rendered paste body#!/bin/sh# our subnets:# 10.0.0.0 - us, wired# 10.0.1.0 - other people, wired (TODO: merge)# 10.0.2.0 - wireless# 10.0.3.0 - VPN# IMPORTANT: Everything not EXT_IF is made routable to anything# else not EXT_IF, and can reach the netEXT_IF=${EXT_IF:-ethCable}EXT_IP=$(/sbin/ifconfig $EXT_IF | grep "inet addr" | awk '{print $2}' | cut -f2 -d:)# Also, if VPN_ONLY_INTERFACES is set, all computers not listed# in /etc/novpn must use VPN on any interfaces in the listVPN_ONLY_INTERFACES=${VPN_ONLY_INTERFACES:-ath0}IPTABLES=/usr/sbin/iptablesfunction start() {$IPTABLES -P INPUT DROP$IPTABLES -A INPUT -i lo -j ACCEPT # Allow localhost connections##### sysctl-based defenses ###### Help protect against spoofingfor i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $i;done# don't participate in smurf attacksecho 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts# Ignore ICMP redirectsfor i in /proc/sys/net/ipv4/conf/*/accept_redirects ; do echo 0 > $i;done# Ignore packets with source routingfor i in /proc/sys/net/ipv4/conf/*/accept_source_route ; do echo 0 > $i;done##### Connection tracking rules #####$IPTABLES -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT$IPTABLES -A INPUT -m conntrack --ctstate RELATED -j ACCEPT#### Rules to allow by ports and/or ICMP type #####$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # ping$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # ssh$IPTABLES -A INPUT -p udp -m udp --dport 8767 -j ACCEPT # ts$IPTABLES -A INPUT -p udp -m udp --dport 1194 -j ACCEPT # openvpn$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT # openvpn (YA RLY)$IPTABLES -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT # HTTP$IPTABLES -A INPUT ! -i $EXT_IF -p tcp -m tcp --dport 25 -j ACCEPT$IPTABLES -A INPUT -p tcp -m tcp --dport 5000:5050 -j ACCEPT # temphack:torrent# Some interfaces shouldn't be allowed muchif [ "x$VPN_ONLY_INTERFACES" != "x" ]; then $IPTABLES -N InputVPNOnly 2>/dev/null for mac in $(cut -f1 '-d ' /etc/novpn); do $IPTABLES -A InputVPNOnly -m mac --mac-source $mac -j RETURN done $IPTABLES -A InputVPNOnly -p udp -m udp --dport 67 -j ACCEPT # DHCP $IPTABLES -A InputVPNOnly -p tcp -m tcp --dport dhcpv6-server -j ACCEPT # DHCP $IPTABLES -A InputVPNOnly -p udp -m udp --dport 53 -j ACCEPT # DNS $IPTABLES -A InputVPNOnly -j DROP for interface in $VPN_ONLY_INTERFACES; do $IPTABLES -A INPUT -i $interface -j InputVPNOnly donefi# Actual local services$IPTABLES -N InputLocal 2>/dev/null$IPTABLES -A InputLocal -p tcp -m tcp --dport 3306 -j ACCEPT #mysql$IPTABLES -A InputLocal -p udp -m udp --dport 67 -j ACCEPT # DHCP$IPTABLES -A InputLocal -p udp -m udp --dport 53 -j ACCEPT # DNS$IPTABLES -A InputLocal -p tcp -m tcp --dport dhcpv6-server -j ACCEPT # DHCP$IPTABLES -A INPUT ! -i $EXT_IF -j InputLocal##### IP Masquerading (internet connection sharing) ###### Don't just allow everything into the internal network$IPTABLES -F FORWARD$IPTABLES -P FORWARD DROP#$IPTABLES -A FORWARD -d