rendered paste body#!/bin/bash
# IPTABLES FIREWALL script for the Linux 2.6 Kernel
# by wireddd
# How much detail do you want in the log?
# 0 - errors only
# 9 - everything
LogLevel=9
# log file for the script to place error/status messages
ScriptLogFile="/var/log/firewall_test.log"
# location of various binaries
IPTABLES=/sbin/iptables
LSMOD=/sbin/lsmod
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprobe
GREP=/bin/grep
AWK=/usr/bin/awk
SED=/bin/sed
IFCONFIG=/sbin/ifconfig
DATE=/bin/date
PS=/bin/ps
# Internal Network Interface
INTIF="eth0"
# External Network Interface
EXTIF="eth1"
# how to display the date in the logfile
dateformat="+%Y.%m.%d_%T"
# Internal Network
INTNET="192.168.10.0/24"
# Internal Interface IP address
INTIP="`/sbin/ifconfig $INTIF | $GREP 'inet addr' | $AWK '{print $2}' | $SED -e 's/.*://'`"
# external interface and IP
EXTIP="`/sbin/ifconfig $EXTIF | $GREP 'inet addr' | $AWK '{print $2}' | $SED -e 's/.*://'`"
UNIVERSE="0.0.0.0/0"
arrBlockedIPs+=("222.62.149.99")
arrBlockedIPs+=("63.86.79.37")
arrBlockedIPs+=("218.5.4.236")
arrBlockedIPs+=("218.1.74.179")
arrBlockedIPs+=("150.140.140.91")
arrBlockedIPs+=("62.75.221.159")
arrBlockedIPs+=("61.157.58.251")
arrBlockedExtIPPorts+=("788")
arrBlockedExtIPPorts+=("847")
arrBlockedExtIPPorts+=("2049")
arrBlockedExtIPPorts+=("111")
arrBlockedExtIPPorts+=("80")
arrBlockedExtIPPorts+=("445")
arrBlockedVpnPorts+=("21")
arrBlockedVpnPorts+=("80")
arrBlockedVpnPorts+=("445")
arrBlockedVpnPorts+=("135")
arrBlockedVpnPorts+=("137")
arrBlockedVpnPorts+=("138")
arrBlockedVpnPorts+=("139")
arrBlockedVpnPorts+=("2049")
arrPortsToForward+=("192.168.10.38 tcp 7878")
# array of kernel modules to load
KernelModules+=("ip_tables")
KernelModules+=("ip_conntrack")
KernelModules+=("ip_conntrack_ftp")
KernelModules+=("ip_conntrack_irc")
KernelModules+=("iptable_nat")
KernelModules+=("ip_nat_ftp")
KernelModules+=("ip_nat_irc")
addtolog ()
{
if [ -z $2 ] || [ $2 -le $LogLevel ]
then
echo "`$DATE $dateformat`: firewall script: $1" >> $ScriptLogFile
fi
}
loadKernelModules ()
{
addtolog "Loading Kernel Modules" 2
# probe all modules
/sbin/depmod -a
if [ $? -ne 0 ]
then
addtolog "Command Failed: /sbin/depmod -a"
exit 1
fi
for ModuleToLoad in "${KernelModules[@]}"
do
if [ -z "` $LSMOD | $GREP $ModuleToLoad | $AWK {'print $1'} `" ]
then
if [ -z "`$MODPROBE -l $ModuleToLoad`" ]
then
addtolog "FATAL ERROR: Module Not Found: $ModuleToLoad"
exit 1
fi
$MODPROBE -q $ModuleToLoad
if [ $? -ne 0 ]
then
addtolog "FATAL ERROR: Module Failed To Load: $ModuleToLoad"
exit 1
fi
fi
done
}
enableIpForwarding ()
{
addtolog "Enabling IP forwarding" 2
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
}
buildIpTablesRules ()
{
addtolog "Building iptables Rules" 2
# Clear any existing rules and setting default policy to DROP
arrIpTablesArg+=("-P INPUT DROP")
arrIpTablesArg+=("-P OUTPUT DROP")
arrIpTablesArg+=("-P FORWARD DROP")
arrIpTablesArg+=("-F INPUT ")
arrIpTablesArg+=("-F OUTPUT ")
arrIpTablesArg+=("-F FORWARD ")
arrIpTablesArg+=("-F -t nat")
# Flush the user chain.. if it exists
if [ "`iptables -L | $GREP drop-and-log-it`" ]; then
arrIpTablesArg+=("-F drop-and-log-it")
fi
# Delete all User-specified chains
arrIpTablesArg+=("-X")
# Reset all IPTABLES counters
arrIpTablesArg+=("-Z")
# Creating a DROP chain
arrIpTablesArg+=("-N drop-and-log-it")
arrIpTablesArg+=("-A drop-and-log-it -j LOG --log-level info ")
arrIpTablesArg+=("-A drop-and-log-it -j REJECT")
addtolog "Building iptables Rules: INPUT rulesets" 4
######### INPUT CHAIN ############
# add rules to block ip addresses from array
for BlockedIP in "${arrBlockedIPs[@]}"
do
arrIpTablesArg+=(" -A INPUT -s $BlockedIP -j drop-and-log-it")
done
# add rules to block Incoming connections to ports on the EXternal Ip address
for BlockedExtIPPort in "${arrBlockedExtIPPorts[@]}"
do
arrIpTablesArg+=("-A INPUT -d $EXTIP -p TCP --dport $BlockedExtIPPort -j drop-and-log-it")
done
# loopback interfaces are valid.
arrIpTablesArg+=("-A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT")
##-----------------------------------------------------------------
#iptables -A INPUT -i eth0 -s 192.168.10.121 -j drop-and-log-it
# build rules for blocking vpn ports
for BlockedPort in "${arrBlockedVpnPorts[@]}"
do
arrIpTablesArg+=("-A INPUT -i tun+ -p TCP --dport $BlockedPort -j REJECT")
done
arrIpTablesArg+=("-A INPUT -i tun+ -d 192.168.10.38 -j ACCEPT")
#iptables -A FORWARD -i tun+ -j ACCEPT
# local interface, local machines, going anywhere is valid
arrIpTablesArg+=("-A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT")
# remote interface, claiming to be local machines, IP spoofing, get lost
arrIpTablesArg+=("-A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it")
# remote interface, any source, going to permanent PPP address is valid
arrIpTablesArg+=("-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -j ACCEPT")
# Allow any related traffic coming back to the MASQ server in
arrIpTablesArg+=("-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT")
# OPTIONAL: Uncomment the following two commands if plan on running
# an Apache Web site on the firewall server itself
#
#echo -e " - Allowing EXTERNAL access to the WWW server"
#iptables -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT
#iptables -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -s $UNIVERSE -d 192.168.10.12 -p tcp --dport 80 -j ACCEPT
arrIpTablesArg+=("-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT")
arrIpTablesArg+=("-A INPUT -m state --state NEW -i ! $EXTIF -j ACCEPT")
arrIpTablesArg+=("-A INPUT -i $EXTIF -d 255.255.255.255 -p udp --dport 68 -j ACCEPT")
# Catch all rule, all other incoming is denied and logged.
arrIpTablesArg+=("-A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it")
addtolog "Building iptables Rules: OUTPUT rulesets" 4
########## OUTPUT CHAIN ###############
# loopback interface is valid.
arrIpTablesArg+=("-A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT")
arrIpTablesArg+=("-A OUTPUT -o tun+ -s 192.168.10.38 -j ACCEPT")
# local interfaces, any source going to local net is valid
arrIpTablesArg+=("-A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT")
# local interface, any source going to local net is valid
arrIpTablesArg+=("-A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT")
# outgoing to local net on remote interface, stuffed routing, deny
arrIpTablesArg+=("-A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it")
# anything else outgoing on remote interface is valid
arrIpTablesArg+=("-A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT")
# Catch all rule, all other outgoing is denied and logged.
arrIpTablesArg+=("-A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it")
addtolog "Building iptables Rules: FORWARD rulesets" 4
############# FORWARD CHAIN ##############
# build rules for port forwarding
for PortToForward in "${arrPortsToForward[@]}";
do
read host proto port <<< "$PortToForward"
arrIpTablesArg+=("-A FORWARD -i $EXTIF -o $INTIF -m state --state NEW,ESTABLISHED,RELATED -s $UNIVERSE -d $host -p $proto --dport $port -j ACCEPT")
done
for PortToForward in "${arrPortsToForward[@]}";
do
read host proto port <<< "$PortToForward"
arrIpTablesArg+=("-t nat -A PREROUTING -p $proto --dport $port -i $EXTIF -j DNAT --to $host")
done
# forwarding rules for vpn route
arrIpTablesArg+=("-A FORWARD -i tun+ -o $INTIF -j ACCEPT")
arrIpTablesArg+=("-A FORWARD -i $INTIF -o tun+ -j ACCEPT")
arrIpTablesArg+=("-A FORWARD -i tun+ -o $EXTIF -j drop-and-log-it")
arrIpTablesArg+=("-A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT")
arrIpTablesArg+=("-A FORWARD -i $INTIF -o $EXTIF -j ACCEPT")
# Catch all rule, all other forwarding is denied and logged.
arrIpTablesArg+=("-A FORWARD -j drop-and-log-it")
# Enable SNAT (MASQUERADE) functionality on $EXTIF
arrIpTablesArg+=("-t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP")
#limit upload speed
#iptables -t mangle -A FORWARD -s 192.168.10.0/24 -j MARK --set-mark 3
#iptables -t mangle -A FORWARD -s $EXTIP -j MARK --set-mark 3
#limit download speed
#iptables -t mangle -A FORWARD -s ! 192.168.10.0/24 -d 192.168.1.0/24 -j MARK --set-mark 4
#iptables -t mangle -A FORWARD -s ! 192.168.10.0/24 -d $EXTIP -j MARK --set-mark 4
addtolog "Building iptables Rules: Complete" 3
}
loadIpTablesRules ()
{
addtolog "Loading iptables rules" 2
for IpTablesArg in "${arrIpTablesArg[@]}"
do
$IPTABLES $IpTablesArg
if [ $? -ne 0 ]
then
addtolog "Command Failed: $IPTABLES $IpTablesArg"
exit 1
fi
done
addtolog "Loading iptables Rules: Complete" 3
}
loadNoip2 ()
{
if [ ! "`$PS aux | $GREP noip2 | $GREP -v grep`" ]
then
/usr/local/bin/noip2
if [ $? -ne 0 ]
then
addtolog "Failed to load noip2"
else
addtolog "noip2 Loaded" 2
fi
else
addtolog "noip2 is allready running" 4
fi
}
#------- INIT --------
addtolog "Running" 1
buildIpTablesRules
loadKernelModules
enableIpForwarding
loadIpTablesRules
loadNoip2
addtolog "Complete" 1
exit 0