rendered paste body#!/bin/bashexport LC_ALL="en"PATH=/usr/sbin:/sbin:/bin:/usr/bin:/usr/local/sbin#Externel netEXT_IF="ppp0";EXT_IP=`/sbin/ifconfig $EXT_IF | grep "inet addr" | awk '{print $2}' | sed 's/[a-z]*://'`;#Internel netINT_IP=192.168.0.1INT_NET=192.168.0.0/24INT_IF="eth2";INT_BRC=192.168.0.255#LocalhostLO_IF=loLO_IP=127.0.0.1LO_MSK=255.0.0.0LO_NET="$LPDIP/$LPDMSK"#Allowed services and portsTCPSERV="domain ssh www https ftp ftp-data mail pop3 pop3s imap3 imaps imap2 time aol 10000:60000"UDPSERV="domain time www aol"SERVICES="33333 www aol domain 53"# Text tools variablesipt='iptables';startfw(){# Text tools variablesipt='iptables';echo "-----------------------------------------------"echo "Loading required stateful/NAT kernel modules"echo "-----------------------------------------------"MODULES="ip_tables ip_conntrack iptable_filter iptable_mangle iptable_nat ipt_LOG ipt_MASQUERADE ipt_REJECT ipt_mark ipt_tcpmss ipt_state"for i in $MODULES;do echo "Inserting module $i" modprobe $idone#Enable IPv4 forwardingecho "1" > /proc/sys/net/ipv4/ip_forward#Enables dynamic address hackingecho "1" > /proc/sys/net/ipv4/ip_dynaddr#Enables SYN flood protectionecho "1" > /proc/sys/net/ipv4/tcp_syncookies#Enables source validation by reversed path according to RFC1812echo "1" > /proc/sys/net/ipv4/conf/$EXT_IF/rp_filterecho "1" > /proc/sys/net/ipv4/conf/$INT_IF/rp_filterecho "1" > /proc/sys/net/ipv4/conf/all/rp_filterecho "1" > /proc/sys/net/ipv4/conf/default/rp_filter#Ignore all ICMP echo requests sent to the broadcast addressecho "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts#Disable accept or refuse source routed packetsecho "0" > /proc/sys/net/ipv4/conf/$EXT_IF/accept_source_routeecho "0" > /proc/sys/net/ipv4/conf/$INT_IF/accept_source_routeecho "0" > /proc/sys/net/ipv4/conf/all/accept_source_routeecho "0" > /proc/sys/net/ipv4/conf/default/accept_source_route#Disable ICMP redirectsecho "0" > /proc/sys/net/ipv4/conf/$EXT_IF/accept_redirectsecho "0" > /proc/sys/net/ipv4/conf/$INT_IF/accept_redirectsecho "0" > /proc/sys/net/ipv4/conf/all/accept_redirectsecho "0" > /proc/sys/net/ipv4/conf/default/accept_redirects#Secure redirectsecho "1" > /proc/sys/net/ipv4/conf/$EXT_IF/secure_redirectsecho "1" > /proc/sys/net/ipv4/conf/$INT_IF/secure_redirectsecho "1" > /proc/sys/net/ipv4/conf/all/secure_redirectsecho "1" > /proc/sys/net/ipv4/conf/default/secure_redirects#Disable logs packets from impossible addressesecho "0" > /proc/sys/net/ipv4/conf/$INT_IF/log_martiansecho "0" > /proc/sys/net/ipv4/conf/$EXT_IF/log_martiansecho "-----------------------------------------------"echo "External interface: $EXT_IF"echo "External IP address is: $EXT_IP"echo "Loading firewall server rules..."echo "-----------------------------------------------"#Flush all existing chains and erase personal chainsCHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`for i in $CHAINSdo$ipt -t $i -Fdonefor i in $CHAINSdo$ipt -t $i -Xdone#------------------------------------------------------------------------------------------##Dany INPUT, OUTPUT and FORWARD chains$ipt -P INPUT DROP$ipt -P OUTPUT DROP$ipt -P FORWARD DROP#User Specified Chains$ipt -N BAD_TCP#BAD_TCP$ipt -A BAD_TCP -p 6 ! --syn -m state --state NEW -m limit -j LOG --log-prefix " New not syn: "$ipt -A BAD_TCP -p 6 ! --syn -m state --state NEW -j REJECT#------------------------------------------------------------------------------------------##PREROUTING$ipt -t mangle -A PREROUTING -i $EXT_IF -j TTL --ttl-inc 1#------------------------------------------------------------------------------------------##INPUT$ipt -A INPUT -i $LO_IF -s $LO_IP -j ACCEPT$ipt -A INPUT -i $LO_IF -s $EXT_IP -j ACCEPT$ipt -A INPUT -i $LO_IF -s $INT_IP -j ACCEPT$ipt -A INPUT -p 6 -j BAD_TCPfor i in $SERVICES;do$ipt -A INPUT -p 6 -d $EXT_IP --sport $i -m state --state NEW,ESTABLISHED -j ACCEPT$ipt -A INPUT -p 6 -d $EXT_IP --dport $i -m state --state NEW,ESTABLISHED -j ACCEPTdone$ipt -A INPUT -p 17 -d $EXT_IP --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT#------------------------------------------------------------------------------------------##OUTPUT$ipt -A OUTPUT -o $LO_IF -d $LO_IP -j ACCEPT$ipt -A OUTPUT -o $LO_IF -d $EXT_IP -j ACCEPT$ipt -A OUTPUT -o $LO_IF -d $INT_IP -j ACCEPT#$ipt -A OUTPUT -p 6 -j BAD_TCP$ipt -A OUTPUT -o $INT_IF ! -d $INT_NET -j DROP$ipt -A OUTPUT -o $EXT_IF ! -s $EXT_IP -j DROPfor i in $SERVICES;do$ipt -A OUTPUT -p 6 -s $EXT_IP --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT$ipt -A OUTPUT -p 6 -s $EXT_IP --sport $i -m state --state NEW,ESTABLISHED -j ACCEPTdonefor i in $TCPSERV;do$ipt -A OUTPUT -o $INT_IF -p 6 -s $INT_NET --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT$ipt -A OUTPUT -o $EXT_IF -p 6 -s $EXT_IP --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT$ipt -A OUTPUT -o $EXT_IF -p 6 --dport $i -m state --state NEW,ESTABLISHED -j ACCEPTdonefor i in $UDPSERV;do$ipt -A OUTPUT -o $EXT_IF -p 17 -s $EXT_IP --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT$ipt -A OUTPUT -o $INT_IF -p 17 -s $INT_NET --dport $i -m state --state NEW,ESTABLISHED -j ACCEPTdone# Allow to ping out$ipt -A OUTPUT -o $EXT_IF -p 1 -s $EXT_IP --icmp-type 8 -m state --state NEW -j ACCEPT$ipt -A OUTPUT -o $INT_IF -p 1 -s $INT_NET --icmp-type 8 -m state --state NEW -j ACCEPT$ipt -A OUTPUT -o $EXT_IF -p 1 --icmp-type ! 8 -j DROP#------------------------------------------------------------------------------------------##FORWARD#spoof$ipt -A FORWARD -s $INT_NET -i $EXT_IF -j DROP#smurf#$ipt -A FORWARD -p 1 -i $EXT_IF -d $INT_NET -m multiport -j DROP$ipt -A FORWARD -i $INT_IF -s ! $INT_NET -j DROP#$ipt -A FORWARD -o $INT_IF -d ! $INT_NET -j DROP# Block outbound ICMP (except for PING)$ipt -A FORWARD -o $EXT_IF -p 1 --icmp-type ! 8 -j DROPfor i in $TCPSERV;do$ipt -A FORWARD -i $INT_IF -p 6 -s $INT_NET --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT$ipt -A FORWARD -i $EXT_IF -p 6 -d $INT_NET --sport $i -m state --state NEW,ESTABLISHED -j ACCEPTdonefor i in $UDPSERV;do$ipt -A FORWARD -i $INT_IF -p 17 -s $INT_NET --dport $i -m state --state NEW,ESTABLISHED -j ACCEPT$ipt -A FORWARD -i $EXT_IF -p 17 -d $INT_NET --sport $i -m state --state NEW,ESTABLISHED -j ACCEPTdone# Allow to ping out$ipt -A FORWARD -i $INT_IF -p 1 -s $INT_NET --icmp-type 8 -m state --state NEW -j ACCEPT$ipt -A FORWARD -j DROP$ipt -A FORWARD -o $EXT_IF -p 1 --icmp-type ! 8 -j DROP#------------------------------------------------------------------------------------------##POSTROUTING$ipt -t mangle -A POSTROUTING -s $INT_NET -o $EXT_IF -j TTL --ttl-set 64 $ipt -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADEecho -e " Firewall rules loading complete\n\n"}stopfw(){#Flush all existing chains and erase personal chainsecho -n "Clearing iptables... "CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`for i in $CHAINSdo$ipt -t $i -Fdonefor i in $CHAINSdo$ipt -t $i -XdonePOL="INPUT OUTPUT FORWARD"for i in $POLdo$ipt -P $i ACCEPTdoneecho "Done"}action="$1"case $action in start) stopfwl startfw ;; stop) stopfw ;; restart) stopfw startfw ;; *) echo "Invalid action!Usage: sh firewall.sh { start | stop | restart }" ;; esac