ut2004master1.epicgames.com -j REJECT --reject-with host-unreach#$IPTABLES -A FORWARD -d ut2004master2.epicgames.com -j REJECT --reject-with host-unreach# Allow incoming from established and related connections# Block out bittorrent #$IPTABLES -A FORWARD -m ipp2p --ipp2p -i $INT_IF ! -s newton.hoe -j REJECT --reject-with port-unreach$IPTABLES -A FORWARD -i $EXT_IF ! -o $EXT_IF -m state --state ESTABLISHED,RELATED -j ACCEPT# No forwarding for novpn interfaces :)if [ "x$VPN_ONLY_INTERFACES" != "x" ]; then $IPTABLES -N ForwardVPNOnly for mac in $(cut -f1 '-d ' /etc/novpn); do $IPTABLES -A ForwardVPNOnly -m mac --mac-source $mac -j RETURN done for interface in $VPN_ONLY_INTERFACES; do $IPTABLES -A ForwardVPNOnly ! -o lo -j REJECT --reject-with host-unreach done $IPTABLES -A FORWARD -i $interface -j ForwardVPNOnlyfi# Unfiltered $IPTABLES -A INPUT ! -i $EXT_IF -j ACCEPT$IPTABLES -A FORWARD ! -i $EXT_IF -j ACCEPT# Enable masquerading$IPTABLES -t nat -F POSTROUTING$IPTABLES -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE$IPTABLES -t nat -F PREROUTING# More VPN_ONLY fuif [ "x$VPN_ONLY_INTERFACES" != "x" ]; then $IPTABLES -t nat -N PreroutingVPNOnly for mac in $(cut -f1 '-d ' /etc/novpn); do $IPTABLES -t nat -A PreroutingVPNOnly -m mac --mac-source $mac -j RETURN done $IPTABLES -t nat -A PreroutingVPNOnly -p tcp --dport 80 ! -d 10.0.0.1 -j DNAT --to-destination 10.0.0.1 for interface in $VPN_ONLY_INTERFACES; do $IPTABLES -t nat -A PREROUTING -i $interface -j PreroutingVPNOnly donefi# Forward some ports to help bittorrent along!$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport 4096:4200 -j DNAT --to-destination 10.0.0.10$IPTABLES -t nat -A PREROUTING -i $EXT_IF -p udp --dport 4096:4200 -j DNAT --to-destination 10.0.0.10$IPTABLES -A FORWARD -i $EXT_IF ! -o $EXT_IF -p tcp --dport 4096:4200 -j ACCEPT$IPTABLES -A FORWARD -i $EXT_IF ! -o $EXT_IF -p udp --dport 4096:4200 -j ACCEPT$IPTABLES -A INPUT -p tcp --dport 4096:4200 -j ACCEPT$IPTABLES -A INPUT -p udp --dport 4096:4200 -j ACCEPT$IPTABLES -A INPUT -p tcp --sport 4096:4200 -j ACCEPT$IPTABLES -A INPUT -p udp --sport 4096:4200 -j ACCEPT# Enable IP packet forwardingecho 1 > /proc/sys/net/ipv4/ip_forward# Enable helper modules for IRC and FTP/sbin/modprobe ip_nat_irc/sbin/modprobe ip_nat_ftp}function stop() {$IPTABLES -t mangle -F$IPTABLES -t nat -F$IPTABLES -P INPUT ACCEPT$IPTABLES -P FORWARD ACCEPT$IPTABLES -P OUTPUT ACCEPT$IPTABLES -F$IPTABLES -X InputLocal 2>/dev/null$IPTABLES -t nat -X PreroutingVPNOnly 2>/dev/null$IPTABLES -X InputVPNOnly 2>/dev/null$IPTABLES -X ForwardVPNOnly 2>/dev/nullfor i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $i; doneecho 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcastsfor i in /proc/sys/net/ipv4/conf/*/accept_redirects ; do echo 1 > $i;donefor i in /proc/sys/net/ipv4/conf/*/accept_source_route ; do echo 1 > $i;done$IPTABLES -t nat -F POSTROUTINGecho 0 > /proc/sys/net/ipv4/ip_forward}stop;case $1 in stop) exit; ;; *) start;esac