Niels Werensteijn
8 years ago
2 changed files with 72 additions and 0 deletions
@ -0,0 +1,53 @@ |
|||||||
|
#!/bin/bash |
||||||
|
sudo modprobe xt_ts3init |
||||||
|
|
||||||
|
#create an autorized ts3 client ip set. |
||||||
|
#perhaps create the set with more than the default 1024 entries |
||||||
|
sudo ipset create ts3_authorized hash:ip timeout 30 || { echo "ipset not installed or there is a problem with it"; exit -1; } |
||||||
|
|
||||||
|
#create new chain that handles ts3 |
||||||
|
sudo iptables -N TS3_UDP_TRAFFIC |
||||||
|
sudo iptables -N TS3_TCP_TRAFFIC |
||||||
|
sudo iptables -N TS3_ACCEPT_NEW |
||||||
|
sudo iptables -N TS3_UPDATE_AUTHORIZED |
||||||
|
|
||||||
|
RANDOM_FILE_NAME=random.data |
||||||
|
if [ ! -f "${RANDOM_FILE_NAME}" ] |
||||||
|
then |
||||||
|
xxd -l 60 -c 60 -p /dev/urandom > "${RANDOM_FILE_NAME}" || { echo "could not use xxd to create random data"; exit -1; } |
||||||
|
fi |
||||||
|
|
||||||
|
RANDOM_FILE=`pwd`/${RANDOM_FILE_NAME} |
||||||
|
|
||||||
|
#disable connection tracking for ts3 server |
||||||
|
sudo iptables -t raw -A PREROUTING -p udp --dport 9987 -j CT --notrack |
||||||
|
|
||||||
|
#move ts3 traffic to TS3_TRAFFIC chain, and filetransfer to TCP chain |
||||||
|
sudo iptables -A INPUT -p udp --dport 9987 -j TS3_UDP_TRAFFIC |
||||||
|
sudo iptables -A INPUT -p tcp --dport 30033 -j TS3_TCP_TRAFFIC |
||||||
|
|
||||||
|
#Allow authorized clients on UDP |
||||||
|
sudo iptables -A TS3_UDP_TRAFFIC -m set --match-set ts3_authorized src -j TS3_UPDATE_AUTHORIZED |
||||||
|
|
||||||
|
#Allow 3.0.19 and up clients |
||||||
|
sudo iptables -A TS3_UDP_TRAFFIC -p udp -m ts3init_get_cookie --min-client 1459504131 -j TS3INIT_SET_COOKIE --seed-file ${RANDOM_FILE} |
||||||
|
|
||||||
|
#add new connection if cookie is valid |
||||||
|
sudo iptables -A TS3_UDP_TRAFFIC -p udp -m ts3init_get_puzzle --check-cookie --seed-file ${RANDOM_FILE} -j TS3_ACCEPT_NEW |
||||||
|
|
||||||
|
#drop the rest |
||||||
|
sudo iptables -A TS3_UDP_TRAFFIC -j DROP |
||||||
|
|
||||||
|
#add new connection to authorized src |
||||||
|
sudo iptables -A TS3_ACCEPT_NEW -j SET --add-set ts3_authorized src |
||||||
|
sudo iptables -A TS3_ACCEPT_NEW -p udp -j TS3INIT_RESET |
||||||
|
|
||||||
|
|
||||||
|
#Allow authorized clients on TCP |
||||||
|
sudo iptables -A TS3_TCP_TRAFFIC -m set --match-set ts3_authorized src -j ACCEPT |
||||||
|
sudo iptables -A TS3_TCP_TRAFFIC -j DROP |
||||||
|
|
||||||
|
#update timeout in set and allow traffic |
||||||
|
sudo iptables -A TS3_UPDATE_AUTHORIZED -j SET --add-set ts3_authorized src --exist |
||||||
|
sudo iptables -A TS3_UPDATE_AUTHORIZED -j ACCEPT |
||||||
|
|
@ -0,0 +1,19 @@ |
|||||||
|
#!/bin/bash |
||||||
|
|
||||||
|
#clear up iptables |
||||||
|
sudo iptables -t raw -D PREROUTING -p udp --dport 9987 -j CT --notrack |
||||||
|
sudo iptables -D INPUT -p udp --dport 9987 -j TS3_UDP_TRAFFIC |
||||||
|
sudo iptables -D INPUT -p tcp --dport 30033 -j TS3_TCP_TRAFFIC |
||||||
|
|
||||||
|
sudo iptables -F TS3_UDP_TRAFFIC |
||||||
|
sudo iptables -F TS3_TCP_TRAFFIC |
||||||
|
sudo iptables -F TS3_ACCEPT_NEW |
||||||
|
sudo iptables -F TS3_UPDATE_AUTHORIZED |
||||||
|
|
||||||
|
sudo iptables -X TS3_UDP_TRAFFIC |
||||||
|
sudo iptables -X TS3_TCP_TRAFFIC |
||||||
|
sudo iptables -X TS3_ACCEPT_NEW |
||||||
|
sudo iptables -X TS3_UPDATE_AUTHORIZED |
||||||
|
|
||||||
|
#delete the ipset |
||||||
|
sudo ipset destroy ts3_authorized |
Loading…
Reference in new issue