#!/bin/bash
modprobe ip_tables
modprobe ip_conntrack
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin
export PATH
test -x /sbin/iptables || exit 1
LOC="xxx.65.7.64/26"
INIF="eth1"
INIP="xxx.65.7.69"
BROADCAST="xxx.65.7.127"
LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="240.0.0.0/4"
P_PORTS="0:1023"
UP_PORTS="1024:65535"
TR_SRC_PORTS="32769:65535"
TR_DEST_PORTS="33434:33523"
case $1 in
start|restart|force-reload)
echo "Starting firewall"
###############################################################################
# First we need to clear up any existing firewall rules
# and chain which might have been created
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t mangle
iptables -F -t nat
iptables -X
iptables -Z
# Default policies: Accept any incoming packets
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
# Disable response to ping:
/bin/echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# Disable response to broadcasts:
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Enable TCP SYN cookies:
/bin/echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# Enable bad error messages protection:
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Disable IP forwarding:
/bin/echo "0" > /proc/sys/net/ipv4/ip_forward
for interface in /proc/sys/net/ipv4/conf/*
do
echo "0" > ${interface}/send_redirects
echo "0" > ${interface}/accept_redirects
echo "1" > ${interface}/secure_redirects
echo "0" > ${interface}/accept_source_route
echo "0" > ${interface}/bootp_relay
echo "0" > ${interface}/proxy_arp
echo "1" > ${interface}/log_martians
echo "1" > ${interface}/rp_filter
done
# Accept any connections from the local machine
iptables -A INPUT -i lo -j ACCEPT
# Here we define a new chain which is going to handle
# packets we don't want to respond to
# limit the amount of logs to 10/min
iptables -N Firewall
iptables -A Firewall -m limit --limit 10/minute -j LOG --log-prefix "Firewall: "
iptables -A Firewall -j DROP
# log those packets and inform the sender that the packet was rejected
iptables -N Rejectwall
iptables -A Rejectwall -m limit --limit 10/minute -j LOG --log-prefix "Rejectwall: "
iptables -A Rejectwall -j REJECT --reject-with icmp-host-unreachable
iptables -N Badflags
iptables -A Badflags -m limit --limit 10/minute -j LOG --log-prefix "Badflags: "
iptables -A Badflags -j DROP
iptables -N Log
iptables -A Firewall -m limit --limit 10/minute -j LOG --log-prefix "Log: "
iptables -A Firewall -j ACCEPT
# A list of well known combination of Bad TCP flags
# we redirect those to the Badflags chain
# which is going to handle them (log and drop)
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j Badflags
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j Badflags
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j Badflags
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j Badflags
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j Badflags
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j Badflags
# Syn flood protection:
#
# Maximize the rate of incoming connections. In order to do this
# we divert tcp packets with the SYN bit set off to a user-defined
# chain. Up to limit-burst connections can arrive in 1/limit
# seconds; in this case 4 connections in one second. After this,
# one of the burst is regained every second and connections are
# allowed again. The default limit is 3/hour. The default limit
# burst is 5.
#
iptables -N syn-flood
iptables -A INPUT -i $INIF -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j LOG --log-prefix "$INIF Input TCP Syn Flood: "
iptables -A syn-flood -j DROP
# New tcp connections must be made with Syn packets:
iptables -A INPUT -i $INIF -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "$INIF Input TCP Syn: "
iptables -A INPUT -i $INIF -p tcp ! --syn -m state --state NEW -j DROP
# Refuse spoofed packets pretending to be from the INIP IP
# address:
iptables -A INPUT -i $INIF -s $INIP -j LOG --log-prefix "$INIF Input Spoof: "
iptables -A INPUT -i $INIF -s $INIP -j DROP
# Refuse packets claiming to be from a Class A private network:
iptables -A INPUT -i $INIF -s $CLASS_A -j LOG --log-prefix "$INIF Input Class A Private: "
iptables -A INPUT -i $INIF -s $CLASS_A -j DROP
# Refuse packets claiming to be from a Class B private network,
# (INNET is a Class B private network-its commented out):
iptables -A INPUT -i $INIF -s $CLASS_B -j LOG --log-prefix "$INIF Input Class B Private: "
iptables -A INPUT -i $INIF -s $CLASS_B -j DROP
# Refuse packets claiming to be from a Class C private network:
iptables -A INPUT -i $INIF -s $CLASS_C -j LOG --log-prefix "$INIF Input Class C Private: "
iptables -A INPUT -i $INIF -s $CLASS_C -j DROP
# Refuse Class D multicast addresses. Multicast is illegal as a
# source address:
iptables -A INPUT -i $INIF -s $CLASS_D_MULTICAST -j LOG --log-prefix "$INIF Input Multicast: "
iptables -A INPUT -i $INIF -s $CLASS_D_MULTICAST -j DROP
# Refuse Class E reserved IP addresses:
iptables -A INPUT -i $INIF -s $CLASS_E_RESERVED_NET -j LOG --log-prefix "$INIF Input Class E: "
iptables -A INPUT -i $INIF -s $CLASS_E_RESERVED_NET -j DROP
# Refuse packets claiming to be to the loopback interface:
iptables -A INPUT -i $INIF -d $LOOPBACK -j LOG --log-prefix "$INIF Input Loopback Spoof: "
iptables -A INPUT -i $INIF -d $LOOPBACK -j DROP
# Refuse broadcast address packets:
iptables -A INPUT -i $INIF -d $BROADCAST -j LOG --log-prefix "$INIF Input Broadcast: "
iptables -A INPUT -i $INIF -d $BROADCAST -j DROP
# Limit ICMP
iptables -A INPUT -p icmp --fragment -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type source-quench -j ACCEPT
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp -j Firewall
# Accept ssh connections from the Internet
iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 22 -j Firewall
# Accept smtp connections from the Internet
iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 25 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
iptables -A INPUT -i $INIF -p tcp -m state --syn --state NEW --dport 25 -j Firewall
# DROP DROP DROP DROP DROP
# Drop netbios from the outside, no log, just drop
iptables -A INPUT -p udp --sport 137 --dport 137 -j DROP
# Drop nfs from the Internet
iptables -A INPUT -p tcp --dport 111 -j DROP
iptables -A INPUT -p tcp --dport 2049 -j DROP
# Drop baclula from the Internet
iptables -A INPUT -p tcp --dport 9101 -j DROP
iptables -A INPUT -p tcp --dport 9103 -j DROP
###############################################################################
;;
stop)
###############################################################################
echo "Stoping firewall"
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
###############################################################################
;;
esac