Firewall Itegration:
1. Anlegen: die Zone vpn mit LuCI, kein Masquerading bei lan! Bild unten.
2. Anlegen:
/etc/config/firewall
Code
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
option src_ip '88.xx.xx.220'
config rule
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
option src_ip '88.xx.xx.220'
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config include
option path '/etc/firewall.user'
option reload 1
3. Anlegen:
/etc/firewall.user
Code
#/etc/firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
/etc/firewall.ipsec
4. Anlegen (. /etc/functions.sh gegen . /lib/functions.sh getauscht):
/etc/ipsec/firewall.sh
Code
#/etc/ipsec/firewall.sh
#!/bin/sh
#/etc/ipsec/firewall.sh - version 2
. /lib/functions.sh
GetZone() {
config_get zone "$1" zone vpn
}
GetTunnel() {
local remote_subnet
local local_subnet
local local_nat
config_get remote_subnet "$1" remote_subnet
config_get local_subnet "$1" local_subnet
config_get local_nat "$1" local_nat ""
iptables -A zone_${zone}_ACCEPT -d $remote_subnet -j ACCEPT
iptables -A zone_${zone}_ACCEPT -s $remote_subnet -j ACCEPT
iptables -A zone_${zone}_REJECT -d $remote_subnet -j reject
iptables -A zone_${zone}_REJECT -s $remote_subnet -j reject
iptables -A zone_${zone}_INPUT -s $remote_subnet -j zone_${zone}
iptables -A zone_${zone}_FORWARD -s $remote_subnet -j zone_${zone}_forward
if [ "$local_nat" == "" ]; then
iptables -t nat -A zone_${zone}_nat -d $remote_subnet -j ACCEPT
else
iptables -t nat -A zone_${zone}_nat -d $remote_subnet \
-s $local_subnet -j NETMAP --to $local_nat
iptables -t nat -A prerouting_${zone} -s $remote_subnet \
-d $local_nat -j NETMAP --to $local_subnet
fi
}
GetRemote() {
local enabled
local gateway
config_get_bool enabled "$1" enabled 0
config_get gateway "$1" gateway
[[ "$enabled" == "0" ]] && return
config_list_foreach "$1" tunnel GetTunnel
}
GetDevice() {
. /lib/functions/network.sh
local interface="$1"
network_get_device listen "$interface"
# open IPsec endpoint
if [ "$listen" == "" ]; then
iptables -A zone_${zone}_gateway -p esp -j ACCEPT
iptables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT
iptables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT
if [ $has_ip6tables -eq 1 ]; then
ip6tables -A zone_${zone}_gateway -p esp -j ACCEPT
ip6tables -A zone_${zone}_gateway -p udp --dport 500 -j ACCEPT
ip6tables -A zone_${zone}_gateway -p udp --dport 4500 -j ACCEPT
fi
else
iptables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT
iptables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT
iptables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT
if [ $has_ip6tables -eq 1 ]; then
ip6tables -A zone_${zone}_gateway -i $listen -p esp -j ACCEPT
ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 500 -j ACCEPT
ip6tables -A zone_${zone}_gateway -i $listen -p udp --dport 4500 -j ACCEPT
fi
fi
}
GetInterface() {
config_list_foreach "$1" listen GetDevice
}
zone=vpn
config_load ipsec
config_foreach GetZone ipsec
if [ -x /usr/sbin/ip6tables ]; then
has_ip6tables=1
else
has_ip6tables=0
fi
iptables -F zone_${zone}_ACCEPT
if [ $has_ip6tables -eq 1 ]; then
ip6tables -F zone_${zone}_ACCEPT
fi
iptables -N zone_${zone}_gateway
iptables -I input -j zone_${zone}_gateway
if [ $has_ip6tables -eq 1 ]; then
ip6tables -N zone_${zone}_gateway
ip6tables -I input -j zone_${zone}_gateway
fi
config_foreach GetInterface ipsec
iptables -t nat -F zone_${zone}_nat
iptables -t nat -I POSTROUTING 2 -j zone_${zone}_nat
iptables -t nat -I PREROUTING 2 -j zone_${zone}_prerouting
# sort VPN rules to top of forward zones and insert VPN reject marker afterwards
ForwardZones=`iptables -S | awk '/.N.*zone.*_forward/{print $2}' | grep -v ${zone}`
for ForwardZone in $ForwardZones ; do
echo "iptables -F $ForwardZone" > /tmp/fwrebuild
iptables -S $ForwardZone | grep zone_${zone}_ACCEPT | \
grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild
echo "iptables -A $ForwardZone -j zone_${zone}_REJECT" >> /tmp/fwrebuild
iptables -S $ForwardZone | grep -v zone_${zone}_ACCEPT | \
grep -v "^-N" | awk '{ print "iptables " $0}' >> /tmp/fwrebuild
chmod +x /tmp/fwrebuild
/tmp/fwrebuild
rm /tmp/fwrebuild
done
# link zone_vpn via zone_vpn_INPUT
iptables -N zone_${zone}_INPUT
iptables -I input -j zone_${zone}_INPUT
# link zone_vpn_forward via zone_vpn_FORWARD
iptables -N zone_${zone}_FORWARD
iptables -I forward -j zone_${zone}_FORWARD
config_foreach GetRemote remote
5. Das aufmerksam lesen:
"Finally we have a look at the script. It injects all the additionally required settings according to /etc/config/ipsec into the OpenWrt firewall. Save it as /etc/ipsec/firewall.sh and put a calling line into /etc/firewall.user so it gets loaded automatically. REMARK: This script only enables VPN firewall rules that have been set in the LUCI web interface. There is no guarantee that manually implemented rules in /etc/config/firewall will work!"
Albert
