rendered paste body#!/bin/bashIPT=/sbin/iptablesUPLINK="eth2"# start bash script start_firewall() { #Reset the iptable first chains=`cat /proc/net/ip_tables_names` for i in $chains; do $IPT -t $i -F $IPT -t $i -X $IPT -t $i -Z done#Add the new rules$IPT -P INPUT DROP$IPT -I INPUT 1 -i ${UPLINK} -m state --state INVALID -j DROP$IPT -I INPUT -i ${UPLINK} -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -P OUTPUT ACCEPT$IPT -P FORWARD ACCEPT#share the internet$IPT -t nat -I POSTROUTING -o ${UPLINK} -j MASQUERADE$IPT -N syn-flood$IPT -I INPUT -i ${UPLINK} -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j syn-flood$IPT -I syn-flood -i ${UPLINK} -m limit --limit 4/s --limit-burst 16 -j RETURN$IPT -I syn-flood -i ${UPLINK} -m limit --limit 75/s --limit-burst 100 -j RETURN$IPT -I syn-flood -i ${UPLINK} -j LOG --log-prefix "SYN FLOOD " --log-tcp-sequence --log-tcp-options --log-ip-options -m limit --limit 1/second$IPT -I syn-flood -i ${UPLINK} -j DROP## I use a script to send droped ips to my workstation in a popup format ;) for ssh, ftp, pop3 and webmin.. ## Insert the rules early so we are sure they get DROP'ed :)sshweb=/sshweb.sh exec $sshweb start &INTERFACES="lo br0"for x in ${INTERFACES} do $IPT -A INPUT -i ${x} -j ACCEPTdone# 21=ftp 22=ssh 25=postfix 110=pop3 6881=torrent 10000=webminSERVICES="21 22 25 81 110 6881 10000"for x in ${SERVICES} do $IPT -A INPUT -p tcp -i ${UPLINK} --dport ${x} -j ACCEPTdone# log ftp attempts$IPT -A INPUT -p tcp -i ${UPLINK} --dport 21 -m state --state NEW -j LOG --log-prefix "IPT:FTP: "$IPT -A INPUT -p tcp -i ${UPLINK} --dport 21 -m state --state NEW -m recent --update --seconds 45 --hitcount 4 -j DROP# log ssh attempts$IPT -A INPUT -p tcp -i ${UPLINK} --dport 22 -m state --state NEW -j LOG --log-prefix "IPT:SSH: "$IPT -A INPUT -p tcp -i ${UPLINK} --dport 22 -m state --state NEW -m recent --update --seconds 45 --hitcount 4 -j DROP# log pop3 attempts$IPT -A INPUT -p tcp -i ${UPLINK} --dport 110 -m state --state NEW -j LOG --log-prefix "IPT:POP3: "$IPT -A INPUT -p tcp -i ${UPLINK} --dport 110 -m state --state NEW -m recent --update --seconds 45 --hitcount 4 -j DROP# log webmin attempts$IPT -A INPUT -p tcp -i ${UPLINK} --dport 10000 -m state --state NEW -j LOG --log-prefix "IPT:WEBMIN: "$IPT -A INPUT -p tcp -i ${UPLINK} --dport 10000 -m state --state NEW -m recent --update --seconds 30 --hitcount 4 -j DROP}stop_firewall() { sshweb=/sshweb.sh exec $sshweb stop & chains=`cat /proc/net/ip_tables_names` for i in $chains; do $IPT -t $i -F $IPT -t $i -X $IPT -t $i -Z done $IPT -P INPUT ACCEPT $IPT -P OUTPUT ACCEPT $IPT -P FORWARD ACCEPT $IPT -I INPUT -i eth2 -j ACCEPT $IPT -I OUTPUT -o eth2 -j ACCEPT $IPT -I INPUT -i br0 -j ACCEPT $IPT -I OUTPUT -o br0 -j ACCEPT $IPT -t nat -I POSTROUTING -o eth2 -j MASQUERADE echo -e "\n******************** Firewall stopped *********************\n" }case "$1" in start) start_firewallecho "****************** Starting the firewall *******************"# Turn on IP Spoof protection by using IP Source Address Verificationif [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then echo -n "Setting up IP spoofing protection..." for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done echo "done."else echo "PROBLEMS SETTING UP IP SPOOFING PROTECTION."fi# Activate the forwarding!if [ -e /proc/sys/net/ipv4/ip_forward ]; then echo -n "Turning on forwarding..." echo 1 >/proc/sys/net/ipv4/ip_forward echo "done."else echo "Forwarding not turned on!"fi# Enable bad error message protectionif [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ] ; then echo -n "Turning on bad error message protection..." echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses echo "done."else echo "Problem turing on bad error message protection."fi# Don't respond to broadcast pings.if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then echo -n "Stopping broadcast pings..." echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "done."else echo "Problem stopping broadcast pings."fiecho -e "\n******************************************************************" ;; stop) stop_firewall ;; *) echo "Usage: $0 {start|stop}" exit 1 ;;esac