rendered paste body#!/bin/bash# Do iptables based masquerading and firewalling.# ~spot, 09/01/2002# Set default PATHexport PATH=/sbin:/usr/sbin:/bin:/usr/bin# Load NAT modulesmodprobe iptable_natmodprobe ip_nat_ftpmodprobe ip_nat_irc# Load connection-tracking modulesmodprobe ip_conntrackmodprobe ip_conntrack_ftpmodprobe ip_conntrack_ircsysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1sysctl -w net.ipv4.conf.all.accept_redirects=0sysctl -w net.ipv6.conf.all.accept_redirects=0sysctl -w net.ipv4.conf.all.send_redirects=0sysctl -w net.ipv6.conf.all.send_redirects=0sysctl -w net.ipv4.conf.all.accept_source_route=0sysctl -w net.ipv4.conf.all.forwarding=0sysctl -w net.ipv4.conf.all.mc_forwarding=0sysctl -w net.ipv4.conf.all.rp_filter=1sysctl -w net.ipv4.conf.all.log_martians=1sysctl -w net.ipv4.tcp_max_syn_backlog=1280sysctl -w net.ipv4.tcp_syncookies=1sysctl -w net.ipv4.tcp_synack_retries=2sysctl -w net.ipv4.ip_forward=1# Clean old iptables iptables -F iptables -X iptables -Z# Start APF/etc/init.d/apf start# Allow forwarding through the internal interfaceiptables -A FORWARD -i eth1 -j ACCEPTiptables -A FORWARD -o eth1 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # Default forward policy to DROPiptables -P FORWARD DROP# Do masquerading through eth0iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE# Port Forwardingiptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.100.2:22# Firewall Rules# Loopback - Allow unlimited trafficiptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT# SYN-Flooding Protection#iptables -N syn-flood#iptables -A INPUT -i eth0 -p tcp --syn -j syn-flood#iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN#iptables -A syn-flood -j DROP# Make sure that new TCP connections are SYN packetsiptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP# Fragments : Don't trust the little buggers. Send 'em to hell.iptables -A INPUT -i eth0 -f -j LOG --log-level debug --log-prefix "IPTABLES FRAGMENTS: "iptables -A INPUT -i eth0 -f -j DROP# Refuse spoofed packets# Broadcast Ipsiptables -A INPUT -i eth0 -d 0.0.0.0/8 -j DROPiptables -A INPUT -i eth0 -d 255.255.255.255 -j DROP# Loopback Ipiptables -A INPUT -i eth0 -d 127.0.0.0/8 -j DROP# Multicast Ipsiptables -A INPUT -i eth0 -d 224.0.0.0/4 -j DROPiptables -A INPUT -i eth0 -d 240.0.0.0/5 -j DROP# Reserved by IANAiptables -A INPUT -i eth0 -d 169.254.0.0/16 -j DROPiptables -A INPUT -i eth0 -d 192.0.34.0/24 -j DROPiptables -A INPUT -i eth0 -d 192.0.0.0/24 -j DROP# RFC 1918iptables -A INPUT -i eth0 -d 10.0.0.0/8 -j DROPiptables -A INPUT -i eth0 -d 172.16.0.0/12 -j DROPiptables -A INPUT -i eth0 -d 192.168.0.0/16 -j DROP# Allow BootP/DHCP UDP requestsiptables -A INPUT -i eth0 -p udp -d 0/0 --dport 67:68 -j ACCEPT# DNS# Allow UDP packets in for DNS client from nameserversiptables -A INPUT -i eth0 -p udp -s 0/0 --sport 53 -m state --state ESTABLISHED -j ACCEPTiptables -A INPUT -i eth0 -p udp -d 0/0 --dport 53 -j ACCEPT# SSH # allow all sshd incoming connections (including the port fw)iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 22 -j ACCEPTiptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 2222 -j ACCEPT# HTTP# allow all http/https incoming/return connectionsiptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 80 -j ACCEPTiptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 443 -j ACCEPT# FTP# allow all ftpd incoming connectionsiptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 21 -j ACCEPT# Enable active ftp transfers iptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT# Enable passive ftp transfersiptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT# Enable ident probes (IRC)iptables -t filter -A INPUT -i eth0 -p tcp -d 0/0 --dport 113 -j ACCEPT# Allow ICMP in if it is related to other connectionsiptables -A INPUT -i eth0 -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT# Allow bot traffic throughiptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 8676 -j ACCEPT# Enable dcciptables -A INPUT -i eth0 -p tcp -m state --state RELATED -j ACCEPT # Drop UDPiptables -A INPUT -i eth0 -p udp -j DROP# Drop ICMPiptables -A INPUT -i eth0 -p icmp -j DROP# Drop Windows NetBIOS noiseiptables -A INPUT -i eth0 -p tcp -s 0/0 --sport 137:139 -j DROP# Drop IGMP noiseiptables -A INPUT -i eth0 -p 2 -j DROP# Drop TCPiptables -A INPUT -i eth0 -p tcp -j DROP# Drop Anything else not allowediptables -A INPUT -i eth0 -j DROP#EOF