poort openzetten ivm CS

[robertobadjo]

hallo allemaal.

kheb een klein probleempje.

ik heb een linux servertje hier thuis staan en daar heb ik een dedicated CounterStrike server op gemaakt puut voor de lol maar niemand kan connecten.

kheb het probleem gevonden.
het komt dus door me firewall die trekt alles erg strak dicht.

dit is mijn scriptje.

code:

#
#**ENDOSHIELD 1.2**
#Written by Endo (Dave Cheeseman) [e-mail]
#EndoShield Site - http://www.sourceforge.net/projects/endoshield

#******************************************************************************************************************************
#Configuration Part of the script - If you are unsure of any of these points, leave them as the default setting, changing these
#options can seriously affect the security of your firewall.

#Do you want to run a ipchains firewall or iptables?
#If you are unsure about this, you need to find out what kernel you are running.
#See the readme file for more information.
TYPE="iptables"

# Change INETDEV to the network device connceted to the Internet (ppp0/eth0)
# This is ppp0 by default for dial-up connections.  Most cable modem users
# will probably want eth0 or possibly eth1.  When in doubt look at the command
# 'ifconfig'.
INETDEV="eth1"
 
# Change LAN to the correct network address and network mask for your LAN
# this can be found by using ifconfig from one of the clients
LAN="10.0.0.0/24"
 
# Change LANDEV to the network device connected to your LAN
LANDEV="eth0"
 
# There should be no need to change this
LOCALIP=`ifconfig $LANDEV | grep inet | cut -d : -f 2 | cut -d \  -f 1`

#Do you want other machines on the internet to be able to PING your machine?
#(If unsure, leave as no)
PING="yes"

#If you selected no as the previous option, do you want the machine to log
#the dropped pings?
LOGPINGS="yes"

#If you trust all data coming from your local network, put yes.
TRUST="yes"

#If you want to share this machines internet connection, put yes
#(This will provide Masquerading services for you LAN)
#Otherwise, put no
SHARE="yes"

#Is this machine connected to a Samba Network?
#If yes, over a LAN?
SAMBALAN="no"
#Or over a WAN?
SAMBAWAN="no"
#Or over both?
SAMBA="no"

#If you are running any servers on your machine, you need to specify them below, 
#you also need to specify wether these servers/ports should be open to just your local
#network, or the whole world. If you answer yes to PORTNAMEPUBLIC, then the specified port 
#will be open to the whole internet, if this is left to the default, which is no, but you
#have specified that you are running a server on the port, the port will only be available to 
#your local lan.

#Do you run a FTP server?
FTP="yes"
FTPPUBLIC="yes"

#Do you run a SSH server?
SSH="yes"
SSHPUBLIC="yes"

#Do you run a telnet server?
TELNET="no"
TELNETPUBLIC="no"

#Do you run a Web server?
WEB="yes" 
WEBPUBLIC="yes"

#Do you run a mail server?
MAIL="yes"
MAILPUBLIC="yes"

#Do you run identd?
IDENT="no"
IDENTPUBLIC="no"

#If you want to add any trusted hosts, that is, machines on the internet or on your local network
#which you want to fully trust (Allow all data from these machines pass through the firewall), then
#list these machines below.
TRUSTEDHOST1="1.1.1.1"
TRUSTEDHOST2="1.1.1.1"
TRUSTEDHOST3="1.1.1.1"
TRUSTEDHOST4="1.1.1.1"
TRUSTEDHOST5="1.1.1.1"

#If you want to block any hosts from accessing your machine, please list them below, these machines
#will not be able to access your machine at all, even your public access servers.
DENYHOST1="1.1.1.1"
DENYHOST2="1.1.1.1"
DENYHOST3="1.1.1.1"
DENYHOST4="1.1.1.1"
DENYHOST5="1.1.1.1"

#End of Configuration.
#************************************************************************************************************

echo "---------------------------------------------------------"
echo "Local Network Device: $LANDEV"
echo "Local IP: $LOCALIP"
echo "Local Network Address: $LAN"
echo "External Network Device: $INETDEV"
echo "---------------------------------------------------------"
echo ""

#Set default chain policy
echo -n "Setting default chain policies..."
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
echo " Done!"

#Flush all chains
echo -n "Flushing chains..."
iptables  -F
iptables  -X
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
echo " Done!"

#Add custom chains
echo -n "Adding custom chains..."
iptables -N inet-in
iptables -N inet-out
echo " Done!"

#Set INPUT rules
echo -n "Setting rules for INPUT chain..."
iptables -A INPUT -i lo -j ACCEPT
if [ "$TRUST" = "yes" -o "$TRUST" = "YES" ]; then
    iptables -A INPUT -i $LANDEV -j ACCEPT
else
    iptables -A INPUT -i $LANDEV -j inet-in
fi
iptables -A INPUT -i $INETDEV -j inet-in
echo " Done!"

