API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 7th, 2011
289
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 54.80 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. # ----------------------------------------------------------------------|
  3. # This is it...MonMotha's Firewall 2.3.8-pre9! |
  4. # I wrote a firewall and all I got was this cheesy tagline |
  5. # ----------------------------------------------------------------------|
  6. # 2.3 RELEASE NOTES: This is the 2.2 series with some extra stuff, |
  7. # including MAC address matching, stateful matching, port forwarding, |
  8. # per-proto accept behavior, and some other stuff that I might think |
  9. # about adding later. |
  10. # ----------------------------------------------------------------------|
  11. # COMMENTS from MonMotha: |
  12. # |
  13. # Please do not email me directly with usage questions. I don't have |
  14. # the time or resources to keep up. Check the configuration help at |
  15. # the URL posted below then post to the users list if you have any |
  16. # further questions. |
  17. # --MonMotha |
  18. # |
  19. # When emailing me or the mailing lists, keep in mind that HTML email |
  20. # may be silently rejected as an anti-spam measure. Configure your UA |
  21. # to use plain text for mail. |
  22. # --MonMotha |
  23. # |
  24. # A list of known bugs can be found at: |
  25. # http://www.mplug.org/phpwiki/index.php?MonMothaKnownBugs |
  26. # please check this list before reporting bugs. Bugs can be reported |
  27. # directly to me or to the devel mailing list. Please ask to be CCed |
  28. # if you mail the devel list and are not a member. |
  29. # --MonMotha |
  30. # |
  31. # Mailing lists are now available. See the distribution website at |
  32. # <http://monmotha.mplug.org> for more info. |
  33. # --MonMotha |
  34. # |
  35. # Note another change of my email address. New address is: |
  36. # <monmotha@indy.rr.com>. Hopefully I can keep this one for a while. |
  37. # --MonMotha |
  38. # |
  39. # I will be entering "feature freeze" when 2.3.8 goes final. Please |
  40. # make sure to have any patches or feature requests in by then. |
  41. # I expect 2.3.7 to be closing in on deserving the "stable" marking. |
  42. # --MonMotha |
  43. # |
  44. # Please note the change of my e-mail address. The new address is: |
  45. # obi-wan@starwarsfan.com. The old address (bvmopen@usa.net) will be |
  46. # discontinued as of July 31, 2001. |
  47. # --MonMotha |
  48. # |
  49. # When e-mailing to report a bug, please check first that it has not |
  50. # already been fixed in the next prerelease (which can be found at the |
  51. # distribution site). |
  52. # --MonMotha |
  53. # |
  54. # Before e-mailing me, please check the distribution site (which can be |
  55. # found at http://freshmeat.net/projects/mothafirewall as it changes |
  56. # sometimes) for a new version. |
  57. # --MonMotha |
  58. # |
  59. # Please...PLEASE give me feedback on your experiences with this script |
  60. # I would really like to know what everyone wants, what works, and |
  61. # about the inevitable bugs present in anything. |
  62. # |
  63. # Direct all feedback to: monmotha@indy.rr.com |
  64. # --MonMotha |
  65. # |
  66. # When e-mailing with problems, please include firewall script version, |
  67. # iptables version, kernel version, and GNU BASH version. If you think |
  68. # your problem might be related to kernel configuration, please attach |
  69. # the .config file for your kernel. |
  70. # --MonMotha |
  71. # |
  72. # ----------------------------------------------------------------------|
  73. # SYSTEM REQUIREMENTS: You must have either compiled the appropriate |
  74. # iptables support into your 2.4 kernel or have loaded all the |
  75. # applicable modules BEFORE you run this script. This script will not |
  76. # load modules for you. |
  77. # |
  78. # You will need (at least) the following kernel options to use |
  79. # this firewall: CONFIG_NETFILTER, CONFIG_IP_NF_IPTABLES, |
  80. # CONFIG_IP_NF_FILTER, CONFIG_IP_NF_MATCH_STATE and |
  81. # CONFIG_IP_NF_TARGET_REJECT. |
  82. # To use the masquerading you will also need (at least): |
  83. # CONFIG_IP_NF_CONNTRACK, CONFIG_IP_NF_NAT, CONFIG_IP_NF_NAT_NEEDED |
  84. # and CONFIG_IP_NF_TARGET_MASQUERADE. |
  85. # Additional options may be needed to use other features. |
  86. # |
  87. # You need iptables. Get it at "http://netfilter.filewatcher.org". |
  88. # Some of the features will need patches only present in the CVS |
  89. # |
