rendered paste body#!/bin/bash#--------------------------------# IPTABLES configuration script# by dedicated and YD # based on Gentoo iptables script#--------------------------------# Version 2.1.3-alone Beta (non-router version)#--------------------------------# Copyright (c) 2005 Andrey Galkin# You may use and redistribute this script under the terms of GNU General Public License version 2 or above.#--------------------------------# ChangeLog:# 2.1# ADDED: LOCAL_TCP_PORTS & LOCAL_UDP_PORTS# 2.1.2# FIXED: tcp protocol in LOCAL_TCP_PORTS# 2.1.3# ADDED: Counter-Strike exploit fix#--------------------------------#---------------------# script config#---------------------IPT="/sbin/iptables" #for using#IPT="echo /sbin/iptables" # uncomment for debuggingID="/usr/bin/id"SG="/usr/bin/sg"OF="eth+"ICMPFREQ="4/sec"ADMIN_IP="80.233.210.4" #space-separated list of admin ip addresses or nothing to allow any ipUDP_GAME_PORTS="27000:27060" #space-separated list of game ports (or START_RANGE_PORT:STOP_RAGE_PORT)TCP_EXTRA_PORTS="8000 8001" #same as above for additional tcp ports with maximum 2 connections per IPUSER_NET_ACCESS="" #space-separated list of users who allowed to make output connectionsGROUP_NET_ACCESS="" #space-separated list of groups who allowed to make output connectionsLOCAL_UDP_PORTS="" #space-separeted list of udp ports for local connectionsLOCAL_TCP_PORTS="" #space-separeted list of tcp ports for local connections#---------------------# auto-config#---------------------${IPT} -t filter -A INPUT -m connlimit ! --connlimit-above 1 -j ACCEPT > /dev/null 2>&1if [ $? -eq 0 ];then alias ipt-connlimit="echo -n \"-m connlimit ! --connlimit-above $1\""else echo "!!! No connlimit support, disabling !!!" alias ipt-connlimit="echo > /dev/null"fialias getuid="${ID} -u $1"#---------------------# Flushing all tables#---------------------echo "Flashing Tables..."${IPT} -t filter -F${IPT} -t filter -X${IPT} -t nat -F${IPT} -t nat -X#---------------------# Setting default actions#---------------------echo "Setting default built-in chain rules..."${IPT} -t filter -P FORWARD DROP${IPT} -t filter -P INPUT DROP${IPT} -t filter -P OUTPUT DROP#---------------------# WORLD allowed input#---------------------echo "Adding \"world-input\" chain..."${IPT} -t filter -N world-input${IPT} -t filter -F world-input#---------------------# EXPLOIT FIX#---------------------echo "Adding \"Counter-Strike exploit fix\" chain..."${IPT} -t filter -N exploit-fix${IPT} -t filter -F exploit-fix${IPT} -A exploit-fix -m string --algo kmp --string "\\prot\\4\\unique\\0\\raw\\valve" -j DROP${IPT} -A exploit-fix -m string --algo kmp --string "(..)" -j DROP#${IPT} -A exploit-fix -j ACCPET#UDP game portsfor PORT in $UDP_GAME_PORTS;do ${IPT} -t filter -A world-input -p udp --dport ${PORT} -j exploit-fixdone#FTP${IPT} -t filter -A world-input -p tcp --dport ftp `ipt-connlimit 2` -j ACCEPT#SSHif [[ -z $ADMIN_IP ]];then echo "! Anyone can connect to the sshd !" ${IPT} -t filter -A world-input -p tcp --dport ssh -j ACCEPTelse for IP in $ADMIN_IP; do ${IPT} -t filter -A world-input -p tcp -s ${IP} --dport ssh -j ACCEPT donefi#WWW${IPT} -t filter -A world-input -p tcp --dport http `ipt-connlimit 4` -j ACCEPT#MAIL#${IPT} -t filter -A world-input -p tcp --dport pop3 `ipt-connlimit 2` -j ACCEPT${IPT} -t filter -A world-input -p tcp --dport imap `ipt-connlimit 2` -j ACCEPT${IPT} -t filter -A world-input -p tcp --dport smtp `ipt-connlimit 2` -j ACCEPT#DNS${IPT} -t filter -A world-input -p udp --dport domain -j ACCEPT${IPT} -t filter -A world-input -p tcp --dport domain `ipt-connlimit 2` -j ACCEPT#extra tcp portsfor PORT in $TCP_EXTRA_PORTS;do ${IPT} -t filter -A world-input -p tcp --dport ${PORT} `ipt-connlimit 2` -j ACCEPTdone#---------------------# LOCAL allowed input#---------------------echo "Adding \"local-input\" chain..."