/etc/init.d# cat firewall
#!/bin/bash
###############################################################
################## Iptables Firewall #####################
###############################################################
#---------------------------------------------------------------
# Loading moduls
#---------------------------------------------------------------
# modprobe iptable_nat // in this case we don't use NAT table
# modprobe ip_nat_ftp
modprobe ip_conntrack
modprobe ip_conntrack_ftp
#---------------------------------------------------------------
# Initialize all the chains by removing all rules
#---------------------------------------------------------------
iptables -F
#---------------------------------------------------------------
# Drop all packets
#---------------------------------------------------------------
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP
#---------------------------------------------------------------
# The loopback interface should accept all traffic
# Necessary for X-Windows and other socket based services
#---------------------------------------------------------------
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#---------------------------------------------------------------
# The local interface should accept all traffic
# Necessary for MS-SQL comunication // This one is for the case
# if SQL server is runnion on another computer connected to eth1
#---------------------------------------------------------------
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT
#---------------------------------------------------------------
# Open outgoing for yum // This one is for Red Hat based Linux
# packages installer, but in this case it allows outgoing traffic
#---------------------------------------------------------------
iptables -A OUTPUT -o eth0 -j ACCEPT
###############################################################
################## Firewall Rules Section #####################
###############################################################
#---------------------------------------------------------------
# Allow port 21 (FTP) connections to the firewall
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
#---------------------------------------------------------------
# Allow port 22 (SSH) connections to the firewall
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
#---------------------------------------------------------------
# Allow port 25 (SMTP) connections to the firewall
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 25 -j ACCEPT
#---------------------------------------------------------------
# Allow port 53 (DNS) connections to the firewall
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --dport 53 -j ACCEPT
#---------------------------------------------------------------
# Allow port 80 (HTTP) connections to the firewall
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
#---------------------------------------------------------------
# Allow port 110 (POP3) connections to the firewall
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 110 -j ACCEPT
#---------------------------------------------------------------
# Allow port 995 (POP3s) connections to the firewall
#---------------------------------------------------------------
# iptables -A INPUT -p tcp -i eth0 --dport 995 -j ACCEPT // not set yet
#---------------------------------------------------------------
# Allow port 143 (IMAP) connections to the firewall
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 143 -j ACCEPT
#---------------------------------------------------------------
# Allow port 993 (IMAPs) connections to the firewall
#---------------------------------------------------------------
# iptables -A INPUT -p tcp -i eth0 --dport 993 -j ACCEPT // not set yet
#---------------------------------------------------------------
#
# Additional ports
# 111 (tcp,udp)sunrpc, portmapper
# 113 (tcp) ident, aut service
# 119 (tcp) nntp , news server, should be disabled
# 999 (tcp) garcon, for computers comunication
#---------------------------------------------------------------
iptables -A INPUT -p tcp -i eth0 --dport 111 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 111 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 113 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 999 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 119 -j REJECT
iptables -A OUTPUT -p tcp -o eth0 --dport 119 -j REJECT
###############################################################
############ Allow already established connections ###########
###############################################################
#---------------------------------------------------------------
# Allow previously established connections
#---------------------------------------------------------------
iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
###############################################################
############ Fix Linux settings for better security ###########
###############################################################
#---------------------------------------------------------------
# Disable routing triangulation. Respond to queries out
# the same interface, not another. Helps to maintain state
# Also protects against IP spoofing
#---------------------------------------------------------------
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
#---------------------------------------------------------------
# Enable logging of packets with malformed IP addresses
#---------------------------------------------------------------
# echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
#---------------------------------------------------------------
# Disable redirects
#---------------------------------------------------------------
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
#---------------------------------------------------------------
# Disable source routed packets
#---------------------------------------------------------------
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
#---------------------------------------------------------------
# Disable acceptance of ICMP redirects
#---------------------------------------------------------------
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
#---------------------------------------------------------------
# Turn on protection from Denial of Service (DOS) attacks
#---------------------------------------------------------------
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#---------------------------------------------------------------
# Disable responding to ping broadcasts
#---------------------------------------------------------------
# echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#---------------------------------------------------------------
# Enable routing (IP forwarding)
#---------------------------------------------------------------
# echo 1 > /proc/sys/net/ipv4/ip_forward
exit 0