forked from norman/fusionpbx-install.sh-github-mirror
73e1606d6c
Squashed commit of the following:
-install iptables as it is not part of minimal install.
-change swig for bullseye to swig4.0
-php7.4-dev for build required (php-config)
-add python3-distutils
-libks seems to be required for mod_verto
-disable mod_avmd to keep in sync with ubuntu-config (eaaef03163 (diff-62a8f25a3200194e88b1073f2b11ebdf1622761f025a30158c012e83e5f593aa))
68 lines
3.2 KiB
Bash
Executable File
68 lines
3.2 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
#move to script directory so all relative paths work
|
|
cd "$(dirname "$0")"
|
|
|
|
#add the includes
|
|
. ./config.sh
|
|
. ./colors.sh
|
|
. ./environment.sh
|
|
|
|
#send a message
|
|
verbose "Configuring IPTables"
|
|
|
|
#defaults to nftables by default this enables iptables
|
|
if [ ."$os_codename" = ."buster" ]; then
|
|
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
|
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
|
|
fi
|
|
if [ ."$os_codename" = ."bullseye" ]; then
|
|
apt-get install -y iptables
|
|
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
|
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
|
|
fi
|
|
|
|
#remove ufw
|
|
ufw reset
|
|
ufw disable
|
|
apt-get remove -y ufw
|
|
#apt-get purge ufw
|
|
|
|
#run iptables commands
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
iptables -A INPUT -j DROP -p udp --dport 5060:5091 -m string --string "friendly-scanner" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p tcp --dport 5060:5091 -m string --string "friendly-scanner" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p udp --dport 5060:5091 -m string --string "sipcli/" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p tcp --dport 5060:5091 -m string --string "sipcli/" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p udp --dport 5060:5091 -m string --string "VaxSIPUserAgent/" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p tcp --dport 5060:5091 -m string --string "VaxSIPUserAgent/" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p udp --dport 5060:5091 -m string --string "pplsip" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p tcp --dport 5060:5091 -m string --string "pplsip" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p udp --dport 5060:5091 -m string --string "system " --algo bm --icase
|
|
iptables -A INPUT -j DROP -p tcp --dport 5060:5091 -m string --string "system " --algo bm --icase
|
|
iptables -A INPUT -j DROP -p udp --dport 5060:5091 -m string --string "exec." --algo bm --icase
|
|
iptables -A INPUT -j DROP -p tcp --dport 5060:5091 -m string --string "exec." --algo bm --icase
|
|
iptables -A INPUT -j DROP -p udp --dport 5060:5091 -m string --string "multipart/mixed;boundary" --algo bm --icase
|
|
iptables -A INPUT -j DROP -p tcp --dport 5060:5091 -m string --string "multipart/mixed;boundary" --algo bm --icase
|
|
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 7443 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 5060:5091 -j ACCEPT
|
|
iptables -A INPUT -p udp --dport 5060:5091 -j ACCEPT
|
|
iptables -A INPUT -p udp --dport 16384:32768 -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
|
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
|
|
iptables -t mangle -A OUTPUT -p udp -m udp --sport 16384:32768 -j DSCP --set-dscp 46
|
|
iptables -t mangle -A OUTPUT -p udp -m udp --sport 5060:5091 -j DSCP --set-dscp 26
|
|
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 5060:5091 -j DSCP --set-dscp 26
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD DROP
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
#answer the questions for iptables persistent
|
|
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
|
|
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
|
|
apt-get install -y iptables-persistent
|