Someone

#!/bin/sh

#########################
# configuration options #
#########################

INET_IP1="201.12.35.51"
INET_IP3="201.12.35.54"
INET_BROADCAST="201.12.35.63"
INET_IFACE="eth0"

LAN_IP="192.168.1.1"
LAN_IP_RANGE="192.168.1.0/24"
LAN_IFACE="eth1"

LO_IFACE="lo"
LO_IP="127.0.0.1"

ODIN_INT="192.168.1.134" 
ODIN_EXT="201.12.35.52"

SAINT_INT="192.168.1.53"
SAINT_EXT="201.12.35.54"
SAINT_RANGE="200.230.207.0/24"

SICREDI_EXT_IP="201.77.95.20"
SICREDI_RANGE="172.16.0.0/12"

IPT=`which iptables`
MODPROBE=`which modprobe`

LOG="-m limit --limit 1/m -j LOG --log-level debug --log-prefix"

################
# load modules #
################

$MODPROBE ip_conntrack_ftp
$MODPROBE ip_conntrack_irc

#######################
# /proc configuration #
#######################

echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "1800" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "60" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range

################
# set policies #
################

$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

#########
# flush #
#########

$IPT -F
$IPT -F -t nat
$IPT -F -t mangle

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle

#################
# create chains #
#################

$IPT -N allowed_packets
$IPT -N denied_packets

$IPT -N tcp_packets
$IPT -N udp_packets
$IPT -N icmp_packets

########################
# chain denied_packets #
########################

# Log/Limit
$IPT -A denied_packets_packets -p tcp ! --syn -m state --state NEW $LOG "New not SYN:"
$IPT -A denied_packets -p tcp --tcp-flags ALL FIN,URG,PSH $LOG "Stealth XMAS scan: "
$IPT -A denied_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG $LOG "Stealth XMAS-PSH scan: "
$IPT -A denied_packets -p tcp --tcp-flags ALL ALL $LOG "Stealth XMAS-ALL scan: "
$IPT -A denied_packets -p tcp --tcp-flags ALL FIN $LOG "Stealth FIN scan: "
$IPT -A denied_packets -p tcp --tcp-flags SYN,RST SYN,RST $LOG "Stealth SYN/RST scan: "
$IPT -A denied_packets -p tcp --tcp-flags SYN,FIN SYN,FIN $LOG "Stealth SYN/FIN scan(?): "
$IPT -A denied_packets -p tcp --tcp-flags ALL NONE $LOG "Stealth Null scan: "
$IPT -A denied_packets -p tcp --tcp-option 64 $LOG "Bad TCP flag(64): "
$IPT -A denied_packets -p tcp --tcp-option 128 $LOG "Bad TCP flag(128): "
$IPT -A denied_packets -p tcp -m state --state INVALID $LOG "INVALID TCP: "
$IPT -A denied_packets -p tcp -m state --state INVALID $LOG "INVALID UDP: "
$IPT -A denied_packets -p icmp --icmp-type echo-request -m state --state INVALID $LOG "INVALID ICMP-request: "
$IPT -A denied_packets -p icmp ! --icmp-type echo-request -m state --state INVALID $LOG "INVALID ICMP-other: "
$IPT -A denied_packets -f $LOG "Fragmented packet: "

# Drop.
$IPT -A denied_packets -f -j DROP
$IPT -A denied_packets -m state --state INVALID -j DROP
$IPT -A denied_packets -p tcp ! --syn -m state --state NEW -j DROP
$IPT -A denied_packets -p tcp --tcp-option 64 -j DROP
$IPT -A denied_packets -p tcp --tcp-option 128 -j DROP 
$IPT -A denied_packets -p tcp --tcp-flags ALL NONE -j DROP
$IPT -A denied_packets -p tcp --tcp-flags ALL ALL -j DROP
$IPT -A denied_packets -p tcp --tcp-flags ALL FIN -j DROP
$IPT -A denied_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPT -A denied_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPT -A denied_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPT -A denied_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
$IPT -A denied_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j DROP

#########################
# chain allowed_packets #
#########################

$IPT -A allowed -p tcp --syn -j ACCEPT
$IPT -A allowed -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A allowed -p tcp -j DROP

#####################
# chain tcp_packets #
#####################

# accept ftp and passive ftp.
$IPT -A tcp_packets -p tcp --dport 21 -j allowed_packets
$IPT -A tcp_packets -p tcp --sport 1024: --dport 1024: -j allowed_packets

