angel4u

[ 00:12:34  geo@DRAGON tmp ]$ cat firewall_new.sh
#!/bin/sh
#################################################
# Location
IPTABLES=/sbin/iptables # The location where we can find the iptables binary
# Interface options
INT=eth0 # The interface that will be protected (in version 1.7, it will be  "interfaceS"  )
TRUSTIF="" # The interfaces you want to trust, all packets from those interfaces are accepted
# /proc based options
ECHOIGNORE=1 # Enable if you want to automatically ignore all ICMP echo requests (IPv4)
#  this is very useful in stopping lame DoS-Attacks (aka ping -f's)
SYNPROT=1 # Enable if you want synflood protection trough /proc/.../tcp_syncookies
SYNFLOOD=1 # Enable if you want synflood protection by iptables roules
LOG=1 # Enable all Logging connections
LOGLEV="info" # You can use info, warning, debug.
###############################################################################################################
# put in the following variable which ports you want to leave open #
###############################################################################################################
OPENTCP="22 53 88 113 1111 10000:65534"
OPENUDP="53 32827 32828"
# put in the following variable which ports you want to leave closed #
###############################################################################################################
CLOSEDHOST=""

# Don't edit below, unless you know what you're doing!

VERSION="v3.2"
echo  "IPtables bash-script $VERSION by morphy"

echo  "Checking for root priviliges..."

sleep 1

ROOT_UID=0
if [  "$UID" -eq  "$ROOT_UID" ]
then
echo  "Okay, root check was positive..."
else
echo  "Oh oh! root check was negative... quitting (you MUST be root to use this script!)"
exit
fi

case "$1" in
 start|restart)

#########################
# do NOT edit below !!!!#
#########################

# anti-spoofing enable
for blah in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo  "1"  > $blah
done

# flushes any old rules
#########################
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F

# sets standard policies for the tables (input drop == very secure)
###################################################################
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

$IPTABLES  -A INPUT -p ipv6 -j ACCEPT
$IPTABLES  -A INPUT -s 127.0.0.1 -j ACCEPT
$IPTABLES  -A INPUT -s 213.202.240.96 -j ACCEPT

# Enabling LOG
######################################################################################
if [ $LOG == 1 ]
then
   $IPTABLES -A INPUT -p icmp --icmp-type "echo-request" -m limit --limit 5/minute \
       -j LOG --log-prefix "#### Ping Scan ####"
#   $IPTABLES -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 5 \
#       -j LOG --log-level $LOGLEV --log-prefix "#### Stealth Scan ####"
   $IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/m \
       -j LOG --log-level $LOGLEV --log-prefix "#### XMAS Scan ####"
   $IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m \
       -j LOG --log-level $LOGLEV --log-prefix "#### SYN/RST Scan ####"
   $IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m \
       -j LOG --log-level $LOGLEV --log-prefix "#### SYN/FIN Scan ####"

   $IPTABLES -A INPUT -p tcp --tcp-option 64 -m limit --limit 5/m \
       -j LOG --log-level $LOGLEV --log-prefix "#### Bad TCP FLAG(64) ####"
   $IPTABLES -A INPUT -p tcp --tcp-option 128 -m limit --limit 5/m \
       -j LOG --log-level $LOGLEV --log-prefix "#### Bad TCP FLAG(128) ####"
fi

# accept all packets from trusted interfaces
###########################################################
for i in $TRUSTIF; do
$IPTABLES -A INPUT -i $i -j ACCEPT
done

# accepting established connections
###################################
$IPTABLES -A INPUT -i $INT -m state --state ESTABLISHED -j ACCEPT

# allow, but limit related connections
######################################
$IPTABLES -A INPUT -i $INT -m state --state RELATED -m limit --limit-burst 30 --limit 1/minute -j ACCEPT

# block all invalid connections
######################################
$IPTABLES -A INPUT -m state --state INVALID -j DROP

# checking whether you want to block all ICMP echo requests trough /proc/.../tcp_syncookies
###########################################################################################
if [ $ECHOIGNORE == 1 ]
then
echo  "Blocking all ICMP echo-requests (through /proc/.../"
echo  "1"  > /proc/sys/net/ipv4/icmp_echo_ignore_all
fi

# checking whether you want to add synflood protection throug /proc/.../tcp_syncookies
######################################################################################
if [ -f /proc/sys/net/ipv4/tcp_syncookies ] && [ $SYNPROT == 1 ]
then
echo  "1"  > /proc/sys/net/ipv4/tcp_syncookies
fi

# Adding ports NOT to be firewalled
################################################

for i in $OPENTCP; do
$IPTABLES -A INPUT -i $INT -p tcp --dport $i -j ACCEPT
done

for i in $OPENUDP; do
$IPTABLES -A INPUT -i $INT -p udp --dport $i -j ACCEPT
done

# checking whether you want to add synflood protection throug /proc/.../tcp_syncookies
######################################################################################
if [ $SYNFLOOD == 1 ]
then
iptables -N syn-flood
iptables -A INPUT -i $INT -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j LOG --log-level $LOGLEV --log-prefix "#### SYN FLOOD ####"
iptables -A syn-flood -j DROP
fi

# Checking/Drop Portscan
################################################
$IPTABLES -A INPUT -i $INT -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 3/m -j DROP
$IPTABLES -A INPUT -i $INT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/m -j DROP
$IPTABLES -A INPUT -i $INT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 3/m -j DROP

# host not allowed
#####################################################
for i in $CLOSEDHOST; do
$IPTABLES -A INPUT -s $i -j DROP
$IPTABLES -A OUTPUT -d $i -j DROP
done

# block igmp...usually used for the wrong reasons
#################################################
$IPTABLES -A INPUT -i $INT -j DROP

# add here any others rules
#################################################
#$IPTABLES -A OUTPUT -m owner ! --uid-owner morphy -s 85.14.248.100 -j DROP
#################################################

echo  "You are now protected."
  ;;

  stop)
echo  "Stopping the firewall (flushing rules etc ...)"
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -t nat -F
$IPTABLES -P INPUT ACCEPT
echo  "Firewall stopped, protection disabled."
  ;;

*)
       echo "Usage: $1 {start|stop|restart}"
       exit 1
esac

exit 0
[ 00:12:39  geo@DRAGON tmp ]$