
#-----------------------------------------------------------------------
# Copyright (C) 2000-2001, Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#-----------------------------------------------------------------------
# $Id: 020-blacklist-hosts,v 1.4 2001/09/02 22:09:26 jsmoriss Exp $
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# Blacklist selected hosts and/or networks from ALL services. Both input 
# AND output packets are affected.
#
#-----------------------------------------------------------------------
# MODULE CONFIGURATION
#-----------------------------------------------------------------------
#
#m# 123
#a# ignore deny
#n# blacklist
#t# hosts
#i# cluster
#
#   |--------------------------------------------------------------------|
#d# The ignore-{int}-blacklist-hosts option will deny these hosts access 
#d# to all your interface's services. Rejected packets are NOT LOGGED. The 
#d# deny-{int}-blacklist-hosts option performs the same function, except
#d# that denied packets are logged.
#d#
#d# These variables can be used after detecting an attack on your 
#d# firewall. Other options (such as deny-{int}-smtp-clients, deny-{int}-
#d# http-clients, etc.) restrict access to specific services. The ignore
#d# option has precedence over the deny option.
#d#
#d# Input AND output packets will be denied from/to these hosts/networks
#d# (including outgoing traceroute and ping).
#   |--------------------------------------------------------------------|
#
#-----------------------------------------------------------------------
# START OF MODULE CODE
#-----------------------------------------------------------------------

# IGNORE-DENY ORDER MUST BE INVERSED SINCE WE'RE "INSERTING" RULES

for action in deny ignore
do
	case $action in
		ignore)	action_log_msg="$LOG_MSG"; action_log="$LOG";;
		deny)	action_log_msg="(logged)"; action_log="-l"  ;;
	esac
	for host in `Option_Value $action $INTOPT blacklist hosts`
	do
		if [ "$CLUSTER_NAME" ]
		then    
			inchain="$OUTCHAIN"
			outchain="$INCHAIN"
		else    
			inchain="$INCHAIN"
			outchain="$OUTCHAIN"
		fi      

		# These rules are "inserted" instead of "appended" to over-ride
		# the default DNS access. Since these rules are "inserted", read
		# them from last to first.
		#
		echo "Deny/Reject <BLACKLIST> $INTOPT $IPADDR <-> $host $action_log_msg"
		ipchains -I $outchain -j REJECT -p all -s $ANY  -d $host $action_log
		ipchains -I $inchain  -j DENY   -p all -s $ANY  -d $host $action_log	# block before masq
		ipchains -I $inchain  -j DENY   -p all -s $host -d $ANY  $action_log
	done
	unset host inchain outchain
done
unset action action_log_msg action_log

