Compare commits
3 Commits
1_3_1-29_e
...
master
| Author | SHA1 | Date | |
|---|---|---|---|
| 14aa2d8fda | |||
| a570a47f5a | |||
|
daa56b9cc5 |
@@ -37,7 +37,7 @@ for my $event (qw(xt_geoip-update bootstrap-console-save
|
||||
{
|
||||
event_link("smeserver-xt_geoip-download-action", $event, "10");
|
||||
}
|
||||
for my $event (qw(bootstrap-console-save e-smith-packetfilter-update
|
||||
for my $event (qw(bootstrap-console-save smeserver-packetfilter-update
|
||||
smeserver-xt_geoip-update remoteaccess-update))
|
||||
{
|
||||
event_link("xt_geoip_kmod", $event, "15");
|
||||
|
||||
@@ -32,67 +32,66 @@ EOF
|
||||
/sbin/iptables --new-chain $NEW_XTGeoIP
|
||||
EOF
|
||||
|
||||
if ( $GP eq 'enabled' )
|
||||
{
|
||||
if (-s $PATH_MODULE || -s $PATH2_MODULE || -s $PATH3_MODULE)
|
||||
{
|
||||
if ($GP eq 'enabled') {
|
||||
if (-s $PATH_MODULE || -s $PATH2_MODULE || -s $PATH3_MODULE) {
|
||||
|
||||
# do not block Localhost(s)
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -s 127.0.0.0/24 -j RETURN\n";
|
||||
|
||||
# do not block LAN
|
||||
my $locals = "@locals";
|
||||
if (@locals)
|
||||
{
|
||||
|
||||
if (@locals) {
|
||||
|
||||
# Make a new local_chk chain and add any networks found in networks db
|
||||
foreach my $local (@locals)
|
||||
{
|
||||
foreach my $local (@locals) {
|
||||
|
||||
# If the network is a remote vpn subnet, restrict it to the ipsec0
|
||||
# interface.
|
||||
my ($net, $msk) = split /\//, $local;
|
||||
my $netrec = $nets->get($net);
|
||||
die "Can't find network $net in networks db!\n" unless $netrec;
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -s $local";
|
||||
if (($netrec->prop('remoteVPNSubnet') || 'no') eq 'yes')
|
||||
{
|
||||
|
||||
if (($netrec->prop('remoteVPNSubnet') || 'no') eq 'yes') {
|
||||
$OUT .= " --in-interface ipsec0";
|
||||
}
|
||||
$OUT .= " -j RETURN\n";
|
||||
}
|
||||
}
|
||||
} ## end foreach my $local (@locals)
|
||||
} ## end if (@locals)
|
||||
|
||||
# [SME: 12445] do not block Remote authorized access
|
||||
# TO DO : allow pin point per service eg this UK ip/network even if UK is filtered
|
||||
|
||||
(($masq{XTAcceptValidRemoteHosts} || 'enabled') eq 'enabled'){
|
||||
if (($masq{XTAcceptValidRemoteHosts} || 'enabled') eq 'enabled') {
|
||||
foreach (split /[,;]/, (${'httpd-admin'}{'ValidFrom'} || '')) {
|
||||
my ($ip, $bits) = Net::IPv4Addr::ipv4_parse("$_");
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -s $ip/$bits -j RETURN\n" unless "$ip" eq '0.0.0.0';
|
||||
}
|
||||
}
|
||||
} ## end if (($masq{XTAcceptValidRemoteHosts...}))
|
||||
|
||||
my @services = split(/,/, $masq{'XtServices'});
|
||||
|
||||
foreach my $servName (@services)
|
||||
{
|
||||
foreach my $servName (@services) {
|
||||
$port = ${$servName}{'TCPPort'} || '';
|
||||
my $servStatus = ${$servName}{'status'} || 'disabled';
|
||||
my $servAccess = ${$servName}{'access'} || 'private';
|
||||
my $locBC = ${$servName}{'BadCountries'} || '';
|
||||
my $reverse = ((${$servName}{'XTGeoipRev'} || 'disabled') eq "enabled") ? "!" : "";
|
||||
|
||||
if ($port ne '' and $servStatus eq 'enabled' and $servAccess eq 'public' and $locBC ne '') {
|
||||
push @locPorts, $port;
|
||||
my $multi = ($port =~ /[,:]/) ? "-m multiport --dports" : "--dport";
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -m geoip $reverse --src-cc $locBC -p tcp $multi $port -j NFLOG --nflog-prefix \"GeoIP BAN: $servName\"\n";
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -m geoip $reverse --src-cc $locBC -p tcp $multi $port -j DROP\n";
|
||||
}
|
||||
}
|
||||
} ## end if ($port ne '' and $servStatus...)
