Untitled

#!/bin/bash#iptables -V = iptables#flush everything#DEPMOD=/sbin/depmod#MODPROBE=/sbin/modprobe#$DEPMOD -a#$MODPROBE ip_conntrack#$MODPROBE ip_conntrack_ftp#$MODPROBE ip_conntrack_irc#$MODPROBE iptable_nat#$MODPROBE ip_nat_ftp#$MODPROBE ip_nat_irc# flushing everythingecho " Flushing everything "iptables -F#iptables -Xiptables -t nat -Fiptables -F INPUTiptables -F FORWARDiptables -F OUTPUT# deleting chainsecho " Deleting chains "#iptables -X bad_tcp_packetsiptables -X icmp_allowediptables -X allow-ssh-traffic-iniptables -X check-flags#iptables -X DropNLog #drop everythingecho " Droping everything "iptables -P INPUT DROPiptables -P FORWARD DROPiptables -P OUTPUT ACCEPT#Allow establised connections and progs that use loop-backecho " Allow establised connections and progs that use loop-back "iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo -j ACCEPTiptables -A INPUT -i lo -j ACCEPT# syn protect#echo " Activating SYN protect with limit = 1/s "#allowed connections$IPTABLES -N allowed-connection$IPTABLES -F allowed-connection$IPTABLES -A allowed-connection -d $maya -p tcp --dport $ssh -j ACCEPT #ICMP trafficecho "Creating icmp chain"$IPTABLES -N icmp_allowed$IPTABLES -F icmp_allowed$IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type time-exceeded -j ACCEPT$IPTABLES -A icmp_allowed -m state --state NEW -p icmp --icmp-type destination-unreachable -j ACCEPT$IPTABLES -A icmp_allowed -p icmp -j LOG --log-prefix "Bad ICMP traffic:"$IPTABLES -A icmp_allowed -p icmp -j DROP#Incoming trafficecho "Creating incoming ssh traffic chain"$IPTABLES -N allow-ssh-traffic-in$IPTABLES -F allow-ssh-traffic-in#Flood protection$IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags ALL RST --dport $ssh -j ACCEPT$IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags ALL FIN --dport $ssh -j ACCEPT$IPTABLES -A allow-ssh-traffic-in -m limit --limit 1/second -p tcp --tcp-flags ALL SYN --dport $ssh -j ACCEPT$IPTABLES -A allow-ssh-traffic-in -m state --state RELATED,ESTABLISHED -p tcp --dport $ssh -j ACCEPT #Catch portscanners    echo "Creating portscan detection chain"$IPTABLES -N check-flags$IPTABLES -F check-flags$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"$IPTABLES -A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS:"$IPTABLES -A check-flags -p tcp --tcp-flags ALL ALL -j DROP$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"$IPTABLES -A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"$IPTABLES -A check-flags -p tcp --tcp-flags ALL NONE -j DROP$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"$IPTABLES -A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"$IPTABLES -A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP# allow connections on portsecho " Allow connection on ports "iptables -A INPUT -m state --state INVALID -j DROPiptables -A INPUT -p icmp -j icmp_allowediptables -A INPUT -j check-flagsiptables -A INPUT -i lo -j ACCEPTiptables -A INPUT -j allow-ssh-traffic-iniptables -A INPUT -j allowed-connection# ipv4_forwardecho " Activating ipv4 forward "echo 1 > /proc/sys/net/ipv4/ip_forward