fixed 3
IPTABLES='/usr/sbin/iptables'
while read line
do
unset SRC
unset SPT
unset DST
unset DPT
unset HSRC
unset HSPT
unset HDST
unset HDPT
unset IPRULE
unset FQDNRULE
unset ACTION
echo $line | grep "firewall-" > /dev/null 2>&1
[ $? != 0 ] && continue
for item in $line
do
case $item in
firewall-*) CHAIN=${item#firewall-};;
PROTO=*) PROTO=${item#PROTO=}; PROTO=${PROTO,,};;
SRC=*) SRC=${item#SRC=};;
SPT=*) SPT=${item#SPT=};;
DST=*) DST=${item#DST=};;
DPT=*) DPT=${item#DPT=};;
esac
done
case $CHAIN in
INPUT) sudo $IPTABLES -n -L $CHAIN | awk '{print $2,$4,$7}' \
| grep "$PROTO\W$SRC\/*\w*${DPT:+"\\Wdpt:$DPT"}\W*$" > /dev/null && continue;;
OUTPUT) sudo $IPTABLES -n -L $CHAIN | awk '{print $2,$5,$7}' \
| grep "$PROTO\W$DST\/*\w*${DPT:+"\\Wdpt:$DPT"}\W*$" > /dev/null && continue;;
FORWARD) sudo $IPTABLES -n -L $CHAIN | awk '{print $2,$4,$5,$7}' \
| grep "$PROTO\W$SRC\W$DST\/*\w*${DPT:+"\\Wdpt:$DPT"}\W*$" > /dev/null && continue;;
esac
[ $CHAIN == "INPUT" ] && sudo $IPTABLES -n -L $CHAIN | awk '{print $2,$7}' \
| grep "$PROTO${DPT:+"\\Wdpt:$DPT"}\W*$" > /dev/null && continue
sudo $IPTABLES -n -L $CHAIN | awk '{print $2,$5,$7}' \
| grep "$PROTO\W$DST\/*\w*${DPT:+"\\Wdpt:$DPT"}\W*$" > /dev/null && continue
HSRC=`host $SRC | grep "domain name pointer" | head -n 1 | awk '{print $5}'`
HDST=`host $DST | grep "domain name pointer" | head -n 1 | awk '{print $5}'`
HSPT=`grep "\W$SPT/$PROTO\W" /etc/services | awk '{print $1}'`
HDPT=`grep "\W$DPT/$PROTO\W" /etc/services | awk '{print $1}'`
HSRC=${HSRC:-$SRC}
HDST=${HDST:-$DST}
HSPT=${HSPT:-$SPT}
HDPT=${HDPT:-$DPT}
case $CHAIN in
INPUT) IPRULE="-s $SRC -p $PROTO"; FQDNRULE="-s $HSRC -p $PROTO";;
OUTPUT) IPRULE="-d $DST -p $PROTO"; FQDNRULE="-d $HDST -p $PROTO";;
FORWARD) IPRULE="-s $SRC -d $DST -p $PROTO"; FQDNRULE="-s $HSRC -d $HDST -p $PROTO";;
esac
[ -z $DPT ] || IPRULE="$IPRULE --dport $DPT"
[ -z $DPT ] || FQDNRULE="$FQDNRULE --dport $DPT"
ACTION=`LANG=C xmessage -buttons "ACCEPT-FQDN,ACCEPT-IP,DROP-FQDN,DROP-IP,SKIP" -default SKIP -timeout 15 \
-print "$HSRC => $HDST:$HDPT($DST:$DPT/$PROTO)"`
ACTION=${ACTION:-"SKIP"}
case $ACTION in
SKIP) continue;;
ACCEPT-FQDN) sudo $IPTABLES -I $CHAIN 4 $FQDNRULE -j ACCEPT \
|| LANG=C xmessage "Error performing line: $line <$FQDNRULE>";;
ACCEPT-IP) sudo $IPTABLES -I $CHAIN 4 $IPRULE -j ACCEPT \
|| LANG=C xmessage "Error performing line: $line <$IPRULE>";;
DROP-FQDN) sudo $IPTABLES -I $CHAIN 4 $FQDNRULE -j DROP \
|| LANG=C xmessage "Error performing line: $line <$FQDNRULE>";;
DROP-IP) sudo $IPTABLES -I $CHAIN 4 $IPRULE -j DROP \
|| LANG=C xmessage "Error performing line: $line <$IPRULE>";;
*) continue;;
esac
done
|
Вариант для распечатки
