rendered paste body#!/bin/sh# VariablesINTIF="br0"EXTIF="ppp0"MASQUNET="192.168.8.0/24"IPT="/sbin/iptables"dmesg -n2 start() {echo -n "Starting Firewall: "# erst mal alles lschen$IPT -F$IPT -X$IPT -t nat -F#default policies$IPT -P INPUT DROP$IPT -P FORWARD DROP$IPT -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu#$IPT -A INPUT -s 00:03:0D:1D:18:07 -j LOG#$IPT -A INPUT -s 00:03:0D:1D:18:07 -j DROP#Masquerading$IPT -t nat -A POSTROUTING -s $MASQUNET -o $EXTIF -j MASQUERADEecho 1 >> /proc/sys/net/ipv4/ip_forward# Create chain which blocks new connections, except if coming from inside$IPT -N block#$IPT -A block -o $EXTIF -j LOG$IPT -A block -m state --state ESTABLISHED,RELATED -j ACCEPT$IPT -A block -m state --state NEW -i ! $EXTIF -j ACCEPT$IPT -A block -j LOG$IPT -A block -j DROP#Create chain that blocks incoming traffic from outside, if it comes from a local IP$IPT -N inet# disable local nets incomming from outside $IPT -A inet -s $MASQUNET -j LOG $IPT -A inet -s $MASQUNET -j DROP $IPT -A inet -s 192.168.0.0/16 -j LOG $IPT -A inet -s 192.168.0.0/16 -j DROP $IPT -A inet -s 10.0.0.0/8 -j LOG $IPT -A inet -s 10.0.0.0/8 -j DROP $IPT -A inet -s 172.16.1.0/16 -j LOG $IPT -A inet -s 172.16.1.0/16 -j DROP# allow ssh$IPT -A inet -p tcp --dport 22 -j ACCEPT #allow smtp#$IPT -A inet -p tcp --dport 25 -j ACCEPT #allow openvpn 5000#$IPT -A inet -p tcp --dport 80 -j ACCEPT #$IPT -A inet -p udp --dport 5000 -j ACCEPT#allow openvpn 5000#$IPT -A inet -p udp --dport 5001 -j ACCEPT#allow openvpn 5000#$IPT -A inet -p udp --dport 5002 -j ACCEPT#$IPT -A inet -p udp --dport 5003 -j ACCEPT#$IPT -A inet -p udp --dport 5004 -j ACCEPT# allow http$IPT -A inet -p tcp --dport 80 -j ACCEPT # allow TS2#$IPT -A inet -p udp --dport 8767 -j ACCEPT #allow mangos$IPT -A inet -p tcp --dport 3724 -j ACCEPT$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3724 -j DNAT --to-destination 192.168.8.2$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.2 --dport 3724 -j ACCEPT$IPT -A inet -p tcp --dport 8085 -j ACCEPT$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 8085 -j DNAT --to-destination 192.168.8.2$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.2 --dport 8085 -j ACCEPT#bittorent$IPT -A inet -p tcp --dport 53924 -j ACCEPT$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 53924 -j DNAT --to-destination 192.168.8.18$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.18 --dport 53924 -j ACCEPT# allow https# $IPT -A inet -p tcp --dport 443 -j ACCEPT #allow neverwinther nights#$IPT -A inet -p udp --dport 5121 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 5121 -j DNAT --to-destination 192.168.8.2#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.2 --dport 5121 -j ACCEPT#allow mysql# $IPT -A inet -p tcp --dport 3306 -j ACCEPT#allow apache#$IPT -A inet -p tcp --dport 80 -j ACCEPT#allow https# $IPT -A inet -p tcp --dport 443 -j ACCEPT#allow POP3 from outside#IPT -A inet -p tcp --dport 110 -j ACCEPT#allow bittorrent$IPT -A inet -p tcp --dport 3724 -j ACCEPT$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3724 -j DNAT --to-destination 192.168.8.11$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.11 --dport 3742 -j ACCEPT$IPT -A inet -p tcp --dport 6881:6999 -j ACCEPT$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 6881:6999 -j DNAT --to-destination 192.168.8.11$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.11 --dport 6881:6999 -j ACCEPT$IPT -A inet -p tcp --dport 6112 -j ACCEPT$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 6112 -j DNAT --to-destination 192.168.8.11$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.11 --dport 6112 -j ACCEPT#allow JediServer#$IPT -A inet -p udp --dport 29070 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 29070 -j DNAT --to-destination 192.168.8.2#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.2 --dport 29070 -j ACCEPT#civilisation (dx8)$IPT -A inet -p udp --dport 2302:2400 -j ACCEPT$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 2302 -j DNAT --to-destination 192.168.8.18$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.18 --dport 2302:2400 -j ACCEPT#allow empire earth#$IPT -A inet -p tcp --dport 33335 -j ACCEPT#$IPT -A inet -p tcp --dport 33336 -j ACCEPT#$IPT -A inet -p udp --dport 33334 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 33335 -j DNAT --to-destination 192.168.9.18#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 33336 -j DNAT --to-destination 192.168.9.18#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 33334 -j DNAT --to-destination 192.168.9.18#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.9.18 --dport 33335 -j ACCEPT#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.9.18 --dport 33336 -j ACCEPT#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.9.18 --dport 33334 -j ACCEPT#allow edonkey#$IPT -A inet -p tcp --dport 4661 -j ACCEPT#$IPT -A inet -p tcp --dport 4662 -j ACCEPT#$IPT -A inet -p udp --dport 3271 -j ACCEPT#$IPT -A inet -p udp --dport 4665 -j ACCEPT#port forwarding edonkey#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 4662 -j DNAT --to-destination 192.168.8.2#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.8.2 --dport 4662 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 3271 -j DNAT --to-destination 192.168.8.2#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.8.2 --dport 3271 -j ACCEPT#allow Jedi Academy Server#$IPT -A inet -p udp --dport 29070 -j ACCEPT#port forwarding Jedi Academy Server#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 29070 -j DNAT --to-destination 192.168.11.2#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.11.2 --dport 29070 -j ACCEPT#allow Siedler 4#$IPT -A inet -p tcp --dport 3000 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3000 -j DNAT --to-destination 192.168.11.15#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.11.15 --dport 3000 -j ACCEPT#$IPT -A inet -p tcp --dport 3105 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -m tcp --dport 3105 -j DNAT --to-destination 192.168.11.15#$IPT -A FORWARD -i $EXTIF -o $INTIF -p tcp -d 192.168.11.15 --dport 3105 -j ACCEPT#$IPT -A inet -p udp --dport 3000 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 3000 -j DNAT --to-destination 192.168.11.15#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.11.15 --dport 3000 -j ACCEPT#$IPT -A inet -p udp --dport 3105 -j ACCEPT#$IPT -t nat -A PREROUTING -i $EXTIF -p udp -m udp --dport 3105 -j DNAT --to-destination 192.168.11.15#$IPT -A FORWARD -i $EXTIF -o $INTIF -p udp -d 192.168.11.15 --dport 3105 -j ACCEPT#killfucking$IPT -A INPUT -d 87.248.104.123 -j LOG$IPT -A INPUT -d 87.248.104.123 -j DROP#Other# Jump to that chain from INPUT and FORWARD chains$IPT -A INPUT -i $EXTIF -j inet$IPT -A INPUT -j block$IPT -A FORWARD -j block#$IPT -A INPUT -i $INTIF -j LOG#$IPT -A OUTPUT -o $EXTIF -j LOG$IPT -A OUTPUT -o $EXTIF -d $MASQUNET -j LOG$IPT -A OUTPUT -o $EXTIF -d $MASQUNET -j DROP#$IPT -A OUTPUT -o $EXTIF -d $172.16.1.0/24 -j LOG#$IPT -A OUTPUT -o $EXTIF -d $172.16.1.0/24 -j DROPtouch /var/lock/subsys/iptablesecho "done"}stop() {echo -n stopping firewall...$IPT -F$IPT -X$IPT -P INPUT ACCEPT$IPT -P OUTPUT ACCEPT$IPT -P FORWARD ACCEPTecho done.rm -f /var/lock/subsys/iptables}case "$1" instart)start;;stop)stop;;restart)# "restart" is really just "start" as this isn't a daemon,# and "start" clears any pre-defined rules anyway.# This is really only here to make those who expect it happystart;;condrestart)[ -e /var/lock/subsys/iptables ] && start;;status)echo $"Table: filter"$IPT --list -n -vechoecho $"Table: nat"$IPT -t nat --list -n -vechoecho $"Table: mangle"$IPT -t mangle --list -n -v;;panic)echo -n $"Changing target policies to DROP: "$IPT -P INPUT DROP && \$IPT -P FORWARD DROP && \$IPT -P OUTPUT DROP && \$IPT -t nat -P PREROUTING DROP && \$IPT -t nat -P POSTROUTING DROP && \$IPT -t nat -P OUTPUT DROP && \$IPT -t mangle -P PREROUTING DROP && \$IPT -t mangle -P OUTPUT DROP && \success $"Changing target policies to DROP" || \failure $"Changing target policies to DROP"echo$IPT -F INPUT && \$IPT -F FORWARD && \$IPT -F OUTPUT && \$IPT -t nat -F PREROUTING && \$IPT -t nat -F POSTROUTING && \$IPT -t nat -F OUTPUT && \$IPT -t mangle -F PREROUTING && \$IPT -t mangle -F OUTPUT && \success $"Flushing all chains:" || \failure $"Flushing all chains:"$IPT -X INPUT && \$IPT -X FORWARD && \$IPT -X OUTPUT && \$IPT -t nat -X PREROUTING && \$IPT -t nat -X POSTROUTING && \$IPT -t nat -X OUTPUT && \$IPT -t mangle -X PREROUTING && \$IPT -t mangle -X OUTPUT && \success $"Removing user defined chains:" || \failure $"Removing user defined chains:";;*)echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"exit 1esacexit 0