rendered paste body#!/bin/sh
localnet="192.168.1.0/24"
wanif=ppp0
lanif=br0
stop() {
# flush all existing chains in all tables (automagically)
cat /proc/net/ip_tables_names | while read table; do
iptables -t $table -L -n | while read c chain rest; do
if [ "X$c" = "XChain" ] ; then
iptables -t $table -F $chain
fi
done
iptables -t $table -X
done
# delete all fw-rules manually (maybe better?!)
# set default policy
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -I INPUT -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
# disable forwarding
# echo 0 > /proc/sys/net/ipv4/ip_forward
}
start() {
# set default policy
iptables -D INPUT -p tcp --dport 443 -j ACCEPT 2>/dev/null
iptables -D INPUT -p tcp --dport 22 -j ACCEPT 2>/dev/null
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
# load needed modules
MODULE_DIR="/lib/modules/`uname -r`"
MODULES="ipt_conntrack ip_conntrack_ftp ip_nat_ftp ip_conntrack_irc ip_nat_irc ipt_limit ipt_ttl ipt_pkttype ipt_LOG"
for module in $(echo $MODULES); do
if [ -e "${MODULE_DIR}/${module}.o" -o -e "${MODULE_DIR}/${module}.o" ]; then
insmod ${module} >/dev/null 2>/dev/null
fi
done
# enable proc-stuff (but no forward before filters are implemented) #####################################################
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1 > /proc/sys/net/ipv4/tcp_window_scaling
echo 1 > /proc/sys/net/ipv4/tcp_sack
echo 1 > /proc/sys/net/ipv4/tcp_fack
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/tcp_ecn
echo 1 > /proc/sys/net/ipv4/tcp_timestamps
##### anti dos and bullshit rules: ##########################################################
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# on lo everything is allowed
iptables -A INPUT -i lo -j ACCEPT
# Ping echo erlauben, aber max 1/sekundea
iptables -N TOOMUCHPING
# 0/0 is icmp echo-reply
# 8/0 is icmp echo-request
iptables -A INPUT -p icmp --icmp-type 8/0 -m limit --limit 2/second -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8/0 -j TOOMUCHPING
iptables -A TOOMUCHPING -m limit --limit 1/second -j LOG --log-level debug --log-prefix "(TOOMUCHPING):DROP "
iptables -A TOOMUCHPING -j DROP
# traceroute erlauben (traceroute expects REJECTS)
iptables -A INPUT -p udp --dport 1024: -m ttl --ttl-eq 1 -j REJECT --reject-with icmp-port-unreachable
# explicitly REJECT identd lookups, helps connecting to much services faster (e.g. irc-servers)
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
# FORWARDING STUFF ######################################################################################
iptables -t nat -A POSTROUTING -o $wanif -j MASQUERADE
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -i $lanif -o $lanif -j ACCEPT
iptables -A FORWARD -m state --state NEW -i $lanif -o $wanif -j ACCEPT
#### LAN : #############################################################################################
# ALL LAN
# dhcp
iptables -A INPUT -i $lanif -p udp --dport 67 -m state --state NEW -j ACCEPT
# gkrellmd
iptables -A INPUT -i $lanif -p tcp -s $localnet --dport 19150 -m state --state NEW -j ACCEPT
# dns
iptables -A INPUT -i $lanif -p udp -s $localnet --dport 53 -m state --state NEW -j ACCEPT
# ntp
#iptables -A INPUT -i $lanif -p udp -s $localnet --dport 123 -m state --state NEW -j ACCEPT
# snmp
#iptables -A INPUT -i $lanif -p udp -s $localnet --dport 161 -m state --state NEW -j ACCEPT
# 22 -> kaeptnb (ssh)
iptables -t nat -A PREROUTING -i $wanif -p tcp --dport 22 -j DNAT --to 192.168.1.5:22
iptables -A FORWARD -i $wanif -p tcp --dport 22 -j ACCEPT
# 443 von extern -> router (ssh)
iptables -t nat -A PREROUTING -i $wanif -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.1.1:22
# www
iptables -t nat -A PREROUTING -i $wanif -p tcp --dport 80 -j DNAT --to 192.168.1.5:80
iptables -A FORWARD -i $wanif -p tcp --dport 80 -j ACCEPT
# webcam
iptables -t nat -A PREROUTING -i $wanif -p tcp --dport 9192 -j DNAT --to 192.168.1.5:9192
iptables -A FORWARD -i $wanif -p tcp --dport 9192 -j ACCEPT
##### OTHER REACHABLE STUFF ################################################################################
#allow bacula-sd acces from vido.info
#iptables -A INPUT -p tcp -s 217.160.172.151 --dport 9103 -m state --state NEW -j ACCEPT
###### WORLD WIDE SERVICES ###################################################################################
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
###### default policy (verbose) ##############################################################################
iptables -N CATCHALL
iptables -A INPUT -j CATCHALL
iptables -A FORWARD -j CATCHALL
# log everything else which gets dropped, but only 1 logentry/sec max, and no broadcast/multicast stuff (it sucks)
#iptables -A CATCHALL -i ! ppp0 -m limit --limit 1/second -m pkttype --pkt-type unicast -j LOG --log-level debug --log-prefix "(CATCHALL):REJECT "
iptables -A CATCHALL -m limit --limit 1/second -m pkttype --pkt-type unicast -j LOG --log-level debug --log-prefix "(CATCHALL):REJECT "
iptables -A CATCHALL -m limit --limit 2/second -j REJECT
iptables -A CATCHALL -j DROP
echo 1 > /proc/sys/net/ipv4/ip_forward
[ -x /etc/init.d/shaper.sh ] && /etc/init.d/shaper.sh restart 2>/dev/null >/dev/null
}
case "$1" in
autostart)
start
;;
start)
start
;;
stop)
stop
;;
restart)
stop
start
;;
*)
echo $"Usage: $0 {start|stop|stopall|restart}"
exit 1
esac