rendered paste body#!/bin/sh
# Settings
SYN_FLOOD_PROTECTION=1
ICMP_IGNORE_BROADCAST=1
ICMP_REDIRECTS=0
ICMP_IGNORE_BAD_MSGS=1
LOG_MARTIANS=0
TCP_TIMESTAMPS=0
ACCEPT_SOURCE_ROUTE=0
ICMP_PING=1
LOG_SCANS=0
XMAS_SCAN=1
XMAS_PSH_SCAN=1
NMAP_XMAS_SCAN=1
NULL_SCAN=1
SYN_RST_SCAN=1
SYN_FIN_SCAN=1
# Generic Protection
print_status() {
if [ $1 == 1 ]; then
echo "Enabled"
else
echo "Disabled"
fi
}
print_statusex() {
printf "$1"
if [ $2 == 1 ]; then
echo "Enabled"
else
echo "Disabled"
fi
}
echo " Setting up..."
printf " SYN-Flood protection "
if [ -f /proc/sys/net/ipv4/tcp_syncookies ]; then
echo $SYN_FLOOD_PROTECTION > /proc/sys/net/ipv4/tcp_syncookies
print_status $SYN_FLOOD_PROTECTION
else
echo "Default"
fi
printf " Ignore ICMP broadcasts "
if [ -f /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ] && [ $ICMP_IGNORE_BROADCAST == 1 ]; then
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
print_status $ICMP_IGNORE_BROADCAST
else
echo "Default"
fi
printf " Log Martians "
if [ -f /proc/sys/net/ipv4/conf/all/log_martians ]; then
echo $LOG_MARTIANS > /proc/sys/net/ipv4/conf/all/log_martians
print_status $LOG_MARTIANS
else
echo "Default"
fi
printf " TCP Timestamps "
if [ -f /proc/sys/net/ipv4/tcp_timestamps ]; then
echo $TCP_TIMESTAMPS > /proc/sys/net/ipv4/tcp_timestamps
print_status $TCP_TIMESTAMPS
else
echo "Default"
fi
printf " ICMP redirects "
if [ -f /proc/sys/net/ipv4/conf/all/accept_redirects ]; then
echo $ICMP_REDIRECTS > /proc/sys/net/ipv4/conf/all/accept_redirects
print_status $ICMP_REDIRECTS
else
echo "Default"
fi
printf " Accept source route "
if [ -f /proc/sys/net/ipv4/conf/all/accept_source_route ]; then
echo $ACCEPT_SOURCE_ROUTE > /proc/sys/net/ipv4/conf/all/accept_source_route
print_status $ACCEPT_SOURCE_ROUTE
else
echo "Default"
fi
printf " Ignore bad ICMP msgs "
if [ -f /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]; then
echo $ICMP_IGNORE_BAD_MSGS > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
print_status $ICMP_IGNORE_BAD_MSGS
else
echo "Default"
fi
modprobe nf_conntrack_ftp
modprobe ip_conntrack_ftp
# maximum number of simultaneous entries per banlist
modprobe ipt_recent ip_list_tot=200;
#
# This implies -F, -X, -P and all rules (-A)..
#
/sbin/iptables-restore <<-EOF
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:closed_tap - [0:0]
:limit01 - [0:0]
:permanent - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# Filter invalid connections
#
-A INPUT -m conntrack ! --ctstate NEW -j RETURN
#
# If banned, drop. Ban time: 1 day = 86400 sec
#
############################ PERMINANT NON-CONDITIONAL BANS #########################
# Andy & Beast
-A permanent -s 82.47.27.102 -j DROP
# Test Daemon
#-A permanent -s 62.3.204.130 -j DROP
-A INPUT -j permanent
-A INPUT -m recent --name ban01 --rcheck --seconds 86400 -j DROP
############################ 5 MIN BAN STEPPING ON CLOSED PORT ######################
-A INPUT -p tcp -m multiport --dport 21,25,88,110,161,162,2222,15534 -m recent --name closed_tap --rcheck --seconds 300 -j DROP
########################### DDOS PROTECTION (SOS) ###################################
#-A ddos_watch -m hashlimit --hashlimit-name ddos_watch --hashlimit 50/second --hashlimit-mode dstport -j RETURN
#-A ddos_watch -p tcp -m tcp -j REJECT --reject-with tcp-reset
#-A INPUT -d 217.146.89.130 -p tcp -m tcp -m multiport --dports 80,443 -j ddos_watch
#-A INPUT -d 217.146.89.131 -p tcp -m tcp -m multiport --dports 80,443 -j ddos_watch
#-A INPUT -d 217.146.89.132 -p tcp -m tcp -m multiport --dports 80,443 -j ddos_watch
############################ UN-RATE LIMITED PORTS ##################################
-A INPUT -d 217.146.89.130 -p tcp -m tcp -m multiport --dports 110,161,162,2222 -j ACCEPT
-A INPUT -d 217.146.89.130 -p udp -m udp -m multiport --dports 161,162 -j ACCEPT
-A INPUT -d 217.146.89.131 -p tcp -m tcp -m multiport --dports 110,2222 -j ACCEPT
-A INPUT -d 217.146.89.132 -p tcp -m tcp -m multiport --dports 110 -j ACCEPT
-A INPUT -d 217.146.89.230 -p tcp -m tcp -m multiport --dports 15534,27055,51234 -j ACCEPT
-A INPUT -d 217.146.89.230 -p udp -m udp -m multiport --dports 27000:27057 -j ACCEPT
-A INPUT -d 217.146.89.240 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -d 217.146.89.240 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -d 217.146.89.241 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -d 217.146.89.241 -p udp -m udp --dport 53 -j ACCEPT
############################ RATE LIMITED PORTS ####################################
-A limit01 -m hashlimit --hashlimit 10/minute --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name limit01 -j ACCEPT
-A limit01 -m recent --name ban01 --set
-A limit01 -j LOG --log-prefix "[Banned: limit reached] "
-A limit01 -j DROP
-A INPUT -d 217.146.89.130 -p tcp -m tcp -m multiport --dports 21,25,80,88,443 -j limit01
-A INPUT -d 217.146.89.131 -p tcp -m tcp -m multiport --dports 21,25,80,88,443 -j limit01
-A INPUT -d 217.146.89.132 -p tcp -m tcp -m multiport --dports 21,25,80,443 -j limit01
-A INPUT -d 217.146.89.230 -p udp -m udp --dport 8767 -j limit01
####################################################################################
#
# If someone steps on a closed port, remember his address
#
-A INPUT -m recent --name closed_tap --set
# Ban saved in /proc/net_ipt_recent/ban01
COMMIT
EOF
echo "Stopping old watch-bans instance";
#killproc -p /tmp/watch-bans.pid /usr/bin/perl;
killall watch-bans
echo
echo
echo Starting watch-bans
screen -A -m -d -S watch-bans /etc/init.d/watch-bans
echo
echo
echo