rendered paste body#!/bin/bash
#
# This is a iptables firewall script.
# On Debian or Ubuntu, run "update-rc.d firewall defaults" to install this on startup.
# Written by Alexey Maximov <amax@mail.ru>
#
#
# chkconfig: 2345 08 92
# description: This configures iptables.
#
### BEGIN INIT INFO
# Provides: firewall
# Required-Start: $network $local_fs $remote_fs
# Required-Stop: $network $local_fs $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: S 0 1 6
# Short-Description: This loads iptables with firewall rules.
# Description: This loads iptables with firewall rules. Placed this in /etc/init.d.
# This isn't technically a daemon control script.
# This just puts a familiar interface around iptables.
### END INIT INFO
modprobe ip_tables
modprobe ip_conntrack
PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin
export PATH
test -x /sbin/iptables || exit 1
INT_IF="eth0"
INT_IP_1="192.168.0.4"
INT_BR_1="255.255.255.0"
INT_NET_1="192.168.0.0/24"
EXT_IF="eth1"
EXT_IP_1="xxx.xx.7.69"
EXT_BR_1="xxx.xx.7.127"
EXT_NET_1="xxx.xx.7.64/26"
LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="240.0.0.0/4"
P_PORTS="0:1023"
UP_PORTS="1024:65535"
TR_SRC_PORTS="32769:65535"
TR_DEST_PORTS="33434:33523"
case $1 in
start|restart|force-reload)
echo "Starting firewall"
###############################################################################
# First we need to clear up any existing firewall rules
# and chain which might have been created
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t mangle
iptables -F -t nat
iptables -X
iptables -Z
# Default policies: Accept any incoming packets
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
# Disable response to ping:
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# Disable response to broadcasts:
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Enable TCP SYN cookies:
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# Enable bad error messages protection:
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Disable IP forwarding:
echo "0" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/tcp_rfc1337
echo "0" > /proc/sys/net/ipv4/ip_no_pmtu_disc
echo "1" > /proc/sys/net/ipv4/tcp_sack
echo "1" > /proc/sys/net/ipv4/tcp_fack
echo "1" > /proc/sys/net/ipv4/tcp_window_scaling
echo "1" > /proc/sys/net/ipv4/tcp_timestamps
echo "0" > /proc/sys/net/ipv4/tcp_ecn
echo "1" > /proc/sys/net/ipv4/route/flush
echo "1440000" > /proc/sys/net/ipv4/tcp_max_tw_buckets
echo "15" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "1800" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "1280" > /proc/sys/net/ipv4/tcp_max_syn_backlog
echo "4096 87380 16777216" > /proc/sys/net/ipv4/tcp_rmem
echo "4096 65536 16777216" > /proc/sys/net/ipv4/tcp_wmem
echo "16777216" > /proc/sys/net/core/rmem_max
echo "16777216" > /proc/sys/net/core/rmem_default
echo "16777216" > /proc/sys/net/core/wmem_max
echo "16777216" > /proc/sys/net/core/wmem_default
for interface in /proc/sys/net/ipv4/conf/*
do
echo "0" > ${interface}/send_redirects
echo "0" > ${interface}/accept_redirects
echo "1" > ${interface}/secure_redirects
echo "0" > ${interface}/accept_source_route
echo "0" > ${interface}/bootp_relay
echo "0" > ${interface}/proxy_arp
echo "1" > ${interface}/log_martians
echo "1" > ${interface}/rp_filter
done
###########################################################################
# Accept any connections from the local machine
iptables -A INPUT -i lo -j ACCEPT
# A list of well known combination of Bad TCP flags
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
# Syn flood protection:
iptables -N syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j LOG --log-prefix "DROP:TCP_Syn_Flood: "
iptables -A syn-flood -j DROP
iptables -A INPUT -i ${EXT_IF} -p tcp --syn -j syn-flood
iptables -A INPUT -i ${INT_IF} -p tcp --syn -j syn-flood
# New tcp connections must be made with Syn packets:
iptables -A INPUT -i ${EXT_IF} -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "DROP:TCP_No_Syn: "
iptables -A INPUT -i ${EXT_IF} -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -i ${INT_IF} -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "DROP:TCP_No_Syn: "
iptables -A INPUT -i ${INT_IF} -p tcp ! --syn -m state --state NEW -j DROP
# Refuse spoofed packets pretending to be from the EXT_IP_1 address:
iptables -A INPUT -i ${EXT_IF} -s $EXT_IP_1 -j LOG --log-prefix "DROP:Spoof: "
iptables -A INPUT -i ${EXT_IF} -s $EXT_IP_1 -j DROP
iptables -A INPUT -i ${INT_IF} -s $INT_IP_1 -j LOG --log-prefix "DROP:Spoof: "
iptables -A INPUT -i ${INT_IF} -s $INT_IP_1 -j DROP
# Refuse packets claiming to be from a Class A private network:
iptables -A INPUT -i ${EXT_IF} -s $CLASS_A -j LOG --log-prefix "DROP:Class_A: "
