#! /sbin/runscriptdepend() { before net}start() { ebegin "Starting firewall" modprobe ip_conntrack_ftp # reset all tables iptables -t filter -F iptables -t nat -F # delete all user chains iptables -t filter -X iptables -t nat -X # drop all packets by default iptables -t filter -P INPUT DROP iptables -t filter -P FORWARD DROP iptables -t filter -P OUTPUT DROP # create needed user-chains iptables -N drop_bad_packets # create a chain, that filters all bad packets: # drop all tcp-packets, that are not established and don't request a # new connection and drop every "unclean" package iptables -A drop_bad_packets -p tcp ! --syn -m state \ --state NEW -j DROP iptables -A drop_bad_packets -m state --state INVALID -j DROP # do not accept, send or forward illegal packets iptables -A INPUT -j drop_bad_packets iptables -A OUTPUT -j drop_bad_packets iptables -A FORWARD -j drop_bad_packets # drop all packets that are comming from/going to 127.0.0.1 and # are not going through loopback device iptables -A INPUT -i ! lo -s 127.0.0.1 -j DROP iptables -A INPUT -i ! lo -d 127.0.0.1 -j DROP iptables -A OUTPUT -o ! lo -s 127.0.0.1 -j DROP iptables -A OUTPUT -o ! lo -d 127.0.0.1 -j DROP # allow masqueraded forwarding for eth0 device for i in $MASQUERADINGDEVICES ; do iptables -t nat -A POSTROUTING -o "$i" -j MASQUERADE done # allow forwarding connections for i in $FORWARDINGDEVICES ; do src="`echo $i | awk -F: '{ print $1 }'`" dest="`echo $i | awk -F: '{ print $2 }'`" if [ -z "$src" ] || [ -z "$dest" ] ; then ewarn "wrong FORWARDINGDEVICES entry (ignored): '$i'" continue fi iptables -A FORWARD -i "$src" -o "$dest" -j ACCEPT iptables -A FORWARD -i "$dest" -o "$src" -m state \ --state ESTABLISHED,RELATED -j ACCEPT done # allow all connections that are comming from or going to the # loopback device and are from local host (other hosts wont be # able to write to our loopback device) iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT for i in $NETDEVICES ; do # allow incoming data for established or related connections iptables -A INPUT -i "$i" -m state \ --state ESTABLISHED,RELATED -j ACCEPT # allow incoming ping requests iptables -A INPUT -i "$i" -m state \ --state NEW --protocol icmp \ --icmp-type 8 -j ACCEPT # allow all outging data iptables -A OUTPUT -o "$i" -j ACCEPT done # allow all traffic from FULLACCESSIPS for i in $FULLACCESSIPS ; do device="`echo $i | awk -F: '{ print $1 }'`" ip="`echo $i | awk -F: '{ print $2 }'`" if [ -z "$ip" ] || [ -z "$device" ] ; then ewarn "wrong FULLACCESSIPS entry (ignored): '$i'" continue fi iptables -A INPUT -i "$device" -m state \ --state NEW \ --source "$ip" -j ACCEPT done # allow incomming connections to tcp ports for i in $INCOMINGPORTS ; do device="`echo $i | awk -F: '{ print $1 }'`" proto="`echo $i | awk -F: '{ print $2 }'`" ports="`echo $i | awk -F: '{ print $3 }'`" if [ -z "$device" ] || [ -z "$ports" ] || [ -z "$proto" ]; then ewarn "wrong INCOMINGPORTS entry (ignored): '$i'" continue fi iptables -A INPUT -i "$device" -m state -m multiport \ --state NEW --protocol "$proto" \ --dport "$ports" -j ACCEPT done # reject all other incoming data instead of just dropping them iptables -A INPUT -j REJECT echo 0 >/proc/sys/net/ipv4/tcp_ecn echo 1 >/proc/sys/net/ipv4/tcp_syncookies for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 >"$f" done # activate IP-Forwarding echo 1 >/proc/sys/net/ipv4/ip_dynaddr echo 1 >/proc/sys/net/ipv4/ip_forward eend 0}stop() { echo 0 >/proc/sys/net/ipv4/tcp_ecn echo 0 >/proc/sys/net/ipv4/tcp_syncookies echo 0 >/proc/sys/net/ipv4/ip_forward echo 0 >/proc/sys/net/ipv4/ip_dynaddr for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 >"$f" done ebegin "Stopping firewall" for a in `cat /proc/net/ip_tables_names`; do /sbin/iptables -F -t "$a" /sbin/iptables -X -t "$a" if [ "$a" == nat ]; then /sbin/iptables -t nat -P PREROUTING ACCEPT /sbin/iptables -t nat -P POSTROUTING ACCEPT /sbin/iptables -t nat -P OUTPUT ACCEPT elif [ "$a" == mangle ]; then /sbin/iptables -t mangle -P PREROUTING ACCEPT /sbin/iptables -t mangle -P INPUT ACCEPT /sbin/iptables -t mangle -P FORWARD ACCEPT /sbin/iptables -t mangle -P OUTPUT ACCEPT /sbin/iptables -t mangle -P POSTROUTING ACCEPT elif [ "$a" == filter ]; then /sbin/iptables -t filter -P INPUT ACCEPT /sbin/iptables -t filter -P FORWARD ACCEPT /sbin/iptables -t filter -P OUTPUT ACCEPT fi done eend $?}