phphilter: Grant access to remote users using iptables

PhPhilter

grant access to remote server/port via iptables packet filtering

==========================================

Version 0.1 (June 2009)

This class can allow or deny access to a specific port via *nix 'iptables' command.
I developed this class because i have an application running under tomcat on port 9521,
and there is no way for me to use an apache 'htaccess' method to manage accesses to this port.
With this script i have created a web page redirecting browser requests to tomcat server.
For all granted access, will be inserted in my firewall list a rule with port 9521 access.
User can be enabled with user/password or by ip.

Installation:

- copy class.phphilter.php and auth.php scripts to a web accessible folder.
- change auth.php redirect url to your application. Rename auth.php to index.php if you like.
- enable apache user to use 'iptables' with sudo and without password request,
  editing /etc/sudoers and adding a row with:

wwwrun ALL= PASSWD:ALL, NOPASSWD: /usr/sbin/iptables

be aware that apache user could be different from 'wwwrun' and 'iptables' pathname could be different too.

- Edit class.phpfilter.php and adjust some values:

_IPTABLES        check if 'sudo' and 'iptables' commands need to be changed
_CHAIN           firewall CHAIN (default 'INPUT')
_PORT            set to port value
_HOST_ALLOW      insert all fix ip values with granted access without user/password request, comma separated.
                 you can put here a simple ip value or ip range (ie. '195.110.135.42' or '195.110.135.128/25')
_HOST_DENY       insert all ip you deny access, in the same way of _HOST_ALLOW
$passwd          all user/password values

- configure your firewall inserting a rule like this:

iptables -A INPUT -p tcp --dport 9521 -j DROP

   so at next reboot all accesses to this port will be denied until users will authenticate themselves,
   where 'INPUT' is the same value of '_CHAIN' class field and '9521' is the same value of '_PORT' class field.




example:

my initial firewall INPUT chain situation:

admin@linux-peppe:~> sudo /usr/sbin/iptables -L INPUT -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9521



after first access from authorized/authenticated user with ip 127.0.0.1 (localhost):

admin@linux-peppe:~> sudo /usr/sbin/iptables -L INPUT -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  127.0.0.1            0.0.0.0/0           tcp dpt:9521
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9521



after second access from authorized/authenticated user with ip 10.98.61.138:

admin@linux-peppe:~> sudo /usr/sbin/iptables -L INPUT -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  10.98.61.138         0.0.0.0/0           tcp dpt:9521
ACCEPT     tcp  --  127.0.0.1            0.0.0.0/0           tcp dpt:9521
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9521

and so on.



Download: http://www.phpclasses.org

Giuseppe Lucarelli
[email protected]


Enjoy!