${IPT} -t filter -N local-input${IPT} -t filter -F local-inputif [[ -n $LOCAL_UDP_PORTS ]];then for PORT in $LOCAL_UDP_PORTS; do ${IPT} -t filter -A local-input -p udp --dport ${PORT} -j ACCEPT donefiif [[ -n $LOCAL_TCP_PORTS ]];then for PORT in $LOCAL_TCP_PORTS; do ${IPT} -t filter -A local-input -p tcp --dport ${PORT} -j ACCEPT donefi#---------------------# WORLD allowed output#---------------------echo "Adding \"world-output\" chain..."${IPT} -t filter -N world-output${IPT} -t filter -F world-output${IPT} -t filter -A world-output -p udp --dport domain -j ACCEPT${IPT} -t filter -A world-output -p tcp --dport domain -j ACCEPT#---------------------# USER NET ACCESS#---------------------echo "Adding \"user-net-access\" chain..."${IPT} -t filter -N user-net-access${IPT} -t filter -F user-net-accessif [[ -z $USER_NET_ACCESS ]];then echo "! Every user can make output connections !" ${IPT} -t filter -A user-net-access -j ACCEPTelse for U in $USER_NET_ACCESS; do ${IPT} -t filter -A user-net-access -m owner --uid-owner `getuid ${U}` -j ACCEPT donefifor G in $GROUP_NET_ACCESS;do ${IPT} -t filter -A user-net-access -m owner --gid-owner `${SG} - $G -c "${ID} -g"` -j ACCEPTdone#---------------------# ICMP ALLOWED#---------------------echo "Adding \"icmp-allowed\" chain..."${IPT} -t filter -N icmp_allowed${IPT} -t filter -F icmp_allowed${IPT} -t filter -A icmp_allowed -p icmp --icmp-type echo-reply -m limit --limit ${ICMPFREQ} -j ACCEPT${IPT} -t filter -A icmp_allowed -p icmp --icmp-type echo-request -m limit --limit ${ICMPFREQ} -j ACCEPT${IPT} -t filter -A icmp_allowed -p icmp --icmp-type time-exceeded -m limit --limit ${ICMPFREQ} -j ACCEPT${IPT} -t filter -A icmp_allowed -p icmp --icmp-type destination-unreachable -m limit --limit ${ICMPFREQ} -j ACCEPT${IPT} -t filter -A icmp_allowed -p icmp -j DROP#---------------------# Flags checking (from gentoo iptables guide)#---------------------echo "Adding \"check-tcp-flags\" chain..."${IPT} -t filter -N check-tcp-flags${IPT} -t filter -F check-tcp-flags${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \ --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL ALL -m limit --limit \ 5/minute -j LOG --log-level 1 --log-prefix "XMAS:"${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL ALL -j DROP${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \ -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL NONE -m limit \ --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL NONE -j DROP${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit \ --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \ --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP#---------------------# INPUT CHAIN#---------------------echo "Adding \"INPUT\" chain..."${IPT} -t filter -A INPUT -m state --state INVALID -j DROP${IPT} -t filter -A INPUT -p tcp -j check-tcp-flags${IPT} -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT${IPT} -t filter -A INPUT -i lo -j local-input${IPT} -t filter -A INPUT -j icmp_allowed${IPT} -t filter -A INPUT -i ${OF} -j world-input#---------------------# OUTPUT CHAIN#---------------------echo "Adding \"OUTPUT\" chain..."${IPT} -t filter -A OUTPUT -m state --state INVALID -j DROP${IPT} -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT${IPT} -t filter -A OUTPUT -j user-net-access${IPT} -t filter -A OUTPUT -o lo -d 127.0.0.0/8 -j ACCEPT${IPT} -t filter -A OUTPUT -o ${OF} -j world-output#--------------------# after config#--------------------unalias ipt-connlimitunalias getuid