Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-01 20:42:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix iptables for glutton

Browse source
This commit is contained in:
t3chn0m4g3 2019-02-20 11:00:36 +00:00
parent 364a6c6d9c
commit 05c15cc533
1 changed files with 20 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
bin/rules.sh
View file

@ -23,10 +23,10 @@ function fuNFQCHECK {
myNFQCHECK=$(grep -e '^\s*honeytrap:\|^\s*glutton:' $myDOCKERCOMPOSEYML | tr -d ': ' | uniq) myNFQCHECK=$(grep -e '^\s*honeytrap:\|^\s*glutton:' $myDOCKERCOMPOSEYML | tr -d ': ' | uniq)
if [ "$myNFQCHECK" == "" ]; if [ "$myNFQCHECK" == "" ];
then then
echo "No NFQ related honeypot detected, no iptables rules needed. Exiting." echo "No NFQ related honeypot detected, no iptables-legacy rules needed. Exiting."
exit exit
else else
echo "Detected $myNFQCHECK as NFQ based honeypot, iptables rules needed. Continuing." echo "Detected $myNFQCHECK as NFQ based honeypot, iptables-legacy rules needed. Continuing."
fi fi
} }
@ -41,54 +41,54 @@ echo "$myRULESPORTS"
} }
function fuSETRULES { function fuSETRULES {
### Setting up iptables rules for honeytrap ### Setting up iptables-legacy rules for honeytrap
if [ "$myNFQCHECK" == "honeytrap" ]; if [ "$myNFQCHECK" == "honeytrap" ];
then then
/sbin/iptables -w -A INPUT -s 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -A INPUT -s 127.0.0.1 -j ACCEPT
/sbin/iptables -w -A INPUT -d 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -A INPUT -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/sbin/iptables -w -A INPUT -p tcp --dport $myPORT -j ACCEPT /usr/sbin/iptables-legacy -w -A INPUT -p tcp --dport $myPORT -j ACCEPT
done done
/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE /usr/sbin/iptables-legacy -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
fi fi
### Setting up iptables rules for glutton ### Setting up iptables-legacy rules for glutton
if [ "$myNFQCHECK" == "glutton" ]; if [ "$myNFQCHECK" == "glutton" ];
then then
/sbin/iptables -w -t raw -A PREROUTING -s 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -t raw -A PREROUTING -s 127.0.0.1 -j ACCEPT
/sbin/iptables -w -t raw -A PREROUTING -d 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -t raw -A PREROUTING -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/sbin/iptables -w -t raw -A PREROUTING -p tcp --dport $myPORT -j ACCEPT /usr/sbin/iptables-legacy -w -t raw -A PREROUTING -p tcp --dport $myPORT -j ACCEPT
done done
# No need for NFQ forwarding, such rules are set up by glutton # No need for NFQ forwarding, such rules are set up by glutton
fi fi
} }
function fuUNSETRULES { function fuUNSETRULES {
### Removing iptables rules for honeytrap ### Removing iptables-legacy rules for honeytrap
if [ "$myNFQCHECK" == "honeytrap" ]; if [ "$myNFQCHECK" == "honeytrap" ];
then then
/sbin/iptables -w -D INPUT -s 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -D INPUT -s 127.0.0.1 -j ACCEPT
/sbin/iptables -w -D INPUT -d 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -D INPUT -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/sbin/iptables -w -D INPUT -p tcp --dport $myPORT -j ACCEPT /usr/sbin/iptables-legacy -w -D INPUT -p tcp --dport $myPORT -j ACCEPT
done done
/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE /usr/sbin/iptables-legacy -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
fi fi
### Removing iptables rules for glutton ### Removing iptables-legacy rules for glutton
if [ "$myNFQCHECK" == "glutton" ]; if [ "$myNFQCHECK" == "glutton" ];
then then
/sbin/iptables -w -t raw -D PREROUTING -s 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -t raw -D PREROUTING -s 127.0.0.1 -j ACCEPT
/sbin/iptables -w -t raw -D PREROUTING -d 127.0.0.1 -j ACCEPT /usr/sbin/iptables-legacy -w -t raw -D PREROUTING -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/sbin/iptables -w -t raw -D PREROUTING -p tcp --dport $myPORT -j ACCEPT /usr/sbin/iptables-legacy -w -t raw -D PREROUTING -p tcp --dport $myPORT -j ACCEPT
done done
# No need for removing NFQ forwarding, such rules are removed by glutton # No need for removing NFQ forwarding, such rules are removed by glutton
fi fi