insmod ebtables
insmod ebt_mark
insmod ebtable_filter
#Reduce DoS'ing ability by reducing timeouts
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
echo 1 > /proc/sys/net/ipv4/tcp_window_scaling
echo 0 > /proc/sys/net/ipv4/tcp_sack
echo 1280 > /proc/sys/net/ipv4/tcp_max_syn_backlog
#SYN COOKIES
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "1" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
ifconfig eth0 promisc up
ifconfig eth1 promisc up
#####
#QOS#
#####
tc qdisc del dev eth0 root
tc qdisc del dev eth1 root
#Classify All as 13
tc qdisc add dev eth1 root handle 1: htb default 12
tc qdisc add dev eth0 root handle 1: htb default 12
#Limit to no more then 1024 KBITS totla
tc class add dev eth0 parent 1: classid 1:1 htb rate 1024KBit ceil 1024Kbit
tc class add dev eth1 parent 1: classid 1:1 htb rate 1024KBit ceil 1024Kbit
#Always have 50% allowed for HTTP
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 512KBit ceil 1024Kbit
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dport 80 0xffff flowid 1:10
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dport 422 0xffff flowid 1:10
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 512KBit ceil 1024Kbit
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dport 80 0xffff flowid 1:10
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dport 422 0xffff flowid 1:10
#Always have 40% kbps allowed for SSH
tc class add dev eth0 parent 1:1 classid 1:11 htb rate 409KBit ceil 1024Kbit
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dport 8022 0xffff flowid 1:11
tc class add dev eth1 parent 1:1 classid 1:11 htb rate 409KBit ceil 1024Kbit
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dport 8022 0xffff flowid 1:11
#Always have 10% kbps allowed for eveything else
tc class add dev eth0 parent 1:1 classid 1:12 htb rate 102Kbit ceil 1024Kbit
tc class add dev eth1 parent 1:1 classid 1:12 htb rate 102Kbit ceil 1024Kbit
##########
#FIREWALL#
##########
ebtables -F
iptables -F
iptables -N BOTNET
iptables -A BOTNET -j DROP -s 193.201.52.117
iptables -A BOTNET -j DROP -s 195.3.206.1
iptables -A BOTNET -j DROP -s 195.5.117.252
iptables -A BOTNET -j DROP -s 195.56.55.139
iptables -A BOTNET -j DROP -s 208.67.217.132
iptables -A BOTNET -j DROP -s 209.132.238.188
iptables -A BOTNET -j DROP -s 209.25.170.18
iptables -A BOTNET -j DROP -s 212.227.119.155
iptables -A BOTNET -j DROP -s 212.239.40.235
iptables -A BOTNET -j DROP -s 212.3.111.66
iptables -A BOTNET -j DROP -s 212.83.114.39
iptables -A BOTNET -j DROP -s 213.203.223.98
iptables -A BOTNET -j DROP -s 213.247.198.9
iptables -A BOTNET -j DROP -s 216.104.34.94
iptables -A BOTNET -j DROP -s 216.219.253.43
iptables -A BOTNET -j DROP -s 216.36.247.104
iptables -A BOTNET -j DROP -s 217.16.27.42
iptables -A BOTNET -j DROP -s 217.67.30.8
iptables -A BOTNET -j DROP -s 217.67.30.9
iptables -A BOTNET -j DROP -s 62.67.235.133
iptables -A BOTNET -j DROP -s 64.111.212.66
iptables -A BOTNET -j DROP -s 64.202.165.132
iptables -A BOTNET -j DROP -s 64.202.165.201
iptables -A BOTNET -j DROP -s 64.22.83.106
iptables -A BOTNET -j DROP -s 66.197.201.69
iptables -A BOTNET -j DROP -s 66.49.234.209
iptables -A BOTNET -j DROP -s 67.19.156.130
iptables -A BOTNET -j DROP -s 67.19.170.34
iptables -A BOTNET -j DROP -s 67.19.210.130
iptables -A BOTNET -j DROP -s 69.10.136.143
iptables -A BOTNET -j DROP -s 69.20.67.185
