prox-fire öffnet jetzt nur noch den Zugang zum Frontend für die IP, die das Script ausführt.

prox-fire.d/prox-fire

 #!/bin/bash
 
 #    <prox-fire Proxmox-Port öffnen und schließen>
-# version: 0.2
+# version: 0.3
 #    Copyright (C) <2013>  <Heiko Kokemoor>
 #    This program is free software: you can redistribute it and/or modify
 #    it under the terms of the GNU General Public License as published by
@@ -26,65 +26,71 @@ LOGLEVELACCEPT='4'
 PROXPORT='8006'
 
 
+
 check_rule_start()
 {
+        CLIENT_IP=$(echo $SSH_CLIENT | awk '{ print $1}')
+
         $IPTABLES -L|grep "tcp dpt:$PROXPORT"
 }
 
 accept_proxmox()
 {
         CLIENT_IP=$(echo $SSH_CLIENT | awk '{ print $1}')
-	CLIENT_PORT=$(echo $SSH_CLIENT | awk '{ print $2}')
-	printf "$CLIENT_IP\t$CLIENT_PORT" >> $OPEN_PORTS_FILE
-
         $IPTABLES -A INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -s $CLIENT_IP -j ACCEPT
-        $IPTABLES -A OUTPUT  -o $EXT_IFACE -p tcp --dport $PROXPORT -s $CLIENT_IP -j ACCEPT
+        $IPTABLES -A OUTPUT  -o $EXT_IFACE -p tcp --dport $PROXPORT -d $CLIENT_IP -j ACCEPT
+        echo "Port $PROXPORT for IP $CLIENT_IP is unblocked"
 }
 
 drop_proxmox()
 {       
+        CLIENT_IP=$(echo $SSH_CLIENT | awk '{ print $1}')
+        
         EI=0
         EO=0
         while [ $EI = 0 ] && [ $EO = 0 ]
         do      
-                $IPTABLES -D INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -j ACCEPT
+                $IPTABLES -D INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -s $CLIENT_IP -j ACCEPT 2&>/dev/null 
                 EI=$?
-                $IPTABLES -D OUTPUT  -o $EXT_IFACE -p tcp --dport $PROXPORT -j ACCEPT
+                $IPTABLES -D OUTPUT  -o $EXT_IFACE -p tcp --dport $PROXPORT -d $CLIENT_IP -j ACCEPT 2&>/dev/null
                 EO=$?
         done 
+        echo "Port $PROXPORT for IP $CLIENT_IP is blocked"
 }
 
+
 stop_all()
 {       
         C=0
-	unset L
+        L=0
         unset Z 
-	unset A	
+        declare -a Z
          
-	 A=$(iptables -L -n |grep $PROXPORT |awk '{print $4}'|uniq)
+         A=$(iptables -L -n |grep $PROXPORT |awk '{print $4}'|grep -v 0.0.0.0||iptables -L -n |grep $PROXPORT |awk '{print $5}'|grep -v 0.0.0.0)
         
         while [ $C = 0 ]
                 do      
-			L=$(wcalc -q $L+1)
-			Z[$L]=$(echo $A|cut -d' ' -f$L)
-			$IPTABLES -D INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -s ${Z[$L]} -j ACCEPT
-			$IPTABLES -D OUTPUT -o $EXT_IFACE -p tcp --dport $PROXPORT -s ${Z[$L]} -j ACCEPT
+                        L=$(( $L+1 ))
+                        Z[$L]=$(echo $A|awk '{ print $'''$L'''}')
+                        $IPTABLES -D INPUT -i $EXT_IFACE -p tcp --dport $PROXPORT -s ${Z[$L]} -j ACCEPT 2&>/dev/null   
+                        $IPTABLES -D OUTPUT -o $EXT_IFACE -p tcp --dport $PROXPORT -d ${Z[$L]} -j ACCEPT 2&>/dev/null  
                         if [ -z ${Z[$L]} ]
                                 then C=1
                         fi
                 done
-}
         
+        echo "Port $PROXPORT for all IPs blocked"
+}
 
 i=$1
  
 case $i in
         start)
-	        check_rule_start
-	        if [  $? = 1 ]
-        		then
+#               check_rule_start
+#               if [  $? = 1 ]
+#                       then 
                                 accept_proxmox
-	        fi
+#               fi              
                 
         ;;      
         stop)
@@ -94,7 +100,7 @@ case $i in
                 stop_all
         ;;              
         *)
-	        echo $(basename $0) '[start|stop] - opens a port for the Porxmox Webinterface'
+                echo $(basename $0) '[start|stop|stop-all] - opens a port for the Proxmox Webinterface'
         ;;
 esac