# accept pptp and gre protocol.
$IPT -A tcp_packets -p tcp --dport 1723 -j allowed_packets
$IPT -A tcp_packets -p 47 -j allowed_packets

#####################
# chain udp_packets #
#####################

# accept dns.
$IPT -A udp_packets -p udp --destination-port 53 -j ACCEPT

# accept dhcp.
$IPT -A udp_packets -p udp -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT

# block fucking microsoft boxes requests.
$IPT -A udp_packets -p udp -i $INET_IFACE -d $INET_BROADCAST --destination-port 135:139 -j DROP

# block dhcp broadcast too.
$IPT -A udp_packets -p udp -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP

######################
# chain icmp_packets #
######################

$IPT -A icmp_packets -p icmp --icmp-type 8 -j ACCEPT
$IPT -A icmp_packets -p icmp --icmp-type 11 -j ACCEPT

#####################
# Mangle PREROUTING #
#####################

$IPT -t mangle -A PREROUTING -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A PREROUTING -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A PREROUTING -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A PREROUTING -p tcp --dport 25 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A PREROUTING -p udp --dport 53 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A PREROUTING -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A PREROUTING -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A PREROUTING -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput

##################
# NAT PREROUTING #
##################

# squid redirect.
$IPT -t nat -A PREROUTING -i $LAN_IFACE -p tcp --dport 80 -j REDIRECT --to-port 3128

# redirect ftp to odin.
$IPT -t nat -A PREROUTING -d $ODIN_EXT -p tcp --dport 21 -j DNAT --to $ODIN_EXT

# redirect http to odin.
$IPT -t nat -A PREROUTING -d $ODIN_EXT -p tcp --dport 80 -j DNAT --to $ODIN_EXT

###############
# INPUT chain #
###############

# we don't want bad packets.
$IPT -A INPUT -p tcp -j denied_packets

# special rules not for internet.
$IPT -A INPUT -p all -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPT -A INPUT -p all -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPT -A INPUT -p all -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPT -A INPUT -p all -i $LO_IFACE -s $INET_IFACE -j ACCEPT

# accept incoming packets from the internet.
$IPT -A INPUT -p all -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp -i $INET_IFACE -j tcp_packets
$IPT -A INPUT -p udp -i $INET_IFACE -j udp_packets
$IPT -A INPUT -p icmp -i $INET_IFACE -j icmp_packets

# accept esp/ike protocols for IPSEC.
$IPT -A INPUT  -p udp -i $INET_IFACE -d $INET_IP3 -s $SICREDI_EXT_IP --sport 500 --dport 500 -j ACCEPT
$IPT -A INPUT  -p 50 -i $INET_IFACE -d $INET_IP3 -s $SICREDI_EXT_IP -j ACCEPT

# stop multicasts from microsoft.
$IPT -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP

# log all other packets.
$IPT -A INPUT $LOG "INPUT blocked: "

#################
# FORWARD chain #
#################

# we don't want bad packets.
$IPT -A FORWARD -p tcp -j denied_packets

# set mss.
$IPT -A FORWARD -o $INET_IFACE -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# accept packets we actually want to forward.
$IPT -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# forward IPSEC.
$IPT -A FORWARD -i $INET_IFACE -o ipsec+ -j ACCEPT
$IPT -A FORWARD -i ipsec+ -o $INET_IFACE -j ACCEPT

# log all other packets.
$IPT -A FORWARD $LOG "FORWARD blocked: "

#################
# Mangle OUTPUT #
#################

$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 25 -j TOS --set-tos Minimize-Delay
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p udp --dport 53 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput
$IPT -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport 6000:6063 -j TOS --set-tos Maximize-Throughput

################
# OUTPUT chain #
################

# we don't want bad packets.
$IPT -A OUTPUT -p tcp -j denied_packets

# set mss.
$IPT -A OUTPUT -o $INET_IFACE -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# accept all output packets.
$IPT -A OUTPUT -p all -s $LO_IP -j ACCEPT
$IPT -A OUTPUT -p all -s $LAN_IP -j ACCEPT
$IPT -A OUTPUT -p all -s $INET_IFACE -j ACCEPT

# log all other packets.
$IPT -A OUTPUT $LOG "OUTPUT blocked: "

###################
# NAT POSTROUTING #
###################

# set mss.
$IPT -t nat -A POSTROUTING -o $INET_IFACE -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# do NAT.
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP1