Woohoo! Got it working!!!
It takes a script, and slight modifications to your firewall.user file, and one nvram variable.
nvram:
nvram set log_ipaddr=xxx.xxx.xxx.xxx
nvram commit
Here is the script I use (I named it wallwatcherscript, and saved it in /etc)
###file: wallwatcherscript
. /etc/functions.sh
WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)
### create a chain for logging dropped packets
iptables -N LOGDROP
iptables -F LOGDROP
#### log packets and drop them
iptables -A LOGDROP -j LOG --log-level warning --log-prefix 'DROP ' --log-tcp-sequence --log-ip-options --log-tcp-options
iptables -A LOGDROP -j DROP
### create a chain for logging accepted packets
iptables -N LOGACCEPT
iptables -F LOGACCEPT
### log packets and accept them
iptables -A LOGACCEPT -j LOG --log-level warning --log-prefix 'ACCEPT ' --log-tcp-sequence --log-ip-options --log-tcp-options
iptables -A LOGACCEPT -j ACCEPT
### create a chain for logging rejected packets
iptables -N LOGREJECT
iptables -F LOGREJECT
### log packets and reject them
iptables -A LOGREJECT -j LOG --log-level warning --log-prefix 'WEBDROP ' --log-tcp-sequence --log-ip-options --log-tcp-options
iptables -A LOGREJECT -p tcp -j REJECT --reject-with tcp-reset
iptables -A LOGREJECT -j REJECT --reject-with icmp-port-unreachable
### Replace default rules w/ ones that log where required:
# INPUT table
iptables -R INPUT 1 -m state --state INVALID -j LOGDROP #log/drop invalid packets
iptables -R INPUT 3 -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j LOGDROP #log/drop bad traffic
iptables -R INPUT 6 -p icmp -j LOGACCEPT #log/accept icmp traffic
iptables -R INPUT 7 -p gre -j LOGACCEPT #log/accept gre traffic
iptables -R INPUT 8 -j LOGREJECT #log/reject bad traffic
#OUTPUT table
iptables -R OUTPUT 1 -m state --state INVALID -j LOGDROP #Log/Drop invalid traffic
iptables -I OUTPUT 4 -o $WAN -j LOGACCEPT #Log traffic from the router to the internet
iptables -R OUTPUT 6 -j LOGREJECT #log/drop rejected(bad) traffic
#FORWARD table
iptables -R FORWARD 1 -m state --state INVALID -j LOGDROP #Log/Drop invalid traffic
iptables -R FORWARD 6 -i $LAN -o $WAN -j LOGACCEPT #log outgoing traffic from LAN to internet
And the changes to firewall.user are as follows:
1: Add a line to call the script near the beginning of the file (before you define any rules!)
2: Change anyplace that you have '-j ACCEPT' to '-j LOGACCEPT' and '-j DROP' to '-j LOGDROP'
example:
### file:firewall.user
#!/bin/sh
. /etc/functions.sh
WAN=$(nvram get wan_ifname)
LAN=$(nvram get lan_ifname)
iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
#load wallwatcher script
/etc/wallwatcherscript
### BIG FAT DISCLAIMER
### The "-i $WAN" literally means packets that came in over the $WAN interface;
### this WILL NOT MATCH packets sent from the LAN to the WAN address.
### Block ICMP ping
iptables -A input_rule -i $WAN -p icmp --icmp-type echo-request -j LOGDROP
### Allow SSH from WAN
iptables -t nat -A prerouting_rule -i $WAN -s xxxxx.selfip.org -p tcp --dport 22 -j ACCEPT
iptables -A input_rule -i $WAN -s xxxxx.selfip.org -p tcp --dport 22 -j LOGACCEPT
### Port forwarding
iptables -t nat -A prerouting_rule -i $WAN -s xxxxx.selfip.org -p tcp --dport 3389 -j DNAT --to 192.168.3.101
iptables -A forwarding_rule -i $WAN -s xxxxxx.selfip.org -p tcp --dport 3389 -d 192.168.3.101 -j LOGACCEPT
iptables -t nat -A prerouting_rule -i $WAN -p tcp --dport 4662 -j DNAT --to 192.168.3.101
iptables -A forwarding_rule -i $WAN -p tcp --dport 4662 -d 192.168.3.101 -j LOGACCEPT
iptables -t nat -A prerouting_rule -i $WAN -p udp --dport 9455 -j DNAT --to 192.168.3.101
iptables -A forwarding_rule -i $WAN -p udp --dport 9455 -d 192.168.3.101 -j LOGACCEPT
### DMZ (should be placed after port forwarding / accept rules)
# iptables -t nat -A prerouting_rule -i $WAN -j DNAT --to 192.168.1.2
# iptables -A forwarding_rule -i $WAN -d 192.168.1.2 -j LOGACCEPT
Do note:
the script alters the original firewall rules where necessary. If you need to restart the user portion of the firewall for any reason, you will have to run /etc/init.d/S45firewall
ALSO: If you've modified S45firewall from WhiteRussian rc2, this may not work as is! The rules have to be replaced in the proper places, and if you've changed the rules then these won't be in the right places, and may cause loss of connectivity, cancer, and weight gain.
(Last edited by bmclaughlin807 on 3 Sep 2005, 05:42)
