mirror of
https://git.rwth-aachen.de/acs/public/villas/node/
synced 2025-03-09 00:00:00 +01:00
added iptables scripts and moved setup script out of s2ss source code
This commit is contained in:
parent
0bd25d0e58
commit
d9cb9b41c4
5 changed files with 68 additions and 1 deletions
1
contrib/liveusb/etc/image/setup.sh
Symbolic link
1
contrib/liveusb/etc/image/setup.sh
Symbolic link
|
@ -0,0 +1 @@
|
|||
setup.sh
|
31
contrib/liveusb/etc/sysconfig/ip6tables
Normal file
31
contrib/liveusb/etc/sysconfig/ip6tables
Normal file
|
@ -0,0 +1,31 @@
|
|||
*filter
|
||||
:INPUT ACCEPT
|
||||
:FORWARD ACCEPT
|
||||
:OUTPUT ACCEPT
|
||||
|
||||
# Allow loopback traffic
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
|
||||
# Allow established connections, and those not coming from the outside
|
||||
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# Allow HTTP
|
||||
-A INPUT -p tcp --dport http -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# Allow SSH
|
||||
-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# Allow Tinc
|
||||
-A INPUT -p udp --dport tinc -j ACCEPT
|
||||
-A INPUT -p tcp --dport tinc -j ACCEPT
|
||||
|
||||
# Accept Pings
|
||||
-A INPUT -p icmpv6 -j ACCEPT
|
||||
|
||||
# Reject everything else
|
||||
-A INPUT -j REJECT
|
||||
|
||||
# We wont act as a router
|
||||
-A FORWARD -j REJECT
|
||||
|
||||
COMMIT
|
34
contrib/liveusb/etc/sysconfig/iptables
Normal file
34
contrib/liveusb/etc/sysconfig/iptables
Normal file
|
@ -0,0 +1,34 @@
|
|||
*filter
|
||||
:INPUT ACCEPT
|
||||
:FORWARD ACCEPT
|
||||
:OUTPUT ACCEPT
|
||||
|
||||
# Allow loopback traffic
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
|
||||
# Allow established connections, and those not coming from the outside
|
||||
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
|
||||
# Allow HTTP
|
||||
-A INPUT -p tcp --dport http -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# Allow VPN
|
||||
-A INPUT -s 10.0.0.0/8 -j ACCEPT
|
||||
|
||||
# Allow SSH
|
||||
-A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# Allow Tinc
|
||||
-A INPUT -p udp --dport tinc -j ACCEPT
|
||||
-A INPUT -p tcp --dport tinc -j ACCEPT
|
||||
|
||||
# Accept Pings
|
||||
-A INPUT -p icmp -j ACCEPT
|
||||
|
||||
# Reject everything else
|
||||
-A INPUT -j REJECT
|
||||
|
||||
# We wont act as a router
|
||||
-A FORWARD -j REJECT
|
||||
|
||||
COMMIT
|
1
contrib/liveusb/etc/sysconfig/network
Normal file
1
contrib/liveusb/etc/sysconfig/network
Normal file
|
@ -0,0 +1 @@
|
|||
NETWORKING=yes
|
|
@ -5,7 +5,7 @@ After=dhclient.service
|
|||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/s2ss/contrib/liveusb/setup.sh
|
||||
ExecStart=/etc/image/setup.sh
|
||||
RemainAfterExit=yes
|
||||
|
||||
TimeoutSec=120
|
||||
|
|
Loading…
Add table
Reference in a new issue