|
||||
} ## end foreach my $servName (@services)
|
||||
|
||||
# block for all or other ports should move there
|
||||
if ($BC ne '') {
|
||||
my $reverse = (($masq{'XTGeoipRev'} || 'disabled') eq "enabled") ? "!" : "";
|
||||
my $others = (($masq{'XTGeoipOther'} || 'disabled') eq "enabled") ? 1 : 0;
|
||||
@locPorts = () unless $others;
|
||||
|
||||
if (@locPorts != 0) {
|
||||
my $LocPorts = join ',', @locPorts;
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -p tcp -m geoip -m multiport ! --dports $LocPorts $reverse --src-cc $BC -j NFLOG --nflog-prefix \"GeoIP BAN: OTHER\"\n";
|
||||
@@ -101,14 +100,11 @@ EOF
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -p tcp -m geoip $reverse --src-cc $BC -j NFLOG --nflog-prefix \"GeoIP BAN: ALL\"\n";
|
||||
$OUT .= " /sbin/iptables -A \$NEW_XTGeoIP -p tcp -m geoip $reverse --src-cc $BC -j DROP\n";
|
||||
}
|
||||
}
|
||||
$OUT .= " /sbin/iptables --append \$NEW_XTGeoIP" .
|
||||
" -j RETURN\n";
|
||||
} ## end if ($BC ne '')
|
||||
$OUT .= " /sbin/iptables --append \$NEW_XTGeoIP" . " -j RETURN\n";
|
||||
## end of add
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
} ## end if (-s $PATH_MODULE ||...)
|
||||
} ## end if ($GP eq 'enabled')
|
||||
|
||||
# Having created a new XTGeoIP chain, activate it and destroy the old.
|
||||
$OUT .= <<'EOF';
|
||||
@@ -117,5 +113,4 @@ EOF
|
||||
/sbin/iptables --flush $OLD_XTGeoIP
|
||||
/sbin/iptables --delete-chain $OLD_XTGeoIP
|
||||
EOF
|
||||
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
%define name smeserver-xt_geoip
|
||||
%define version 1.3.1
|
||||
%define release 29
|
||||
%define release 31
|
||||
|
||||
Summary: smserver rpm to setup database, update and configuration for xt_geoip module with a panel.
|
||||
Name: %{name}
|
||||
@@ -78,6 +78,14 @@ rm -rf %{name}-%{version}
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Oct 28 2025 Jean-Philippe Pialasse <jpp@koozali.org> 1.3.1-31.sme
|
||||
- Update the references in Createlinks to smeserver-*-update [SME: 13249]
|
||||
thanks to Zsolt Vasarhelyi
|
||||
|
||||
* Wed Oct 22 2025 John Crisp <jcrisp@safeandsoundit.co.uk> 1.3.1-30.sme
|
||||
- Fix error in patch for [SME: 12445]
|
||||
- Tidy template
|
||||
|
||||
* Tue Oct 21 2025 John Crisp <jcrisp@safeandsoundit.co.uk> 1.3.1-29.sme
|
||||
- Fix SmartMatch errors [SME: 13240]
|
||||
- Fix panel errors [SME: 13173]
|
||||
|
||||
Reference in New Issue
Block a user