rendered paste body#!/bin/sh######### Interface VariablesWAN="eth1"LAN="eth0"DMZ="eth2"IP_LAN=`ifconfig $LAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`IP_WAN=`ifconfig $WAN | grep -e "inet addr" | awk {'print $2'} | awk -F: {'print $2'}`######## Load Modulesload_modules(){IRCPORTS="6665,6666,6667,6668,6669,7000"modprobe ip_tablesmodprobe iptable_filtermodprobe ip_conntrackmodprobe ip_conntrack_ftpmodprobe ip_nat_ftpmodprobe ipt_statemodprobe ipt_MASQUERADEmodprobe ip_conntrack_irc ports=$IRCPORTSmodprobe ip_nat_irc ports=$IRCPORTS}load_modules######## Flush Rulesiptables -F INPUTiptables -F OUTPUTiptables -F FORWARDiptables -Fiptables -F -t natiptables -F -t mangleiptables -Xiptables -X -t natiptables -X -t mangle######## Default Policypolicy_drop(){iptables -P INPUT DROPiptables -P OUTPUT DROPiptables -P FORWARD DROP}policy_accept(){iptables -P INPUT ACCEPTiptables -P OUTPUT ACCEPTiptables -P FORWARD ACCEPT}policy_drop######## Kernel Settingskernel(){#echo "1" > /proc/sys/net/ipv4/conf/all/accept_source_route#echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all#echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts#echo "0" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responsesecho "1" > /proc/sys/net/ipv4/conf/all/accept_redirectsecho "0" > /proc/sys/net/ipv4/conf/all/log_martiansecho "1" > /proc/sys/net/ipv4/ip_forward}for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do /bin/echo "1" > ${interface} ; done#kernelecho "1" > /proc/sys/net/ipv4/ip_forwardiptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE######## TRANSPARENT SQUIDiptables -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j REDIRECT --to-port 3128######## Block new connectionsblock_new(){iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPTiptables -A INPUT -m state --state NEW -j ACCEPTiptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPTiptables -A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT}#block_new######## New Table: LOGDROPiptables -N logdropiptables -F logdropiptables -A logdrop -m limit --limit 2/s --limit-burst 3 -j LOG --log-prefix "LOGDROP: "iptables -A logdrop -j DROP######## New Table: SYNFLOODiptables -N synfloodiptables -F synfloodiptables -A synflood -m limit --limit 1/s --limit-burst 4 -j RETURNiptables -A synflood -j DROP######## New Tables: ICMP_TRAFFICiptables -N icmp_trafficiptables -F icmp_traffic#iptables -A icmp_traffic -m limit --limit 5/s --limit-burst 3 -j LOG --log-prefix "ICMP: "iptables -A icmp_traffic -p icmp -j ACCEPT####### RFC1918rfc1918(){iptables -A INPUT -i $LAN -s 127.0.0.1 -j DROPiptables -A INPUT -i $LAN -s $IP_LAN -j DROPiptables -A INPUT -i $WAN -s $IP_LAN -j DROPiptables -A INPUT -i $WAN -s 127.0.0.1 -j DROPiptables -A INPUT -i $WAN -s 10.0.0.0/8 -j DROPiptables -A INPUT -i $WAN -s 172.16.0.0/12 -j DROPiptables -A INPUT -i $WAN -s 192.168.0.0/16 -j DROP}rfc1918######## SSHiptables -A INPUT -i $LAN -p tcp --dport 22 -j ACCEPTiptables -A OUTPUT -o $LAN -p tcp --sport 22 -j ACCEPTiptables -A FORWARD -p tcp --dport 22 -j ACCEPTiptables -A FORWARD -p tcp --sport 22 -j ACCEPT######## ICMPicmp_j(){iptables -A INPUT -p icmp -j icmp_trafficiptables -A OUTPUT -p icmp -j icmp_trafficiptables -A FORWARD -p icmp -j icmp_traffic}######## ICMPiptables -A INPUT -p icmp -j ACCEPTiptables -A OUTPUT -p icmp -j ACCEPTiptables -A FORWARD -p icmp -j ACCEPT######## Loopback Interfaceiptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT######## Speed Up ssh connectionsiptables -t mangle -A PREROUTING -p tcp --sport 22 -j TOS --set-tos Minimize-Delay######## SKYPEiptables -A FORWARD -p tcp --sport 2940:3000 -j logdropiptables -A FORWARD -p udp --sport 1247 -j logdrop######## DNSiptables -A INPUT -p udp --sport 53 -j ACCEPTiptables -A OUTPUT -p udp --dport 53 -j ACCEPTiptables -A FORWARD -p udp --sport 53 -j ACCEPTiptables -A FORWARD -p udp --dport 53 -j ACCEPT######## WEB#iptables -A FORWARD -p tcp --sport 80 -j LOG --log-prefix "WWW in:" -m limit --limit 5/s#iptables -A FORWARD -p tcp --dport 80 -j LOG --log-prefix "WWW out:" -m limit --limit 5/siptables -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPTiptables -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPTiptables -A FORWARD -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPTiptables -A FORWARD -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPTiptables -A FORWARD -p tcp --sport 3128 -m state --state ESTABLISHED -j ACCEPTiptables -A FORWARD -p tcp --dport 3128 -m state --state NEW,ESTABLISHED -j ACCEPT######## IRCiptables -A FORWARD -p tcp --sport 6665:7000 -j ACCEPTiptables -A FORWARD -p tcp --dport 6665:7000 -j ACCEPT######## MSNiptables -A INPUT -p tcp --sport 1863 -j LOG --log-prefix "MSN in: " -m limit --limit 5/siptables -A OUTPUT -p tcp --dport 1863 -j LOG --log-prefix "MSN out: " -m limit --limit 5/siptables -A FORWARD -p tcp --sport 1863 -j ACCEPTiptables -A FORWARD -p tcp --dport 1863 -j ACCEPT