#Set FORWARD rules
echo -n "Setting rules for FORWARD chain..."
if [ "$SHARE" = "yes" -o "$SHARE" = "YES" ]; then
    modprobe iptable_nat
    iptables -A FORWARD -s $LAN -j ACCEPT
    iptables -A FORWARD -d $LAN -j ACCEPT
    echo 1 > /proc/sys/net/ipv4/ip_forward
        #Activate masquerade
        echo -n "Activating masquerade..."
        iptables -t nat -A POSTROUTING -o $INETDEV -j MASQUERADE
        echo " Done!"   
fi
echo " Done!"

#Set OUTPUT rules
echo -n "Setting rules for OUTPUT chain..."
iptables -A OUTPUT -j inet-out
echo " Done!"

#Set inet-in rules
echo -n "Setting rules for internet device incoming chain: "
                    echo -n "Setting open ports for specified servers / Network Services .... "i
    if [ "$SAMBALAN" = "YES" -o "$SAMBALAN" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 138:139 -j ACCEPT
    fi
    if [ "$SAMBAWAN" = "YES" -o "$SAMBAWAN" = "yes" ]; then
        iptables -A inet-in -p tcp -i $INETDEV -o $INETDEV --dport 138:139 -j ACCEPT
    fi
    if [ "$SAMBA" = "YES" -o "$SAMBA" = "yes" ]; then
        iptables -A inet-in -p tcp --dport 138:139 -j ACCEPT
    fi
    if [ "$FTP" = "YES" -o "$FTP" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 21 -j ACCEPT
        if [ "$FTPPUBLIC" = "YES" -o "$FTPPUBLIC" = "yes" ]; then
            iptables -A inet-in -p tcp --dport 21 -j ACCEPT
        fi
    fi
    if [ "$TELNET" = "YES" -o "$TELNET" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 23 -j ACCEPT
        if [ "$TELNETPUBLIC" = "YES" -o "$TELNETPUBLIC" = "yes" ]; then
            iptables -A inet-in -p tcp --dport 23 -j ACCEPT
        fi
    fi
    if [ "$SSH" = "YES" -o "$SSH" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 22 -j ACCEPT
        if [ "$SSHPUBLIC" = "YES" -o "$SSHPUBLIC" = "yes" ]; then
            iptables -A inet-in -p tcp --dport 22 -j ACCEPT
        fi
    fi
    if [ "$WEB" = "YES" -o "$WEB" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 80 -j ACCEPT
        if [ "$WEBPUBLIC" = "YES" -o "$WEBPUBLIC" = "yes" ]; then
            iptables -A inet-in -p tcp --dport 80 -j ACCEPT
        fi
    fi
    if [ "$MAIL" = "YES" -o "$MAIL" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 110 -j ACCEPT
    fi
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 25 -j ACCEPT   


    if [ "$MAILPUBLIC" = "YES" -o "$MAILPUBLIC" = "yes" ]; then
            iptables -A inet-in -p tcp --dport 110 -j ACCEPT
        fi
            iptables -A inet-in -p tcp --dport 25 -j ACCEPT
        

    if [ "$IDENT" = "YES" -o "$IDENT" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 113 -j ACCEPT
        if [ "$IDENTPUBLIC" = "YES" -o "$IDENTPUBLIC" = "yes" ]; then
            iptables -A inet-in -p tcp --dport 113 -j ACCEPT
        fi
    fi
    echo "Done!"

    echo -n "Adding trusted hosts.... "
    iptables -A inet-in -s $TRUSTEDHOST1 -j ACCEPT
    iptables -A inet-in -s $TRUSTEDHOST2 -j ACCEPT
    iptables -A inet-in -s $TRUSTEDHOST3 -j ACCEPT
    iptables -A inet-in -s $TRUSTEDHOST4 -j ACCEPT
    iptables -A inet-in -s $TRUSTEDHOST5 -j ACCEPT
    echo "Done!"

    echo -n "Denying all specified hosts.... "
    iptables -A inet-in -s $DENYHOST1 -j DROP
    iptables -A inet-in -s $DENYHOST2 -j DROP
    iptables -A inet-in -s $DENYHOST3 -j DROP
    iptables -A inet-in -s $DENYHOST4 -j DROP
    iptables -A inet-in -s $DENYHOST5 -j DROP
    echo "Done!"

echo -n "  Setup ping option on/off..."
if [ "$PING" = "YES" -o "$PING" = "yes" ]; then
    iptables -A inet-in -p ICMP -j ACCEPT
fi
if [ "$LOGPINGS" = "YES" -o "$LOGPINGS" = "yes" ]; then
                iptables -A inet-in -p ICMP -j LOG
fi
echo "Done!"