  90. # This script was written (and partially tested) with iptables CVS |
  91. # and kernel 2.4.x (non testing) in mind. |
  92. # |
  93. # Also, this is a BASH shell script...any 2.x version of GNU BASH |
  94. # should work. |
  95. # ----------------------------------------------------------------------|
  96. # |
  97. # ALL USERS, READ THE FOLLOWING: |
  98. # |
  99. # This is distributed under the BSD liscense sans advertising clause: |
  100. # |
  101. # Redistribution and use in source and binary forms, with or without |
  102. # modification, are permitted provided that the following conditions |
  103. # are met: |
  104. # |
  105. # 1.Redistributions of source code must retain the above copyright |
  106. # notice, this list of conditions and the following disclaimer. |
  107. # 2.Redistributions in binary form must reproduce the above |
  108. # copyright notice, this list of conditions and the following |
  109. # disclaimer in the documentation and/or other materials provided |
  110. # with the distribution. |
  111. # 3.The name of the author may not be used to endorse or promote |
  112. # products derived from this software without specific prior |
  113. # written permission. |
  114. # |
  115. # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
  116. # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
  117. # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
  118. # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
  119. # DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
  120. # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE |
  121. # GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
  122. # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER |
  123. # IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR |
  124. # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN |
  125. # IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE |
  126. # |
  127. # While this may be used freely for commercial use, I do REQUEST that |
  128. # any commercial users please tell me via e-mail at |
  129. # monmotha@indy.rr.com that they are using it, why they chose it, |
  130. # how well it works, etc. |
  131. # |
  132. # ----------------------------------------------------------------------|
  133. # IMPORTANT: This firewall is currently in beta! It may be too |
  134. # restrictive or insecure. |
  135. # ----------------------------------------------------------------------|
  136. # CHANGELOG: (Since 2.3.0-pre1a only) |
  137. # version 2.3.8-pre9: Correct typo in config help wiki |
  138. # Re-order FILTER_CHAINS for TREJECT change |
  139. # rp_filter support multiple INET interfaces |
  140. # version 2.3.8-pre8: Fix typo in ULREJECT chain creation status |
  141. # Remove one-liner config help - use wiki |
  142. # version 2.3.8-pre8b: Show liscense on unconfigured run |
  143. # Experimental multiple internet devices |
  144. # -Breakage of DMZ guaranteed |
  145. # version 2.3.8-pre8a: LTREJECT jump to TREJECT after logging |
  146. # Fix transparent proxy when on masqed LAN; |
  147. # See discussion list archives for Jun |
  148. # 2002 for more info |
  149. # Clarify source route messages |
  150. # version 2.3.8-pre7: Fix syntax error in ALLOW_HOSTWISE_PROTO |
  151. # version 2.3.8-pre7b: More sanity checking |
  152. # LOCIP option for DENY_HOSTWISE options |
  153. # LOCIP option for DENY_ALL |
  154. # version 2.3.8-pre7a: Clarify liscense |
  155. # Alias TCP_ALLOW and UDP_ALLOW to |
  156. # ALLOW_HOSTWISE_xxx as they contain |
  157. # redundant code |
  158. # Move BAD_ICMP to non-experimental options |
  159. # Changed exit status; review your scripts |
  160. # Additional sanity checking |
  161. # Add ALLOW_HOSTWISE_PROTO option |
  162. # version 2.3.8-pre6: Fix comment errors |
  163. # Fix a bug in config checks |
  164. # Add BRAINDEAD_ISP option |
  165. # version 2.3.8-pre5: More fixes for multiple LAN interfaces |
  166. # Fix a syntax error in ALLOW_HOSTWISE_TCP |
  167. # version 2.3.8-pre5d: Intersubnet Routing should work again |
  168. # TOS Mangles default to off |
  169. # version 2.3.8-pre5c: Port forwards apply to all interfaces only |
  170. # when LOCIP is used |
  171. # Multiple LAN Interfaces (breaks DMZ) |
  172. # version 2.3.8-pre5b: Fix missing fi near line 1160 |
  173. # version 2.3.8-pre5a: Fix BAD_ICMP and echo-request |
  174. # Fix port forwards |
  175. # Add checks for limit and REJECT |
  176. # Local IP options for TCP/UDP allows (and |
  177. # hostwise allows) |
  178. # Port forwards now apply to all interfaces |
  179. # Remove redundant disclaimer |
  180. # version 2.3.8-pre4: Fix typo in SUPER_EXEMPT |
  181. # Fix reversal of DMZIN/OUT |
  182. # Fix reversed logic in port forwards |
  183. # version 2.3.8-pre3: Fix DHCP server syntax error |
  184. # Replace ALLOW_ALL with SUPER_EXEMPT |
  185. # Fix ALLOW_OUT_TCP |
  186. # Fix SNAT status reporting |
  187. # Removed some obsoleted code |
  188. # Move DHCP server to stable options |
  189. # Add local IP to port forwards |
  190. # version 2.3.8-pre2: Don't create ULDROP unless used in case |
  191. # system doesn't have ULOG support |
  192. # ALLOW_OUT_TCP now allows a destination port |
  193. # Additional sanity checks |
  194. # Add ULREJECT and ULTREJECT targets |
  195. # BLACKHOLEs should now work |
  196. # Fix status reporting in local traffic rules |
  197. # DMZ Fixes (Hans Bieshaar) |
  198. # Flush and delete SYSTEST (Hans) |
  199. # Syncookies set off if not on (Hans) |
  200. # Fix REJECT messages for ICMP (Hans) |
  201. # Explicit denies are now global (Hans) |
  202. # Remove FORWARD -d $INTERNAL_LAN; it is not |
  203. # needed for internet and can pose a |
  204. # security risk (this may break things) |
  205. # (Hans) |
  206. # SYNCOOKIES default to off (Hans) |
  207. # We had a debate on this one, feel free |
  208. # to email me regarding it. |
  209. # Config directives for RP_FILTER and |
  210. # accept strict source routed (Hans) |
  211. # Add BAD_ICMP directive |
  212. # version 2.3.8-pre1: Add ULDROP (ULOG and DROP) target |
  213. # Restructuring to allow the following: |
  214. # BLACKHOLEs are now global (not just inet) |
  215. # All explicit denies override TCP/UDP |
  216. # forwards. |
  217. # All explicit denies ovrride ALLOW_HOSTWISE |
  218. # BLACKHOLEs should now work for computers |
  219. # behind the firewall as well as the |
  220. # firewall itself. |
  221. # Fix for iptables 1.2.3 log level info |
  222. # version 2.3.7: No changes from pre8 |
  223. # version 2.3.7-pre8: Change email address on liscense |
  224. # Revert to pre6 behavior of dropping ICMP |
  225. # echo-request (take global DROP= policy) |
  226. # Allow everything from interface lo |
  227. # Correct pre7 changelog |
  228. # Special rules for DHCP servers |
  229. # version 2.3.7-pre7: Fix version number in changelog entry below |
  230. # Fix 127.0.0.1 INPUT handling. |
  231. # Only enable IP forwarding if it's needed |
  232. # (INTERNAL_LAN defined) |
  233. # Tweak flood parameters |
  234. # Hostwise allows now override explicit, |
  235. # denies but not blackholes |
  236. # ICMP echo-request will no longer take the |
  237. # specified drop policy when it doesn't |
  238. # comply with limits, straight DROP will |
  239. # be used instead |
  240. # Fix REJECT handling in TREJECT and LTREJECT |
  241. # Add transparent proxy support (Joshua Link) |
  242. # version 2.3.7-pre6: Fix status reporting on SSR SysCtl loop |
  243. # Fix the SSR SysCtl loop |
  244. # Remove stateful match from forward chain |
  245. # version 2.3.7-pre5: Make the default policy actually be DROP |
  246. # instead of just saying it is |
  247. # Add stateful matching to forward chain to |
  248. # prevent people from routing onto your |
  249. # internal network (please tell me if |
  250. # breaks anything). Thanks to Martin |
  251. # Mosny for noticing this |
  252. # Block Source Routed Packets to help with |
  253. # the above problem |
  254. # Add option for TCP SynCookies on or off |
  255. # Fix BLACKHOLE directive (was being applied |
  256. # to INPUT/OUTPUT after the jump for |
  257. # INETIN/INETOUT so didn't apply for |
  258. # the internet). Thanks to Gerry Doris |
  259. # for noticing this |
  260. # Add DHCP client to default UDP port allows |
  261. # Note email address change |
  262. # Changed emphesis in comments |
  263. # Forwarding of port ranges (Vinny and Eddie) |
  264. # version 2.3.7-pre4: Line 414, missing subnet match caused all |
  265. # packets from anywhere to be allowed. |
  266. # Fixed. |
  267. # version 2.3.7-pre3: Fix missing fi (fatal syntax error) |
  268. # Fix logging in TCPACCEPT chain |
  269. # version 2.3.7-pre2: Add route verification (thanks to Jeremy |
  270. # Frank) |
  271. # Add blackhole directive |
  272. # Updated configuration sanity checks |
  273. # Ripped out SSH Stuff as it isn't needed |
  274. # True default DROP on INPUT |
  275. # Don't run the INTERNAL_LAN loop if no nets |
  276. # Upped the default SYN limit as large |
  277. # numbers of small FTP transfers would |