iptables -A BOTNET -j DROP -s 69.50.220.108
iptables -A BOTNET -j DROP -s 69.89.21.72
iptables -A BOTNET -j DROP -s 69.89.22.106
iptables -A BOTNET -j DROP -s 69.93.248.2
iptables -A BOTNET -j DROP -s 70.85.226.130
iptables -A BOTNET -j DROP -s 70.86.182.226
iptables -A BOTNET -j DROP -s 70.87.62.162
iptables -A BOTNET -j DROP -s 70.87.95.34
#iptables -A BOTNET -j DROP -s 72.29.69.171
#iptables -A BOTNET -j DROP -s 72.29.75.11
iptables -A BOTNET -j DROP -s 72.32.196.20/16
iptables -A BOTNET -j DROP -s 72.29.89.20/24
iptables -A BOTNET -j DROP -s 193.86.238.12
iptables -A BOTNET -j DROP -s 209.62.92.226
iptables -A BOTNET -j DROP -s 74.52.133.34
iptables -A BOTNET -j DROP -s 77.55.94.2
iptables -A BOTNET -j DROP -s 78.108.81.71
iptables -A BOTNET -j DROP -s 78.110.50.103
iptables -A BOTNET -j DROP -s 80.93.57.160
iptables -A BOTNET -j DROP -s 80.93.57.207
iptables -A BOTNET -j DROP -s 80.93.62.91
iptables -A BOTNET -j DROP -s 81.13.72.148
iptables -A BOTNET -j DROP -s 81.13.86.55
iptables -A BOTNET -j DROP -s 81.177.24.60
iptables -A BOTNET -j DROP -s 81.89.56.32
iptables -A BOTNET -j DROP -s 81.95.96.130
iptables -A BOTNET -j DROP -s 82.208.46.145
iptables -A BOTNET -j DROP -s 84.17.17.24
iptables -A BOTNET -j DROP -s 84.246.225.21
iptables -A BOTNET -j DROP -s 85.13.128.38
iptables -A BOTNET -j DROP -s 85.13.129.246
iptables -A BOTNET -j DROP -s 85.13.130.117
iptables -A BOTNET -j DROP -s 85.13.130.120
iptables -A BOTNET -j DROP -s 85.13.138.24
iptables -A BOTNET -j DROP -s 85.13.206.122
iptables -A BOTNET -j DROP -s 85.17.53.234
iptables -A BOTNET -j DROP -s 86.110.225.114
iptables -A BOTNET -j DROP -s 193.86.238.12
iptables -A BOTNET -j DROP -s 209.62.92.226
iptables -A BOTNET -j DROP -s 77.221.130.1/24
iptables -A BOTNET -j DROP -s 74.86.129.130
iptables -A BOTNET -j DROP -s 78.111.81.129
iptables -A BOTNET -j DROP -s 80.249.152.20
iptables -A BOTNET -j DROP -s 81.201.28.101
###SYN FLOOD
iptables -F syn-flood
iptables -N syn-flood
#iptables -A syn-flood -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -m limit --limit 5/second --limit-burst 10 -j RETURN
#iptables -A syn-flood -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -j LOG --log-prefix "SYN flood: "
#iptables -A syn-flood -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -j DROP
iptables -A syn-flood -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "SYN flood: State "
iptables -A syn-flood -p tcp ! --syn -m state --state NEW -j DROP
iptables -A syn-flood -m limit --limit 10/s --limit-burst 40 -j RETURN
iptables -A syn-flood -j LOG --log-prefix "SYN flood: Rate "
iptables -A syn-flood -j DROP
#iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 10/s --limit-burst 50 -j LOG --log-prefix "SYN flood: StateRate "
#iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 10/s --limit-burst 50 -j DROP
iptables -A FORWARD -i lo -j ACCEPT
iptables -A FORWARD -d 127.0.0.0/8 -j REJECT
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -j BOTNET
iptables -A FORWARD -p TCP --syn -j syn-flood
#iptables -A FORWARD -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -m limit --limit 5/second -j ACCEPT
#iptables -A FORWARD -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -j DROP
iptables -A FORWARD -j ACCEPT
###############
#Other Subnets#
###############
route add -net 207.112.13.176/28 br0