rendered paste bodycivil-srv civil # cat ~/1firewall0.sh#!/bin/bashIPTABLES='/sbin/iptables'LOIF="lo0"EXTIFS="ppp0 \ eth1"INTIFS="eth0 \ usb0"/bin/echo 1 > /proc/sys/net/ipv4/ip_forwardecho "Flusing old rules..."$IPTABLES -F$IPTABLES -X$IPTABLES -A INPUT -p ALL -i $LOIF -j ACCEPT$IPTABLES -A OUTPUT -p ALL -o $LOIF -j ACCEPTecho "Done"#echo "Setting new chain for Treason uncloaked..."#$IPTABLES -F TREASON#$IPTABLES -X TREASON#$IPTABLES -N TREASON# Fix for VPN - make iptables split eth's packets (wich is 1500 bytes long) to meet ppp0's requests (1462 bytes).echo "Fixing VPN packet size"## $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss -mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu# $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu$IPTABLES -t mangle -A FORWARD -p tcp -o ppp+ --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1250echo "Forwarding ICMP Fragmentation-needed"# $IPTABLES -A FORWARD -p icmp --icmp-type fragmentation-needed -j ACCEPT# $IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT# Increasing TTLecho "Increasing TTL"$IPTABLES -A PREROUTING -t mangle -i eth0 -j TTL --ttl-inc 1# $IPTABLES -A PREROUTING -t mangle -i eth0 -j TTL --ttl-inc 1#NFS stuffecho "Allowing NFS Connects"$IPTABLES -A INPUT -p tcp --dport 111 -j ACCEPT$IPTABLES -A INPUT -p udp --dport 111 -j ACCEPT$IPTABLES -A INPUT -p tcp --dport 633 -j ACCEPT$IPTABLES -A INPUT -p udp --dport 633 -j ACCEPT$IPTABLES -A INPUT -p tcp --dport 636 -j ACCEPT$IPTABLES -A INPUT -p udp --dport 636 -j ACCEPT$IPTABLES -A INPUT -p tcp --dport 999 -j ACCEPT$IPTABLES -A INPUT -p udp --dport 999 -j ACCEPT# Allowing VMWare Console$IPTABLES -A INPUT -p tcp --dport 902 -j ACCEPT$IPTABLES -A INPUT -p udp --dport 902 -j ACCEPT# Allowing Multicast# $IPTABLES -A INPUT -p igmp -j ACCEPT# $IPTABLES -A FORWARD -s 10.184.0.0/16 -p udp -j ACCEPT# Let's allow SSH, Web and FTP serverecho "Allowing SSH, WWW and FTP Servers"$IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT$IPTABLES -A INPUT --protocol tcp --dport 80 -j ACCEPT$IPTABLES -A INPUT --protocol tcp --dport 21 -j ACCEPT$IPTABLES -A INPUT --protocol tcp --dport 20 -j ACCEPT# We need this for torrent and games serversecho "Allowing Torrents and Games (all ports in 1024:65535)"# $IPTABLES -A INPUT -p tcp -m tcp --dport 1024:65535 --syn -j ACCEPT$IPTABLES -A INPUT -p tcp --dport 1024:65535 -j ACCEPT$IPTABLES -A INPUT -p udp --dport 1024:65535 -j ACCEPT# Maybe we need this to send that Dest. Host is unreachable# $IPTABLES -A INPUT -p icmp --icmp-type 3 -j ACCEPT# $IPTABLES -A INPUT -p icmp --icmp-type 11 -j ACCEPT# $IPTABLES -A INPUT -p icmp --icmp-type 12 -j ACCEPT#Cool pings: Destination host is unreachable :D# echo "Destination host is unreachable on ping"# $IPTABLES -A INPUT -p icmp -i ${EXTIF1} -j REJECT --reject-with icmp-host-unreachable# $IPTABLES -A INPUT -p icmp -i ${EXTIF2} -j REJECT --reject-with icmp-host-unreachable# $IPTABLES -A INPUT -p icmp -i eth1 -j REJECT --reject-with 1/13# $IPTABLES -A INPUT -p tcp -m tcp --dport 1024:65535 --syn -j ACCEPT# TV_MNET="224.10.10.0/26"# TV_MPORT="8001:8063"for INTIF in `echo "${INTIFS}"` do for EXTIF in `echo "${EXTIFS}"` do echo "Enabling NAT for ${EXTIF} and ${INTIF}" $IPTABLES -t nat -A POSTROUTING -o ${EXTIF} -j MASQUERADE $IPTABLES -t nat -A POSTROUTING -o ${EXTIF} -j MASQUERADE $IPTABLES -A FORWARD -i ${INTIF} -o ${EXTIF} -m state --state NEW,ESTABLISHED -j ACCEPT# echo "Multicast forwarding"# if [ "${EXTIF}"="eth0" ]; then# $IPTABLES -A INPUT -p 2 -i ${INTIF} -s ${EXTIF} -d ${TV_MNET} -j ACCEPT# $IPTABLES -A INPUT -p 2 -i ${INTIF} -s ${EXTIF} -d 224.0.0.0/24 -j ACCEPT# $IPTABLES -A OUTPUT -p 2 -o ${INTIF} -s ${EXTIF} -d ${TV_MNET} -j ACCEPT# $IPTABLES -A OUTPUT -p 2 -o ${INTIF} -s ${EXTIF} -d 224.0.0.0/24 -j ACCEPT# fi# echo "Disabling all unallowed connections from ${EXTIF}" $IPTABLES -A INPUT -i ${EXTIF} -m state --state NEW,INVALID -j DROP $IPTABLES -A FORWARD -i ${EXTIF} -m state --state NEW,INVALID -j DROP done doneecho "Done. Have a lot of fun"#$IPTABLES -j TREASON