  278. # overload it quickly |
  279. # Form cleanups |
  280. # version 2.3.7-pre1: Maybe the FTP will work now (fixes for the |
  281. # RELATED state) |
  282. # Now works with both LAN and DMZ iface null |
  283. # Moved static NAT to stable options |
  284. # Change parser to /bin/bash not /bin/sh |
  285. # version 2.3.6: Add TTL mangling |
  286. # Added some more EFNet servers to the list |
  287. # Fix in the DMZOUT chain |
  288. # Fix FTP stuff |
  289. # version 2.3.5: Fixes to make port forwarding work again |
  290. # version 2.3.4: USE_MASQ has been changed to MASQ_LAN in port fw |
  291. # Fix syntax error in TCP port forwards |
  292. # General cleanup |
  293. # Fixes in port forwarding |
  294. # It's LTREJECT, not TLREJECT |
  295. # More TOS mangling |
  296. # version 2.3.3: Fatal syntax error in IP forward detect fix |
  297. # Don't bail on no IP forward for no LAN |
  298. # version 2.3.3-pre1: Reject with tcp-reset for TCP option |
  299. # Removed the huge list of censorship |
  300. # Moved the port forwards to stable options |
  301. # Moved the TOS mangling to stable options |
  302. # Check before enabling IP Forwarding and |
  303. # IP SynCookies |
  304. # Don't run censorship loop if no rules |
  305. # Request low latency TOS on UDP packets for |
  306. # games on ports 4000-7000 (Diablo II) |
  307. # Fix bad syntax in the port forwarding loops |
  308. # Reversed DMZIN and DMZOUT fixed |
  309. # Various syntax fixes |
  310. # Stateful inspection on forward chain |
  311. # Other stateful matching changes |
  312. # version 2.3.2: Fixed bad syntax in DMZ_IFACE loop |
  313. # version 2.3.2-pre2: Put a real liscense on it (BSD liscense) |
  314. # Changed format of ALLOW_HOSTWISE and |
  315. # DENY_HOSTWISE to be less confusing |
  316. # (the ":" was changed to ">") |
  317. # Added LOG_FLOOD option to tweak log limit |
  318. # Added SYN_FLOOD option to tweak SYN limit |
  319. # Added PING_FLOOD option to tweak PING limit |
  320. # version 2.3.2-pre1: Stateful matching on active FTP and SSH |
  321. # rules (thanks to Len Padilla) |
  322. # Fixed a minor bug in chain creation order |
  323. # (thanks to Peter Lindman) |
  324. # TOS Optimizations (thanks to vesa alatalo) |
  325. # Begin DMZ Support |
  326. # Proofread comments and correct |
  327. # Use BASH builtins instead of sed |
  328. # (thanks to Craig Ludington) |
  329. # Fixed "USE_SNAT" bug in port forwarding |
  330. # (has been changed to "SNAT_LAN") |
  331. # (thanks to Frédéric Marchand) |
  332. # Tuned down default TCP allows (remove POP3) |
  333. # version 2.3.1: Option for 1:1 or subnet:1 static NAT |
  334. # Internet censorship options |
  335. # version 2.3.1-pre2: Added option to deny specific ports from |
  336. # specific hosts |
  337. # Added limiting to logging chains to prevent |
  338. # log DoSing |
  339. # Spiffed up comments |
  340. # Changed the "AUTH_ALLOW" and "DNS" options |
  341. # to be more generic and flexible |
  342. # version 2.3.1-pre1: Updated comments for new kernel version |
  343. # Removed double drop setting |
  344. # Updated for iptables-1.2 |
  345. # Began a kernel option list |
  346. # version 2.3.0: No changes from pre1g |
  347. # version 2.3.0-pre1g: Tuned down default TCP allows |
  348. # Restructure to SSH loop |
  349. # Status Reporting Fixes (newlines, etc.) |
  350. # Fix log prefix length on accept loops |
  351. # version 2.3.0-pre1f: Moved the ICMP echo-request limit to where |
  352. # it should have been |
  353. # Allows the rest of the ICMP like it should |
  354. # Remove the interface matching from ICMP |
  355. # echo-request (not needed) |
  356. # version 2.3.0-pre1e: Fixed an issue in the invalid matching |
  357. # version 2.3.0-pre1d: Spiffed up comments |
  358. # Port Forwarding |
  359. # Moved the deny setting to normal options |
  360. # version 2.3.0-pre1c: Minor fixes that don't (currently) affect |
  361. # functionality |
  362. # version 2.3.0-pre1b: Security fix documented in 2.1.13 |
  363. # Slight logic change in TCP_ALLOW loop |
  364. # Don't print allow messages if nothign is |
  365. # allowed by that loop |
  366. # Changed IPTables download URL |
  367. # version 2.3.0-pre1a: Initial branch from 2.1.12 |
  368. # Add stuff in release notes except port fw |
  369. # ----------------------------------------------------------------------|
  370. # You NEED to set this! |
  371. # Configuration follows: |
  372. # |
  373. # Main configuration, modify to suit your setup. Help can be found at:
  374.  
