API tools faq
paste
Guest User

Arch Linux IpTables Web Server Script

a guest
Nov 28th, 2015
193
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 5.16 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. # Iptables Firewall 11/2015
  3.  
  4. SERVER_IP="192.168.1.10"
  5.  
  6. ##############
  7. # Clean first
  8. ##############
  9.  
  10. # Make sure service is started
  11.  systemctl restart iptables.service             &&
  12.  
  13. # Clean rules firs, start from scratch  
  14. # Resets iptables rules
  15. # It's your choice how you wan to do this, method a or b
  16.  
  17. # Method a
  18. # clean
  19. # iptables-restore < /etc/iptables/empty.rules      &&
  20.  
  21. # Method b (skipping forward and input)
  22.  iptables -F                        -v &&
  23.  iptables -X                        -v &&
  24.  iptables -t nat -F                     -v &&
  25.  iptables -t nat -X                     -v &&
  26.  iptables -t mangle -F                  -v &&
  27.  iptables -t mangle -X                  -v &&
  28.  iptables -t raw -F                     -v &&
  29.  iptables -t raw -X                     -v &&
  30.  iptables -t security -F                -v &&
  31.  iptables -t security -X                -v &&
  32.  iptables  -P OUTPUT ACCEPT                 -v &&
  33.  
  34. # Tighten and start some chains (leaving OUTPUT open fta)
  35.  iptables -P FORWARD DROP               -v &&
  36.  iptables -P INPUT DROP                 -v &&      
  37.  iptables -N TCP                    -v &&
  38.  iptables -N UDP                    -v &&
  39.  iptables -N IN_SSH                 -v &&
  40.  
  41. # Accept - keep alive existing to salvage any ssh conn
  42.  iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT     -v &&
  43.  
  44. # allow loopback
  45.  iptables -A INPUT -i lo -j ACCEPT                      -v &&
  46.  
  47. # drop any invalid
  48.  iptables -A INPUT -m conntrack --ctstate INVALID -j DROP           -v &&
  49.  
  50. # Accept - icmp echo request, important for good traffic flow, first packet only is new
  51.  iptables -A INPUT -p icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT   -v &&
  52.  
  53. # Command UDP and TCP input chains to take new incoming connections
  54.  iptables -A INPUT -p udp -m conntrack --ctstate NEW -j UDP             -v &&
  55.  iptables -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP       -v &&
  56.  
  57. # reject anything other ports with clean message drop and close (what about stealth according to grc?  should we not replyon these instead for stealth?)
  58.  iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable -v &&
  59.  iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset         -v &&
  60.  
  61. # Reject - final INPUT chain rule, securely reject unopened ports
  62. iptables -A INPUT -j REJECT --reject-with icmp-proto-unreachable    -v &&
  63.  
  64.  
  65. ################################
  66. # TCP UDP Chain Service rules
  67. ##############################
  68.  
  69. # ssh
  70.  iptables -A TCP -p tcp --dport 22 -j ACCEPT                -v &&
  71.  
  72. # www
  73.  iptables -A TCP -p tcp --dport 80 -j ACCEPT                -v &&
  74.  iptables -A TCP -p tcp --dport 443 -j ACCEPT               -v &&
  75.  iptables -A TCP -p tcp --dport 3000:3003 -j ACCEPT         -v &&
  76.  iptables -A TCP -p tcp --dport 27017 -j ACCEPT             -v &&
  77.  iptables -A TCP -p tcp --dport 35729 -j ACCEPT             -v &&
  78.  
  79. ## DNS
  80.  iptables -A UDP -s 192.168.1.0/24 -p udp --dport 53 -j ACCEPT      -v &&
  81.  iptables -A TCP -s 192.168.1.0/24 -p tcp --dport 953 -j ACCEPT     -v &&
  82.  
  83. ## Samba
  84.  iptables -A UDP -s 192.168.1.0/24 -p udp --dport 137:138 -j ACCEPT -v &&
  85.  iptables -A TCP -s 192.168.1.0/24 -p tcp --dport 139 -j ACCEPT     -v &&
  86.  iptables -A UDP -s 192.168.1.0/24 -p udp --dport 445 -j ACCEPT     -v &&
  87.  iptables -A TCP -s 192.168.1.0/24 -p tcp --dport 445 -j ACCEPT     -v &&
  88.  
  89.  
  90. ################
  91. #More Hardening
  92. ################
  93.  
  94. # Mitigate brute force
  95.  iptables -A TCP -p tcp --dport 22 -j IN_SSH                                -v &&
  96.  iptables -A IN_SSH -m recent --name sshbf --rttl --rcheck --hitcount 3 --seconds 10 -j DROP        -v &&
  97.  iptables -A IN_SSH -m recent --name sshbf --rttl --rcheck --hitcount 4 --seconds 1800 -j DROP      -v &&
  98.  iptables -A IN_SSH -m recent --name sshbf --set -j ACCEPT                      -v &&
  99.  
  100. #Block various port scanners
  101.  iptables -I TCP -p tcp --dport 80 -m string --algo bm --string 'GET /w00tw00t.at.ISC.SANS.' -j DROP    -v &&
  102.  
  103. #######################
  104. # End iptables ruleset
  105. #
  106. # Save and restart
  107. ######################
  108.  iptables-save > /etc/iptables/iptables.rules               &&
  109.  systemctl restart iptables
  110.  
  111.  
  112. ########
  113. # NOTES
  114. ########
  115.  
  116. # for self testing watch incoming attempts `cat /proc/net/xt_recent/sshbf`
  117. # unblock IP during testing, from root `# echo / > /proc/net/xt_recent/sshbf
  118.  
  119.  
  120.  
  121.  
  122.  
  123. ##########
  124. # NOT USED
  125. ##########
  126.  
  127. # iptables -A OUTPUT -p tcp -s $SERVER_IP --sport 80 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
  128. # iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
  129. # iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
  130. # iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
  131. # iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
  132. # iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
  133. # iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
  134. # iptables -A OUTPUT -p tcp --dport 3306 -j ACCEPT
  135. # iptables -A OUTPUT -p tcp --dport 8080 -j ACCEPT
  136. # iptables -A OUTPUT -p tcp --dport 8009 -j ACCEPT
  137. # iptables -A OUTPUT -p tcp --dport 11211 -j ACCEPT
  138. # iptables -A OUTPUT -p tcp --dport 58069 -j ACCEPT
  139. # iptables -A OUTPUT -p tcp --dport 8140 -j ACCEPT
  140. # iptables -A OUTPUT -p tcp --dport 5224 -j ACCEPT
  141. # iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
  142.  
  143. #more ssh stuff, testing
  144. ## iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT     -v &&
  145. # iptables -A TCP -p tcp --dport 22 -m conntrack --ctstate NEW -j IN_SSH            -v &&
  146. ## iptables -A TCP -p tcp --dport 22 -j IN_SSH                      -v &&
  147. # iptables -A UDP -p udp -m conntrack --ctstate NEW -j UDP                  -v &&
  148. ## iptables -A UDP -p udp -j UDP                                -v &&
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!