Skip to content

Instantly share code, notes, and snippets.

@Titinx

Titinx/firewall-dns.sh

Last active March 7, 2017 02:53
Show Gist options
  • Save Titinx/473b44746e4ce9c3e91d670d0dcd31e4 to your computer and use it in GitHub Desktop.
Save Titinx/473b44746e4ce9c3e91d670d0dcd31e4 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
firewall-dns.sh
SOCKETS_DIR=$(ps aux | grep -oP "/tmp/pycore.[0-99999999999].+?(?=/)" | head -n1)
echo "Prueba firewall dns"
vcmd -c $SOCKETS_DIR/n28 -- iptables -F
vcmd -c $SOCKETS_DIR/n28 -- iptables -P FORWARD DROP
# permitir acceso al NS-SYPER-EDU
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.34 -p udp --dport 53 -j ACCEPT
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.34 -p udp --sport 53 -j ACCEPT
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.34 -p tcp --dport 53 -j ACCEPT
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.34 -p tcp --sport 53 -j ACCEPT
# Permitiendo acceso a resolverDNS
# PROTOCOLO UDP ---------------------------------------------------------------------------------------------
# cuando CONSULTAN al resolver
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.14 -p udp --dport 53 -s 193.81.7.16/28 -j ACCEPT
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.14 -p udp --dport 53 -s 193.81.6.0/24 -j ACCEPT
# cuando el resolver RESPONDE
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.14 -p udp --sport 53 -d 193.81.7.16/28 -j ACCEPT
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.14 -p udp --sport 53 -d 193.81.6.0/24 -j ACCEPT
# cuando el resolver CONSULTA
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.14 -p udp --sport 1024:65535 -j ACCEPT
# cuando le RESPONDEN al resolver
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.14 -p udp --dport 1024:65535 -j ACCEPT
# PROTOCOLO TCP ---------------------------------------------------------------------------------------------
# cuando CONSULTAN al resolver
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.14 -p tcp --dport 53 -s 193.81.7.16/28 -j ACCEPT
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.14 -p tcp --dport 53 -s 193.81.6.0/24 -j ACCEPT
# cuando el resolver RESPONDE
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.14 -p tcp --sport 53 -d 193.81.7.16/28 -j ACCEPT
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.14 -p tcp --sport 53 -d 193.81.6.0/24 -j ACCEPT
# cuando el resolver CONSULTA
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -s 193.81.7.14 -p tcp --sport 1024:65535 -j ACCEPT
# cuando le RESPONDEN al resolver
vcmd -c $SOCKETS_DIR/n28 -- iptables -A FORWARD -d 193.81.7.14 -p tcp --dport 1024:65535 -j ACCEPT
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment