kgoetz@gateProxy:~$ cat /etc/network/if-up.d/000-firewallScript
#!/bin/sh
############### ###############
# The bits that are ##'d are copied from places - they should be basicly #
# unchanged ( perhaps a port here and there, or a variable ). The header block #
# is the only original bit - and the variables :). wow. original :) #
# This was coppied from the script used on Willunga Waldorf Schools gateway #
############### ###############
# internal=eth0
# thisBoxInternal=192.168.0.1
# external=eth1
# thisBoxExternal=10.0.0.2
# cachingProxyPort=8123
# filteringProxyPort=8118
############### ###############
# Copied from http://www.debian-administration.org/articles/23 #
# "Setting up a simple Debian gateway" #
# All typed out by Karl, 16th July, 2k6 #
# Eth0 is internal, Eth1 is eth1. Or was when I set it up. #
############### ###############
PATH=/usr/sbin:/sbin:/bin:/usr/bin
#
# Delete All Existing Rules
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT
# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow outgoing connections from the LAN side
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
# Masquerade
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# Dont't forward from the outside to the inside
iptables -A FORWARD -i eth1 -o eth1 -j REJECT
# Enable routing
echo "1" > /proc/sys/net/ipv4/ip_forward
############### ###############
# End of debian-administration iptables rules #
############### ###############
############### ###############
# Copied from http://www.debian-administration.org/articles/73 #
# "Port forwarding for iptables (DMZ)" #
# The instructions are for a different machine, I'm trying for this one. #
############### ###############
# All external traffic to 64 should be sent to this machine.
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 64 -j DNAT --to 10.0.0.2
# Accept new connections on port 64 on device eth1
iptables -A INPUT -p tcp -m state --state NEW --dport 64 -i eth1 -j ACCEPT
############### ###############
# End DMZ (ssh) bit #
############### ###############
############### ###############
# Copied from http://www.debian-administration.org/articles/252 #
# "Secure Networking within kernel" #
# Left disabled until I know the top bit works, and because all this can / #
# should be set in a config file. (/etc/sysctl.conf). It will be enabled here #
# for added security. #
############## ###############
# Ignore all ICMP echo - dont respond to ping
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# Reject incoming packets if their source ip does not match the network
# they are coming from - dont know if this is safe for us.
# echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
# Protect against SYN floods... whatever o_0
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# Ignore broadcast ping to "... prevent you from being an unwilling
# participant in smurf attacks"
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Ignore bogus error responces (ie, responces to errors we didn't make)
#echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responces
############### ###############
# End of Secure networking in kernel section. #
############### ###############
############### ###############
# Copied from http://www.debian-administration.org/articles/187 #
# "Using iptables to rate-limit incoming connections" #
############### ###############
iptables -I INPUT -p tcp --dport 64 -i eth1 -m state --state NEW -m recent --set
# Allow a max of 3 tries per minute (drop on 4th) from external network to ssh.
iptables -I INPUT -p tcp --dport 64 -i eth1 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
############### ###############
############### ###############
# Copied from: #
# http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html #
# "Linux: Setup a transparent proxy with Squid in three easy steps" #
# Skipped down to step 3 - "Iptables configuration". #
# Comments somewhat changed to reflet my reality, variables renamed. #
############## ###############
#
# Commented out due to lack of testing
#
# DNAT port 80 request comming from LAN systems to squid 8118 ($SQUID_PORT) aka transparent proxy
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to $thisBoxInternal:$filteringProxyPort
#
# if it is same system
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port $filteringProxyPort
#
# From debian-administraton.org - seems to disagree with above - :S
## Transparent proxying
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
#
############### ###############
# End of "Linux: Setup a transparent proxy with Squid in three easy steps" #
############### ###############