
#-----------------------------------------------------------------------
# Copyright (C) 2000-2001, Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#-----------------------------------------------------------------------
# $Id: private_net_spoofing_chains.sh,v 1.2 2001/08/11 17:01:20 jsmoriss Exp $
#-----------------------------------------------------------------------
#  $RCSfile: private_net_spoofing_chains.sh,v $
#   $Author: jsmoriss $
# $Revision: 1.2 $
#     $Date: 2001/08/11 17:01:20 $
#   $Locker:  $ 
#     $Name:  $
#-----------------------------------------------------------------------
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by 
# the Free Software Foundation <http://www.gnu.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of 
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License (LICENSE file in archive) for more details.
#
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# A bourne shell function used by rcf; a very secure, fast, and complete
# firewall for linux <http://jsmoriss.mvlan.net/linux/rcf.html>.
#
#-----------------------------------------------------------------------
# FUNCTION
#-----------------------------------------------------------------------

Private_Net_Spoofing_Chains () {

	echo "Creating Private Networks Spoofing Chains and Adding Deny Rules"
	if [ ! "$REFRESH_INTERFACES" ]
	then
		ipchains -N spoofi
		ipchains -N spoofo
		ipchains -N smasqo
	else
		ipchains -F spoofi
		ipchains -F spoofo
		ipchains -F smasqo
	fi

	# Allow packets from private interfaces with source addresses
	# in those networks connected to the interface.

	for private_interface in $LOOPBACK_INTERFACES $PRIVATE_INTERFACES $MZ_INTERFACES
	do
		echo "  Accept Private Networks from $private_interface $LOG_MSG"
		for private_subnet in `{
			Get_Interface_Vars "$private_interface" "PRIVATE"
			Device_Subnets PRIVATE
			} | sort | Sed_Uniq`
		do
			ipchains -A spoofi -j RETURN -i $private_interface -s $private_subnet -d $ANY $LOG
		done
		unset private_subnet
	done
	unset private_interface

	all_private_subnets="`{
		for private_interface in $LOOPBACK_INTERFACES $PRIVATE_INTERFACES $MZ_INTERFACES
		do
			Get_Interface_Vars "$private_interface" "PRIVATE"
			Device_Subnets PRIVATE
		done
		unset private_interface
	} | sort | Sed_Uniq`"

	echo "Reject Stuffed Masquerading -> $ANY (logged)"
	echo "Deny IP Spoofing & Stuffed Routing for Private Networks (logged)"

	for private_subnet in $all_private_subnets
	do
		ipchains -A smasqo -j REJECT -s $private_subnet -d $ANY -l

		# Don't allow private interface IPs from/to public interfaces.
		# All traffic should be masqueraded in these cases. Private IPs
		# are OK for DMZ interfaces.

		ipchains -A spoofi -j DENY   -s $private_subnet -d $ANY -l
		ipchains -A spoofo -j REJECT -s $ANY -d $private_subnet -l
	done

    ##ipchains -A spoofi -j RETURN $LOG
    ##ipchains -A spoofo -j RETURN $LOG

	unset private_subnet all_private_subnets
}

