1
0
Fork 0
mirror of https://git.rwth-aachen.de/acs/public/villas/node/ synced 2025-03-09 00:00:00 +01:00

added iptables scripts and moved setup script out of s2ss source code

This commit is contained in:
Steffen Vogel 2015-05-17 19:25:39 +02:00
parent 0bd25d0e58
commit d9cb9b41c4
5 changed files with 68 additions and 1 deletions

View file

@ -0,0 +1 @@
setup.sh

View file

@ -0,0 +1,31 @@
*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
# Allow loopback traffic
-A INPUT -i lo -j ACCEPT
# Allow established connections, and those not coming from the outside
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow HTTP
-A INPUT -p tcp --dport http -m conntrack --ctstate NEW -j ACCEPT
# Allow SSH
-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j ACCEPT
# Allow Tinc
-A INPUT -p udp --dport tinc -j ACCEPT
-A INPUT -p tcp --dport tinc -j ACCEPT
# Accept Pings
-A INPUT -p icmpv6 -j ACCEPT
# Reject everything else
-A INPUT -j REJECT
# We wont act as a router
-A FORWARD -j REJECT
COMMIT

View file

@ -0,0 +1,34 @@
*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
# Allow loopback traffic
-A INPUT -i lo -j ACCEPT
# Allow established connections, and those not coming from the outside
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow HTTP
-A INPUT -p tcp --dport http -m conntrack --ctstate NEW -j ACCEPT
# Allow VPN
-A INPUT -s 10.0.0.0/8 -j ACCEPT
# Allow SSH
-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j ACCEPT
# Allow Tinc
-A INPUT -p udp --dport tinc -j ACCEPT
-A INPUT -p tcp --dport tinc -j ACCEPT
# Accept Pings
-A INPUT -p icmp -j ACCEPT
# Reject everything else
-A INPUT -j REJECT
# We wont act as a router
-A FORWARD -j REJECT
COMMIT

View file

@ -0,0 +1 @@
NETWORKING=yes

View file

@ -5,7 +5,7 @@ After=dhclient.service
[Service]
Type=simple
ExecStart=/s2ss/contrib/liveusb/setup.sh
ExecStart=/etc/image/setup.sh
RemainAfterExit=yes
TimeoutSec=120