Red

debian:~# cat fw
#!/bin/bash
echo "Setting up firewall rules..."
IPTABLES=/sbin/iptables
EXTERNAL_IFACE0=ppp0
EXTERNAL_IP=`/sbin/ifconfig ppp0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`

echo "Loading required stateful/NAT kernel modules..."

/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc

echo "    Enabling IP forwarding..."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

echo "    External interface: $EXTERNAL_IFACE0"
echo "       External interface IP address is: $EXTERNAL_IP"
echo "    Loading firewall server rules..."

UNIVERSE=" 0.0.0.0/0"

# Start with a tough policy.
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT

# clean up
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z

$IPTABLES -A INPUT -i lo -j ACCEPT
# remote interface, any source, going to permanent PPP address is valid
$IPTABLES -A INPUT -i $EXTERNAL_IFACE0 -s $UNIVERSE -d $EXTERNAL_IP -j ACCEPT
$IPTABLES -m state -A INPUT -i $EXTERNAL_IFACE0 --state ESTABLISHED,RELATED -j ACCEPT

# on ppp0, allow SSH,HTTP and torrent
$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -i $EXTERNAL_IFACE0 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 -i $EXTERNAL_IFACE0 -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 6890:6999 -i $EXTERNAL_IFACE0 -j ACCEPT

# everywhere, allow ping and traceroute
$IPTABLES -A INPUT -p icmp -m icmp  --icmp-type 0               -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp  --icmp-type 8               -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp  --icmp-type 3               -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp  --icmp-type 11              -j ACCEPT
$IPTABLES -A INPUT -p icmp -m icmp  --icmp-type 30              -j ACCEPT
$IPTABLES -A INPUT -p udp  -m state --state ESTABLISHED         -j ACCEPT
$IPTABLES -A INPUT -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT

# limit the number of incoming connections on port 22 ( SSH ) to 3 attempts a minute
$IPTABLES -I INPUT -p tcp --dport 22 -i $EXTERNAL_IFACE0 -m state --state NEW -m recent --set
$IPTABLES -I INPUT -p tcp --dport 22 -i $EXTERNAL_IFACE0 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 -j DROP

DATE=(date +"%F %r")
echo "$DATE REBOOT 1.1.1.1" >> /var/log/check_ppp0


echo -e "    Firewall rules loading complete\n\n"
debian:~#