  375. # -------------------------------------------------------------------------
  376. # |!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!|
  377. # |!*********************************************************************!|
  378. # |!*** http://www.mplug.org/phpwiki/index.php?MonMothaReferenceGuide ***!|
  379. # |!*********************************************************************!|
  380. # |!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!|
  381. # -------------------------------------------------------------------------
  382. # --------------------------READ THE URL ABOVE!----------------------------
  383. # -------------------------------------------------------------------------
  384.  
  385. # Main Options
  386. IPTABLES="/sbin/iptables"
  387. TCP_ALLOW="53 67 68 80 6000 6001 6002 6003 49200 22 113 139 445 8080 20666 20668 49152"
  388. UDP_ALLOW="53 67 68 177 68 6112 6119 4000 137 138 20667"
  389. INET_IFACE="ppp0"
  390. LAN_IFACE="wlan0"
  391. INTERNAL_LAN="192.168.2.0/24 192.168.43.0/24"
  392. MASQ_LAN="192.168.2.0/24 192.168.43.0/24"
  393. SNAT_LAN=""
  394. DROP="TREJECT"
  395. DENY_ALL=""
  396. DENY_HOSTWISE_TCP=""
  397. DENY_HOSTWISE_UDP=""
  398. BLACKHOLE=""
  399. BLACKHOLE_DROP="DROP"
  400. ALLOW_HOSTWISE_TCP=""
  401. ALLOW_HOSTWISE_UDP=""
  402. TCP_FW=""
  403. UDP_FW=""
  404. MANGLE_TOS_OPTIMIZE="FALSE"
  405. DHCP_SERVER="TRUE"
  406. BAD_ICMP="5 9 10 15 16 17 18"
  407. ENABLE="Y"
  408.  
  409. # Flood Params
  410. LOG_FLOOD="2/s"
  411. SYN_FLOOD="20/s"
  412. PING_FLOOD="1/s"
  413.  
  414. # Outbound filters
  415. # FIXME: Update config help wiki then remove one-liner help
  416. ALLOW_OUT_TCP="" # Internal hosts allowed to be forwarded out on TCP (do not put this/these host/s in INTERNAL_LAN, but do define their method of access [snat, masq] if not a public ip)
  417. PROXY="" # Redirect for Squid or other TRANSPARENT proxy. Syntax to specify the proxy is "host:port".
  418. MY_IP="" # Set to the internal IP of this box (with the firewall), only needed for PROXY=
  419.  
  420. # Below here is experimental (please report your successes/failures)
  421. MAC_MASQ="" # Currently Broken
  422. MAC_SNAT="" # Ditto...
  423. TTL_SAFE=""
  424. USE_SYNCOOKIES="FALSE"
  425. RP_FILTER="TRUE"
  426. ACCEPT_SOURCE_ROUTE="FALSE"
  427. SUPER_EXEMPT=""
  428. BRAINDEAD_ISP="FALSE"
  429. ALLOW_HOSTWISE_PROTO=""
  430.  
  431. # Only touch these if you're daring (PREALPHA stuff, as in basically non-functional)
  432. DMZ_IFACE="" # Interface your DMZ is on (leave blank if you don't have one) - Obsolete: Will be removed before 2.4.0
  433.  
  434.  
