
|
||||
SUBSYSLOCK=""
|
||||
|
||||
TC=
|
||||
|
||||
###############################################################################
|
||||
# D E F A U L T A C T I O N S / M A C R O S
|
||||
###############################################################################
|
||||
|
||||
ACCEPT_DEFAULT=none
|
||||
DROP_DEFAULT=Drop
|
||||
NFQUEUE_DEFAULT=none
|
||||
QUEUE_DEFAULT=none
|
||||
REJECT_DEFAULT=Reject
|
||||
|
||||
###############################################################################
|
||||
# R S H / R C P C O M M A N D S
|
||||
###############################################################################
|
||||
|
||||
RCP_COMMAND='scp ${files} ${root}@${system}:${destination}'
|
||||
RSH_COMMAND='ssh ${root}@${system} ${command}'
|
||||
|
||||
###############################################################################
|
||||
# F I R E W A L L O P T I O N S
|
||||
###############################################################################
|
||||
|
||||
ACCOUNTING=Yes
|
||||
|
||||
ACCOUNTING_TABLE=filter
|
||||
|
||||
ADMINISABSENTMINDED=Yes
|
||||
|
||||
AUTOCOMMENT=Yes
|
||||
|
||||
AUTOHELPERS=Yes
|
||||
|
||||
AUTOMAKE=No
|
||||
|
||||
BASIC_FILTERS=No
|
||||
|
||||
BLACKLIST="NEW,INVALID,UNTRACKED"
|
||||
|
||||
CHAIN_SCRIPTS=Yes
|
||||
|
||||
CLAMPMSS=No
|
||||
|
||||
CLEAR_TC=No
|
||||
|
||||
COMPLETE=No
|
||||
|
||||
DEFER_DNS_RESOLUTION=Yes
|
||||
|
||||
DELETE_THEN_ADD=Yes
|
||||
|
||||
DONT_LOAD=
|
||||
|
||||
DYNAMIC_BLACKLIST=Yes
|
||||
|
||||
EXPAND_POLICIES=Yes
|
||||
|
||||
EXPORTMODULES=Yes
|
||||
|
||||
FASTACCEPT=No
|
||||
|
||||
FORWARD_CLEAR_MARK=Yes
|
||||
|
||||
HELPERS=
|
||||
|
||||
IGNOREUNKNOWNVARIABLES=No
|
||||
|
||||
IMPLICIT_CONTINUE=No
|
||||
|
||||
INLINE_MATCHES=No
|
||||
|
||||
IPSET_WARNINGS=Yes
|
||||
|
||||
IP_FORWARDING=On
|
||||
|
||||
KEEP_RT_TABLES=Yes
|
||||
|
||||
LOAD_HELPERS_ONLY=Yes
|
||||
|
||||
MACLIST_TABLE=filter
|
||||
|
||||
MACLIST_TTL=
|
||||
|
||||
MANGLE_ENABLED=Yes
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MODULE_SUFFIX=ko
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
OPTIMIZE=1
|
||||
|
||||
OPTIMIZE_ACCOUNTING=No
|
||||
|
||||
REJECT_ACTION=
|
||||
|
||||
REQUIRE_INTERFACE=No
|
||||
|
||||
RESTART=restart
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
SAVE_IPSETS=No
|
||||
|
||||
TC_ENABLED=No
|
||||
|
||||
TC_EXPERT=No
|
||||
|
||||
TC_PRIOMAP="2 3 3 3 2 3 1 1 2 2 2 2 2 2 2 2"
|
||||
|
||||
TRACK_PROVIDERS=No
|
||||
|
||||
TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
||||
VERBOSE_MESSAGES=Yes
|
||||
|
||||
WARNOLDCAPVERSION=Yes
|
||||
|
||||
WORKAROUNDS=No
|
||||
|
||||
ZERO_MARKS=No
|
||||
|
||||
ZONE2ZONE=-
|
||||
|
||||
###############################################################################
|
||||
# P A C K E T D I S P O S I T I O N
|
||||
###############################################################################
|
||||
|
||||
BLACKLIST_DISPOSITION=DROP
|
||||
|
||||
INVALID_DISPOSITION=CONTINUE
|
||||
|
||||
MACLIST_DISPOSITION=REJECT
|
||||
|
||||
RELATED_DISPOSITION=ACCEPT
|
||||
|
||||
SFILTER_DISPOSITION=DROP
|
||||
|
||||
RPFILTER_DISPOSITION=DROP
|
||||
|
||||
SMURF_DISPOSITION=DROP
|
||||
|
||||
TCP_FLAGS_DISPOSITION=DROP
|
||||
|
||||
UNTRACKED_DISPOSITION=CONTINUE
|
||||
|
||||
################################################################################
|
||||
# P A C K E T M A R K L A Y O U T
|
||||
################################################################################
|
||||
|
||||
TC_BITS=
|
||||
|
||||
PROVIDER_BITS=
|
||||
|
||||
PROVIDER_OFFSET=
|
||||
|
||||
MASK_BITS=
|
||||
|
||||
ZONE_BITS=0
|
||||
|
||||
#LAST LINE -- DO NOT REMOVE
|
||||
18
shorewall6/stoppedrules
Normal file
18
shorewall6/stoppedrules
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
#
|
||||
# Shorewall version 4.5 - Sample Stoppedrules File for two-interface configuration.
|
||||
# Copyright (C) 2012 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-stoppedrules"
|
||||
###############################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE
|
||||
# PORT(S) PORT(S)
|
||||
ACCEPT gt-tun0 -
|
||||
ACCEPT - gt-tun0
|
||||
|
||||
19
shorewall6/zones
Normal file
19
shorewall6/zones
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
#
|
||||
# Shorewall version 4.0 - Sample Zones File for two-interface configuration.
|
||||
# Copyright (C) 2006-2014 by the Shorewall Team
|
||||
#
|
||||
# This library is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-zones"
|
||||
###############################################################################
|
||||
#ZONE TYPE OPTIONS IN OUT
|
||||
# OPTIONS OPTIONS
|
||||
fw firewall
|
||||
net ipv6
|
||||
vpn ipv6
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue