Administrace komentářů

Jste na stránce určené pro řešení chyb a problémů týkajících se diskusí a komentářů. Můžete zde našim administrátorům reportovat špatně zařazenou či duplicitní diskusi, vulgární či osočující příspěvek a podobně. Děkujeme vám za vaši pomoc, více očí více vidí, společně můžeme udržet vysokou kvalitu AbcLinuxu.cz.
Příspěvek
27.10.2019 02:03 Žluva74
Rozbalit Rozbalit vše Re: iptables pravidlo a klient openvpn
Konkrétně upravit si:
firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group AG_INTERNAL_LANS {
            address 192.168.0.0/16
            address 172.16.0.0/12
            description ""
        }
        address-group AG_IPVanish {
            address 10.0.11.0/24
            description "IPVanish Address Group"
        }
        address-group AG_IPVanish2 {
            address 10.0.12.10-10.0.12.253
            address 172.19.0.9
            address 172.19.0.13
            description ""
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    modify OPENVPN_ROUTE {
        rule 10 {
            action modify
            description "IPVanish to vtun0"
            modify {
                table 1
            }
            source {
                group {
                    address-group AG_IPVanish
                }
            }
        }
        rule 20 {
            action modify
            description "IPVanish2 to ESXi-OpenVPN"
            modify {
                table 2
            }
            source {
                group {
                    address-group AG_IPVanish2
                }
            }
        }
    }
    name GUEST_IN {
        default-action accept
        rule 10 {
            action accept
            description "Accept Established & Related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action accept
            description "Allow access to IPVanish Gateway"
            destination {
                address 10.0.12.2
            }
            log disable
            protocol all
        }
        rule 30 {
            action accept
            description "Allow UDP ports for Sonos"
            destination {
                port 1900,1901,5353,6969
            }
            log disable
            protocol udp
            source {
                group {
                    address-group AG_Guest_Sonos_Clients
                }
            }
        }
        rule 40 {
            action accept
            description "Allow TCP ports for Sonos"
            destination {
                port 3400,3401,04070
            }
            log disable
            protocol tcp
            source {
                group {
                    address-group AG_Guest_Sonos_Clients
                }
            }
        }
        rule 50 {
            action drop
            description "Drop packets destined for Internal"
            destination {
                group {
                    address-group AG_INTERNAL_LANS
                }
            }
            log disable
            protocol all
            source {
                group {
                }
            }
        }
        rule 60 {
            action drop
            description "Drop P2P"
            disable
            log disable
            p2p {
                all
            }
            protocol all
        }
    }
    name GUEST_LOCAL {
        default-action drop
        description ""
        rule 10 {
            action accept
            description DNS
            destination {
                port 53
            }
            log disable
            protocol udp
        }
        rule 20 {
            action accept
            description "Accept DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
        rule 21 {
            action accept
            description "Allow MDNS"
            destination {
                port 5353
            }
            log disable
            protocol udp
            source {
                group {
                    address-group AG_Guest_Sonos_Clients
                }
            }
        }
        rule 22 {
            action accept
            description "Allow ICMP"
            log disable
            protocol icmp
        }
    }
    name IPVANISH2_IN {
        default-action accept
        rule 10 {
            action accept
            description "Accept Established & Related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop packets destined for Internal"
            destination {
                group {
                    address-group AG_INTERNAL_LANS
                }
            }
            log disable
            protocol all
            source {
                group {
                }
            }
        }
    }
    name IPVANISH2_LOCAL {
        default-action drop
        description ""
        rule 10 {
            action accept
            description "Accept IGMP"
            log disable
            protocol igmp
        }
        rule 20 {
            action accept
            description DNS
            destination {
                port 53
            }
            log disable
            protocol udp
        }
        rule 30 {
            action accept
            description "Accept DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
    }
    name IPVANISH_IN {
        default-action accept
        rule 10 {
            action accept
            description "Accept Established & Related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop packets destined for Internal"
            destination {
                group {
                    address-group AG_INTERNAL_LANS
                }
            }
            log disable
            protocol all
            source {
                group {
                }
            }
        }
    }
    name IPVANISH_LOCAL {
        default-action drop
        description ""
        rule 10 {
            action accept
            description DNS
            destination {
                port 53
            }
            log disable
            protocol udp
        }
        rule 20 {
            action accept
            description "Accept DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
        rule 21 {
            action accept
            description "Allow IGMP"
            log disable
            protocol igmp
        }
    }
    name VTUN0_IN {
        default-action accept
        rule 10 {
            action accept
            description "Accept Established & Related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 20 {
            action drop
            description "Drop packets destined for Internal"
            destination {
                group {
                    address-group AG_INTERNAL_LANS
                }
            }
            log disable
            protocol all
            source {
                group {
                }
            }
        }
    }
    name VTUN0_LOCAL {
        default-action drop
        description ""
        rule 10 {
            action accept
            description DNS
            destination {
                port 53
            }
            log disable
            protocol udp
        }
        rule 20 {
            action accept
            description "Accept DHCP"
            destination {
                port 67
            }
            log disable
            protocol udp
        }
    }
    name WAN_IN {
        default-action drop
        description "WAN to internal from internet"
        rule 1 {
            action accept
            description "allow established sessions"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 3 {
            action drop
            description "drop invalid state"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN from internet to router"
        rule 10 {
            action accept
            description "allow established sessions"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 50 {
            action drop
            description "drop invalid state"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
    }
    name WAN_OUT {
        default-action accept
        description "Block internet if no VPN"
        rule 1 {
            action drop
            description "DROP IPVanish AG on WAN"
            log disable
            protocol all
            source {
                group {
                    address-group AG_IPVanish
                }
            }
        }
        rule 2 {
            action drop
            description "DROP Cameras on WAN"
            log disable
            protocol all
            source {
                group {
                    address-group AG_Unifi_Cameras
                }
            }
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address dhcp
        description WAN-Internet_AT&T
        dhcp-options {
            default-route update
            default-route-distance 210
            name-server no-update
        }
        duplex auto
        firewall {
            in {
                name WAN_IN
            }
            local {
                name WAN_LOCAL
            }
            out {
                name WAN_OUT
            }
        }
        speed auto
    }
    ethernet eth2 {
        address 10.0.10.1/24
        description Guest
        duplex auto
        firewall {
            in {
                modify OPENVPN_ROUTE
                name GUEST_IN
            }
            local {
                name GUEST_LOCAL
            }
        }
        speed auto
    }
    ethernet eth3 {
        address 192.168.0.1/24
        description Main
        duplex auto
        firewall {
            in {
            }
            local {
            }
        }
        speed auto
        vif 5 {
            address 10.0.11.1/24
            description IPVanish
            firewall {
                in {
                    modify OPENVPN_ROUTE
                    name IPVANISH_IN
                }
                local {
                    name IPVANISH_LOCAL
                }
            }
            mtu 1500
        }
        vif 15 {
            address 10.0.12.1/24
            description IPVanish2
            firewall {
                in {
                    modify OPENVPN_ROUTE
                    name IPVANISH2_IN
                }
                local {
                    name IPVANISH2_LOCAL
                }
            }
            mtu 1500
        }
    }
    loopback lo {
    }
    openvpn vtun0 {
        config-file /config/auth/config.ovpn
        description IPVanish
        firewall {
            in {
                name VTUN0_IN
            }
            local {
                name VTUN0_LOCAL
            }
        }
    }
}
protocols {
    static {
        table 1 {
            interface-route 0.0.0.0/0 {
                next-hop-interface vtun0 {
                }
            }
        }
        table 2 {
            route 0.0.0.0/0 {
                next-hop 10.0.12.2 {
                }
            }
        }
    }
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
         shared-network-name Guest {
            authoritative enable
            subnet 10.0.10.0/24 {
                default-router 10.0.10.1
                dns-server 208.67.222.222
                dns-server 208.67.220.220
                lease 86400
                start 10.0.10.10 {
                    stop 10.0.10.199
                }
            }
        }
        shared-network-name IPVanish {
            authoritative enable
            subnet 10.0.11.0/24 {
                default-router 10.0.11.1
                dns-server 10.0.11.1
                lease 86400
                start 10.0.11.10 {
                    stop 10.0.11.19
                }
            }
        }
        shared-network-name IPVanish2 {
            authoritative enable
            subnet 10.0.12.0/24 {
                default-router 10.0.12.2
                dns-server 10.0.12.1
                lease 86400
                start 10.0.12.10 {
                    stop 10.0.12.19
                }
                static-mapping Openvpn-Client {
                    ip-address 10.0.12.2
                    mac-address 00:0c:29:66:d7:67
                }
            }
        }
        shared-network-name VPN {
            authoritative disable
            subnet 172.21.0.0/24 {
                default-router 172.21.0.1
                dns-server 172.21.0.1
                lease 86400
                start 172.21.0.50 {
                    stop 172.21.0.60
                }
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
        forwarding {
            cache-size 750
            listen-on eth1
            listen-on eth2
            listen-on eth3
            listen-on eth3.4
            listen-on eth3.10
            listen-on eth3.5
            listen-on eth3.15
            listen-on eth3.20
            listen-on eth3.25
            options listen-address=192.168.0.1
        }
    }
    nat {
        rule 5000 {
            description IPVanish
            log disable
            outbound-interface vtun0
            protocol all
            source {
                group {
                    address-group AG_IPVanish
                }
            }
            type masquerade
        }
        rule 5001 {
            description IPVanish2
            log disable
            outbound-interface eth3.15
            source {
                group {
                    address-group AG_IPVanish2
                }
            }
            type masquerade
        }
        rule 5002 {
            description "All LAN-to-WAN"
            log disable
            outbound-interface eth0
            type masquerade
        }
    }
}
V tomto formuláři můžete formulovat svou stížnost ohledně příspěvku. Nejprve vyberte typ akce, kterou navrhujete provést s diskusí či příspěvkem. Potom do textového pole napište důvody, proč by měli admini provést vaši žádost, problém nemusí být patrný na první pohled. Odkaz na příspěvek bude přidán automaticky.
Offtopic diskuse použijte pro diskusi mimo záběr našeho portálu (včelařství, windows), která by měla být smazána.
Duplicitní diskuse je určena pro případ, kdy uživatel odeslal svůj dotaz několikrát.
Návrh na cenzuru použijte, pokud komentář obsahuje urážky, vulgarismy nebo porušuje zákony.
Návrh na smazání komentáře je velmi neobvyklá akce používaná obvykle při nepovolené reklamě či spamu, výkřicích psychicky nemocných jedinců (ještírci) nebo pro smazání duplikátních komentářů.
Oprava formátování je žádost pro úpravu formy příspěvku, například pokud někdo píše bez odstavců nebo použije PRE pro celý komentář. Žádosti o změnu obsahu budou zamítnuty.
Vaše jméno
Váš email
Typ požadavku

Slovní popis