iptables -A INPUT -i ${EXT_IF} -s $CLASS_A -j DROP
iptables -A INPUT -i ${INT_IF} -s $CLASS_A -j LOG --log-prefix "DROP:Class_A: "
iptables -A INPUT -i ${INT_IF} -s $CLASS_A -j DROP
# Refuse packets claiming to be from a Class B private network,
# (INNET is a Class B private network-its commented out):
iptables -A INPUT -i ${EXT_IF} -s $CLASS_B -j LOG --log-prefix "DROP:Class_B: "
iptables -A INPUT -i ${EXT_IF} -s $CLASS_B -j DROP
iptables -A INPUT -i ${INT_IF} -s $CLASS_B -j LOG --log-prefix "DROP:Class_B: "
iptables -A INPUT -i ${INT_IF} -s $CLASS_B -j DROP
# Refuse packets claiming to be from a Class C private network:
iptables -A INPUT -i ${EXT_IF} -s $CLASS_C -j LOG --log-prefix "DROP:Class_C: "
iptables -A INPUT -i ${EXT_IF} -s $CLASS_C -j DROP
# iptables -A INPUT -i ${INT_IF} -s $CLASS_C -j LOG --log-prefix "DROP:Class_C: "
# iptables -A INPUT -i ${INT_IF} -s $CLASS_C -j DROP
# Refuse Class D multicast addresses. Multicast is illegal as a
# source address:
iptables -A INPUT -i ${EXT_IF} -s $CLASS_D_MULTICAST -j LOG --log-prefix "DROP:Multicast: "
iptables -A INPUT -i ${EXT_IF} -s $CLASS_D_MULTICAST -j DROP
iptables -A INPUT -i ${INT_IF} -s $CLASS_D_MULTICAST -j LOG --log-prefix "DROP:Multicast: "
iptables -A INPUT -i ${INT_IF} -s $CLASS_D_MULTICAST -j DROP
# Refuse Class E reserved IP addresses:
iptables -A INPUT -i ${EXT_IF} -s $CLASS_E_RESERVED_NET -j LOG --log-prefix "DROP:Class_E: "
iptables -A INPUT -i ${EXT_IF} -s $CLASS_E_RESERVED_NET -j DROP
iptables -A INPUT -i ${INT_IF} -s $CLASS_E_RESERVED_NET -j LOG --log-prefix "DROP:Class_E: "
iptables -A INPUT -i ${INT_IF} -s $CLASS_E_RESERVED_NET -j DROP
# Refuse packets claiming to be to the loopback interface:
iptables -A INPUT -i ${EXT_IF} -d $LOOPBACK -j LOG --log-prefix "DROP:Loopback_Spoof: "
iptables -A INPUT -i ${EXT_IF} -d $LOOPBACK -j DROP
iptables -A INPUT -i ${INT_IF} -d $LOOPBACK -j LOG --log-prefix "DROP:Loopback_Spoof: "
iptables -A INPUT -i ${INT_IF} -d $LOOPBACK -j DROP
# Refuse common broadcast address packets:
#iptables -A INPUT -s 255.255.255.255 -j LOG --log-prefix "DROP:${EXT_IF}:Broadcast: "
iptables -A INPUT -s 255.255.255.255 -j DROP
#iptables -A INPUT -d 255.255.255.255 -j LOG --log-prefix "DROP:${EXT_IF}:Broadcast: "
iptables -A INPUT -d 255.255.255.255 -j DROP
# Refuse our broadcast address packets:
iptables -A INPUT -i ${EXT_IF} -d $EXT_BR_1 -j LOG --log-prefix "DROP:Broadcast: "
iptables -A INPUT -i ${EXT_IF} -d $EXT_BR_1 -j DROP
iptables -A INPUT -i ${INT_IF} -d $INT_BR_1 -j LOG --log-prefix "DROP:Broadcast: "
iptables -A INPUT -i ${INT_IF} -d $INT_BR_1 -j DROP
# Limit ICMP
iptables -A INPUT -p icmp --fragment -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type source-quench -j ACCEPT
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT
iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp -j DROP
# Reject ident
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
# Drop netbios
iptables -A INPUT -p udp --sport 137 --dport 137 -j DROP
# Accept ssh connections
iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 22 -j DROP
iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 22 -j DROP
# Accept smtp connections
iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 25 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 25 -j DROP
iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 25 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT
iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 25 -j DROP
# Drop nfs from the Internet
iptables -A INPUT -i ${EXT_IF} -p tcp --dport 111 -j REJECT --reject-with tcp-reset
iptables -A INPUT -i ${EXT_IF} -p tcp --dport 2049 -j REJECT --reject-with tcp-reset
# Drop baclula from the Internet
iptables -A INPUT -i ${EXT_IF} -p tcp --dport 9101 -j REJECT --reject-with tcp-reset
iptables -A INPUT -i ${EXT_IF} -p tcp --dport 9103 -j REJECT --reject-with tcp-reset
# Drop samba from the Internet
iptables -A INPUT -i ${EXT_IF} -p tcp --dport 137:139 -j REJECT --reject-with tcp-reset
iptables -A INPUT -i ${EXT_IF} -p udp --dport 137:139 -j DROP
iptables -A INPUT -i ${EXT_IF} -p tcp --dport 445 -j REJECT --reject-with tcp-reset
iptables -A INPUT -i ${EXT_IF} -p udp --dport 445 -j DROP
# Drop squid from the Internet
iptables -A INPUT -i ${EXT_IF} -p tcp --dport 3128 -j REJECT --reject-with tcp-reset
###############################################################################
;;
stop)
###############################################################################
echo "Stoping firewall"
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
###############################################################################
;;
esac