github/vesta
1
0
Fork 0
mirror of https://github.com/serghey-rodin/vesta.git synced 2025-08-21 05:44:07 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #332 from StudioMaX/patch-1

Browse source 
Update v-update-firewall
This commit is contained in:
Serghey Rodin 2015-02-24 02:33:46 +02:00
commit f78a07878f
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
bin/v-update-firewall
View file

@ -12,6 +12,7 @@
# Defining absolute path for iptables and modprobe # Defining absolute path for iptables and modprobe
iptables="/sbin/iptables" iptables="/sbin/iptables"
modprobe="/sbin/modprobe" modprobe="/sbin/modprobe"
sysctl="/sbin/sysctl"
# Includes # Includes
source /etc/profile.d/vesta.sh source /etc/profile.d/vesta.sh
@ -38,11 +39,16 @@ if [ ! -e "$rules" ]; then
exit exit
fi fi
$sysctl net.netfilter.nf_conntrack_max >/dev/null 2>&1
if [ $? -ne 0 ]; then
conntrack='no'
fi
# Checking conntrack module avaiabilty # Checking conntrack module avaiabilty
$modprobe nf_conntrack >/dev/null 2>&1 $modprobe nf_conntrack >/dev/null 2>&1
$modprobe nf_conntrack_ftp >/dev/null 2>&1 $modprobe nf_conntrack_ftp >/dev/null 2>&1
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
stateful='no' conntrack_ftp='no'
fi fi
# Creating temporary file # Creating temporary file
@ -75,7 +81,7 @@ for line in $(sort -r -n -k 2 -t \' $rules); do
# Checking FTP for contrack module # Checking FTP for contrack module
if [ "$TYPE" = "FTP" ] || [ "$PORT" = '21' ]; then if [ "$TYPE" = "FTP" ] || [ "$PORT" = '21' ]; then
if [ "$stateful" != 'no' ]; then if [ "$conntrack_ftp" != 'no' ]; then
state="-m conntrack --ctstate NEW" state="-m conntrack --ctstate NEW"
else else
port="-m multiport --dports 20,21,12000:12100" port="-m multiport --dports 20,21,12000:12100"
@ -101,7 +107,7 @@ for p_rule in $(cat $ports); do
done done
# Enabling stateful support # Enabling stateful support
if [ "$stateful" != 'no' ]; then if [ "$conntrack" != 'no' ]; then
str="$iptables -A INPUT -p tcp -m state" str="$iptables -A INPUT -p tcp -m state"
str="$str --state ESTABLISHED,RELATED -j ACCEPT" str="$str --state ESTABLISHED,RELATED -j ACCEPT"
echo "$str" >> $tmp echo "$str" >> $tmp