rendered paste body#!/bin/sh
#
export PATH="${PATH}:/sbin:/usr/local/bin"
export ETH1IP=`/sbin/ifconfig eth0 | \
fgrep "inet addr:" | \
awk -F: '{print $2}' | \
awk '{print $1}'`
echo "ETH1 = $ETH1IP"
export ETH0IP=`/sbin/ifconfig eth1 | \
fgrep "inet addr:" | \
awk -F: '{print $2}' | \
awk '{print $1}'`
echo "ETH0 = $ETH0IP"
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
echo " Setting up IP spoofing protection... "
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
fi
#---------------------------------------------------------------------------------------------
echo " loading modules "
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp fxp=1 ports=21,5656,6677,2121,6969,10032
modprobe ip_nat_ftp
#---------------------------------------------------------------------------------------------
echo " Changing default ipv4 options "
echo "56000 60999" >/proc/sys/net/ipv4/ip_local_port_range
echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "0" >/proc/sys/net/ipv4/conf/all/log_martians
echo "1" >/proc/sys/net/ipv4/ip_forward
echo 32768 > /proc/sys/net/ipv4/ip_conntrack_max
#---------------------------------------------------------------------------------------------
iptables -t filter -F
iptables -t nat -F
iptables -t mangle -F
iptables -t filter -X
iptables -t nat -X
iptables -t mangle -X
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -i eth1 -j ACCEPT #internal
#iptables -t filter -A INPUT -i eth0 -j ACCEPT
#---------------------------------------------------------------------------------------------
iptables -t filter -A INPUT -s 84.218.40.17/32 -p tcp --dport 22 -j ACCEPT #bennys
iptables -t filter -A INPUT -s 192.168.0.100 -p tcp --dport 22 -j ACCEPT
#---------------------------------------------------------------------------------------------
#Accept All hosts
#iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 23 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 113 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 2121 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 8324 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 3473 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 7284 -j ACCEPT
# ircd ports for stunnel
iptables -t filter -A INPUT -p tcp --dport 54321 -j ACCEPT
#---------------------------------------------------------------------------------------------
# pasv port range from glftpd.conf
iptables -t filter -A INPUT -p tcp --dport 8324:9000 -j ACCEPT
#---------------------------------------------------------------------------------------------
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#---------------------------------------------------------------------------------------------
#Nating Lan
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -d ! $ETH1IP -j SNAT --to $ETH1IP #Local net
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -d ! $ETH1IP -j SNAT --to $ETH1IP #Local net
#---------------------------------------------------------------------------------------------
#Forwarding ports to icq on lan
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4000 -j DNAT --to 192.168.2.85:4000
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4001 -j DNAT --to 192.168.2.85:4001
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4002 -j DNAT --to 192.168.2.85:4002
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4003 -j DNAT --to 192.168.2.85:4003
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4004 -j DNAT --to 192.168.2.85:4004
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4005 -j DNAT --to 192.168.2.85:4005
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4006 -j DNAT --to 192.168.2.85:4006
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4007 -j DNAT --to 192.168.2.85:4007
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4008 -j DNAT --to 192.168.2.85:4008
#iptables -t nat -A PREROUTING -p tcp -d $ETH1IP --dport 4009 -j DNAT --to 192.168.2.85:4009
#echo " Forwarding ports 4000-4009 to enable icq filetransfer"
#---------------------------------------------------------------------------------------------
# Accept Pings at the rate of one per second.
iptables -t filter -A INPUT -i eth0 -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
#---------------------------------------------------------------------------------------------
# Log all mass ping requests
iptables -t filter -A INPUT -i eth0 -p icmp --icmp-type 8 -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "PING:"
#---------------------------------------------------------------------------------------------
# Accept ICMP Traceroute
iptables -t filter -A INPUT -p icmp -j ACCEPT
#---------------------------------------------------------------------------------------------
echo " fixing NAT Exploit"
iptables -A OUTPUT -m state -p icmp --state INVALID -j DROP
echo " Firewall rules installed "
exit 0