IPTABLES

#!/bin/sh#  IPTABLES  FIREWALL  script for the Linux 2.4 kernel.#  This script is a derivitive of the script presented in#  the IP Masquerade HOWTO page at:#  www.tldp.org/HOWTO/IP-Masquerade-HOWTO/stronger-firewall-examples.html#  It was simplified to coincide with the configuration of#  the sample system presented in the Guides section of#  www.aboutdebian.com##  This script is presented as an example for testing ONLY#  and should not be used on a production firewall server.##    PLEASE SET THE USER VARIABLES#    IN SECTIONS A AND B OR Cecho -e "\n\nSETTING UP IPTABLES FIREWALL..."# === SECTION A# -----------   FOR EVERYONE # SET THE INTERFACE DESIGNATION AND ADDRESS AND NETWORK ADDRESS# FOR THE NIC CONNECTED TO YOUR _INTERNAL_ NETWORK#   The default value below is for "eth0".  This value #   could also be "eth1" if you have TWO NICs in your system.#   You can use the ifconfig command to list the interfaces#   on your system.  The internal interface will likely have#   have an address that is in one of the private IP address#   ranges.#       Note that this is an interface DESIGNATION - not#       the IP address of the interface.# Enter the designation for the Internal Interface'sINTIF="eth0"  # interfaz interna(LAN)# Enter the NETWORK address the Internal Interface is onINTNET="192.168.0.0/25"  # IP de la red interna# Enter the IP address of the Internal InterfaceINTIP="192.168.0.1/25" # IP de esta maquina# SET THE INTERFACE DESIGNATION FOR YOUR "EXTERNAL" (INTERNET) CONNECTION#   The default value below is "ppp0" which is appropriate #   for a MODEM connection.#   If you have two NICs in your system change this value#   to "eth0" or "eth1" (whichever is opposite of the value#   set for INTIF above).  This would be the NIC connected#   to your cable or DSL modem (WITHOUT a cable/DSL router).#       Note that this is an interface DESIGNATION - not#       the IP address of the interface.#   Enter the external interface's designation for the#   EXTIF variable:EXTIF="eth1"  # interfaz externa(Cablemodem/DSL)# ! ! ! ! !  Use ONLY Section B  *OR*  Section C depending on#  ! ! ! !   the type of Internet connection you have.# ! ! ! ! !  Uncomment ONLY ONE of the EXTIP statements.# === SECTION B# -----------   FOR THOSE WITH STATIC PUBLIC IP ADDRESSES   # SET YOUR EXTERNAL IP ADDRESS   #   If you specified a NIC (i.e. "eth0" or "eth1" for   #   the external interface (EXTIF) variable above,   #   AND if that external NIC is configured with a   #   static, public IP address (assigned by your ISP),   #   UNCOMMENT the following EXTIP line and enter the   #   IP address for the EXTIP variable:#;EXTIP="your.static.IP.address"# === SECTION C# ----------   DIAL-UP MODEM, AND RESIDENTIAL CABLE-MODEM/DSL (Dynamic IP) USERS# SET YOUR EXTERNAL INTERFACE FOR DYNAMIC IP ADDRESSING#   If you get your IP address dynamically from SLIP, PPP,#   BOOTP, or DHCP, UNCOMMENT the command below.#   (No values have to be entered.)#         Note that if you are uncommenting these lines then#         the EXTIP line in Section B must be commented out.EXTIP="`/sbin/ifconfig eth1 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`" #encuentra IP# --------  No more variable setting beyond this point  --------echo "Loading required stateful/NAT kernel modules..."echo "    Enabling IP forwarding..."echo "1" > /proc/sys/net/ipv4/ip_forwardecho "1" > /proc/sys/net/ipv4/ip_dynaddrecho "    External interface: $EXTIF"echo "       External interface IP address is: $EXTIP"echo "    Loading firewall server rules..."UNIVERSE="0.0.0.0/0"# Clear any existing rules and setting default policy to DROPiptables -P INPUT DROP    #-P policyiptables -F INPUT         #-F Flush/como resetear iptables -P OUTPUT DROPiptables -F OUTPUT iptables -P FORWARD DROPiptables -F FORWARD iptables -F -t nat# Flush the user chain.. if it existsif [ "`iptables -L | grep drop-and-log-it`" ]; then   iptables -F drop-and-log-itfi# Delete all User-specified chainsiptables -X    #-X Delete/Borra# Reset all IPTABLES countersiptables -Z    #-Z Zero/resetea# Creating a DROP chainiptables -N drop-and-log-it   # -N New chain/Crea cadenaiptables -A drop-and-log-it -j LOG --log-level info   #-A Append/agrega parametrosiptables -A drop-and-log-it -j REJECTecho -e "     - Loading INPUT rulesets"######################################################################## INPUT: Incoming traffic from various interfaces.  All rulesets are #        already flushed and set to a default policy of DROP. # -i interfaz de input# -o interfaz de output# -s source# -d destino# -j jump target/especifica accion de la regla##mi maquina hace todo#iptables -A INPUT -s $EXTIP -j ACCEPT #iptables -A OUTPUT -d $EXTIP -j ACCEPT# loopback interfaces are valid.iptables -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT# local interface, local machines, going anywhere is validiptables -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT# remote interface, claiming to be local machines, IP spoofing, get lostiptables -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it# remote interface, any source, going to permanent PPP address is validiptables -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -j ACCEPT# Allow any related traffic coming back to the MASQ server iniptables -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT#  OPTIONAL:  Uncomment the following two commands if plan on running#             an Apache Web site on the firewall server itself##echo -e "      - Allowing EXTERNAL access to the WWW server"#iptables -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT# Catch all rule, all other incoming is denied and logged.  iptables -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-itecho -e "     - Loading OUTPUT rulesets"######################################################################## OUTPUT: Outgoing traffic from various interfaces.  All rulesets are #         already flushed and set to a default policy of DROP. ## loopback interface is valid.iptables -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT# local interfaces, any source going to local net is validiptables -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT# local interface, any source going to local net is validiptables -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT# outgoing to local net on remote interface, stuffed routing, denyiptables -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it# anything else outgoing on remote interface is validiptables -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT# Catch all rule, all other outgoing is denied and logged. iptables -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-itecho -e "     - Loading FORWARD rulesets"######################################################################## FORWARD: Enable Forwarding and thus IPMASQ#          Allow all connections OUT and only existing/related INiptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT# Catch all rule, all other forwarding is denied and logged. iptables -A FORWARD -j drop-and-log-it# Enable SNAT (MASQUERADE) functionality on $EXTIFiptables -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIPecho -e "    Firewall server rule loading complete\n\n"