echo -n "  Setup port blocking on vulnerable ports..."
#Block NFS
iptables -A inet-in -p tcp --dport 2049 -j LOG
iptables -A inet-in -p udp --dport 2049 -j LOG
iptables -A inet-in -p tcp --dport 2049 -j DROP
iptables -A inet-in -p udp --dport 2049 -j DROP
#Block postgres
iptables -A inet-in -p tcp --dport postgres -j LOG
iptables -A inet-in -p udp --dport postgres -j LOG
iptables -A inet-in -p tcp --dport postgres -j DROP
iptables -A inet-in -p udp --dport postgres -j DROP
#Block X
iptables -A inet-in -p tcp --dport 5999:6003 -j LOG
iptables -A inet-in -p udp --dport 5999:6003 -j LOG 
iptables -A inet-in -p tcp --dport 5999:6003 -j DROP
iptables -A inet-in -p udp --dport 5999:6003 -j DROP
#Block XFS
iptables -A inet-in -p tcp --dport 7100 -j LOG
iptables -A inet-in -p udp --dport 7100 -j LOG
iptables -A inet-in -p tcp --dport 7100 -j DROP
iptables -A inet-in -p udp --dport 7100 -j DROP
#Block Back Orifice
iptables -A inet-in -p tcp --dport 31337 -j LOG
iptables -A inet-in -p udp --dport 31337 -j LOG 
iptables -A inet-in -p tcp --dport 31337 -j DROP
iptables -A inet-in -p udp --dport 31337 -j DROP
#Block netbus
iptables -A inet-in -p tcp --dport 12345:12346 -j LOG
iptables -A inet-in -p udp --dport 12345:12346 -j LOG
iptables -A inet-in -p tcp --dport 12345:12346 -j DROP
iptables -A inet-in -p udp --dport 12345:12346 -j DROP
echo " Done!"
echo " Done!"
echo -n "  Setting connection tracking..."
iptables -A INPUT -i $INETDEV  -m state --state NEW,INVALID -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
echo " Done!"

if [ "$TYPE" = "ipchains" -o "$TYPE" = "IPCHAINS" ]; then
    echo "MAJOR APOLOGIES - The ipchains version didnt make it into the first version, but it is the highest priority on my TODO list"
    echo "Check http://www.endoshield.sourceforge.net for the next release"
fi

kheb het scriptje gedownload van freshmeat.net en ik vind hem erg goed.

hij heet endoshield.
maar ik heb het 1 en ander geprobeerd maar hij wil niet die poort openzetten.
niemand kan joinen op me CS server.

weet iemand een regel of een aanpassing op het scriptje dat ie request op poort 27015 doorlaat zodat mensen op me CS server kunnen spelen??

alvast bedankt.

als je meer gegevens nodig hebt geef ff een gil

[PolarWolf]

Eerst:

code:

$CS=YES
$CSPUBLIC=YES

en ergens bij die andere:

code:

if [ "$CS" = "YES" -o "$CS" = "yes" ]; then
        iptables -A inet-in -p tcp -i $LANDEV -o $LANDEV --dport 27015 -j ACCEPT
                iptables -A inet-in -p udp -i $LANDEV -o $LANDEV --dport 27015 -j ACCEPT
        if [ "$CSPUBLIC" = "YES" -o "$CSPUBLIC" = "yes" ]; then
            iptables -A inet-in -p tcp --dport 27015 -j ACCEPT
            iptables -A inet-in -p udp --dport 27015 -j ACCEPT
        fi
    fi

Volgens mij moet dat werken.

Vindt het zelf niet zo'n geweldig script, maar zolang jij er blij mee bent...
Persoonlijk zou ik als eerste regel het locale LAN alles toestaan, zodat je al met de helft van het aantal regels toe kunt.

[Renkie]

HL / CS gebruikt volgens mij meer poorten dan alleen 27015
27005 ook voor de clients die joinen

copy/paste oude logfile

L 04/26/1999 - 16:27:18: "Renkie<1><4294967295><>" connected, address "10.0.0.150:27005"

[PolarWolf]

Client kant hoef je geen rekening mee te houden, alleen de poort waarnaar geconnect wordt aan de server kant. Je moet hem alleen wel ook voor UDP open zetten.

[robertobadjo]

zo bedankt polar wolf we gaan het us proberen.
en de rest ook bedankt

[PolarWolf]

Joh, wat is er ingewikkeld aan? Plak die eerste twee regels die ik je heb gegeven ergens bovenin, en de rest in het stuk waar al die andere meuk wat erop lijkt ook staat...ja, echt raketwetenschap.

[robertobadjo]

nou het werkt dus niet.

mischien een type cout ofzow??

nietmand kan joinen maar wel mooi stukje werk

[PolarWolf]

Nou, bij mij heeft:

code:

iptables -A INPUT -p tcp -d $MYIP --dport 27015 -j ACCEPT
iptables -A INPUT -p udp -d $MYIP --dport 27015 -j ACCEPT

altijd gewerkt. Dat het nu bij jouw niet werkt, tja...heb je al eens zonder filtering geprobeerd?

[robertobadjo]

HIJ DOET HET!!!!!

eindelijk.

ik maakte zelf een type vout.

harstikke bedankt.

alleen nog 1 vraagske.

wat voor programmeertaal is dat?? en heb je dat helemaal zelf geschreven??

[PolarWolf]

Programmeertaal? Waar?
Of bedoel je dat if...fi gedoe? Dat is sh, of bash

[robertobadjo]

oh weet je toevallig een tutorial om zulke scriptjes te maken lijkt me erg kewl.

[MM-]

man bash?

http://www.google.nl/sear...=UTF-8&oe=UTF-8&hl=nl&lr=

Check bijvoorbeeld de eerste. succes!

[robertobadjo]

bedankt