  435. # ----------------------------------------------------------------------|
  436. # These control basic script behavior; there should be no need to |
  437. # change any of these settings for normal use. |
  438. # ----------------------------------------------------------------------|
  439. FILTER_CHAINS="INETIN INETOUT DMZIN DMZOUT TCPACCEPT UDPACCEPT LDROP LREJECT LTREJECT TREJECT"
  440. UL_FILTER_CHAINS="ULDROP ULREJECT ULTREJECT"
  441. LOOP_IFACE="lo"
  442.  
  443. # Colors
  444. NORMAL="\033[0m"
  445. GREEN=$'\e[32;01m'
  446. YELLOW=$'\e[33;01m'
  447. RED=$'\e[31;01m'
  448. NORMAL=$'\e[0m'
  449.  
  450. # Undocumented Features
  451. OVERRIDE_NO_FORWARD="FALSE"
  452. OVERRIDE_SANITY_CHECKS="FALSE"
  453.  
  454. # ----------------------------------------------------------------------|
  455. # You shouldn't need to modify anything below here |
  456. # Main Script Starts |
  457. # ----------------------------------------------------------------------|
  458.  
  459. # Let's load it!
  460. echo "Loading iptables firewall:"
  461.  
  462. # Configuration Sanity Checks
  463. echo -n "Checking configuration..."
  464.  
  465. if [ "$OVERRIDE_SANITY_CHECKS" = "TRUE" ] ; then
  466. echo "skipped! If it breaks, don't complain!"
  467. echo "If there's a reason you needed to do this, please report to the developers list!"
  468. echo
  469. echo -n "Wait 5 seconds..."
  470. sleep 5
  471. echo "continuing"
  472. echo
  473. echo
  474. else
  475. # Has it been configured?
  476. if ! [ "$ENABLE" = "Y" ] ; then
  477. echo
  478. echo "${RED}You need to *EDIT YOUR CONFIGURATION* and set ENABLE to Y!"
  479. echo "${YELLOW}End User Liscense Agreement:${NORMAL}"
  480. echo -n "$GREEN"
  481. cat << EOF
  482.  
  483. Redistribution and use in source and binary forms, with or without
  484. modification, are permitted provided that the following conditions
  485. are met:
  486.  
  487. 1.Redistributions of source code must retain the above copyright
  488. notice, this list of conditions and the following disclaimer.
  489. 2.Redistributions in binary form must reproduce the above
  490. copyright notice, this list of conditions and the following
  491. disclaimer in the documentation and/or other materials provided
  492. with the distribution.
  493. 3.The name of the author may not be used to endorse or promote
  494. products derived from this software without specific prior
  495. written permission.
  496.  
  497. THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  498. IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  499. WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  500. ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  501. DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  502. DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
  503. GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  504. INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  505. IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  506. OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
  507. IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE
  508.  
  509. EOF
  510. echo "${RED}You need to *EDIT YOUR CONFIGURATION* and set ENABLE to Y!${NORMAL}"
  511. exit 99
  512. fi
  513.  
  514. # It's hard to run an iptables script without iptables...
  515. if ! [ -x $IPTABLES ] ; then
  516. echo
  517. echo "ERROR IN CONFIGURATION: ${IPTABLES} doesn't exist or isn't executable!"
  518. exit 4
  519. fi
  520.  
  521. # Basic interface sanity
  522. for dev in ${LAN_IFACE} ; do
  523. if [ "$dev" = "${DMZ_IFACE}" ] && [ "$dev" != "" ]; then
  524. echo
  525. echo "ERROR IN CONFIGURATION: DMZ_IFACE and LAN_IFACE can't have a duplicate interface!"
  526. exit 1
  527. fi
  528. done
  529.  
  530. # Create a test chain to work with for system ablilities testing
  531. ${IPTABLES} -N SYSTEST
  532. if [ "$?" != "0" ] ; then
  533. echo
  534. echo "IPTABLES can't create new chains or the script was interrupted previously!"
  535. echo "Flush IPTABLES rulesets and chains and try again."
  536. exit 4
  537. fi
  538.  
  539. # Check for ULOG support
  540. ${IPTABLES} -A SYSTEST -j ULOG > /dev/null 2>&1
  541. if [ "$?" = "0" ] ; then
  542. HAVE_ULOG="true"
  543. else
  544. HAVE_ULOG="false"
  545. fi
  546.  
  547. # Check for LOG support
  548. ${IPTABLES} -A SYSTEST -j LOG > /dev/null 2>&1
  549. if [ "$?" != "0" ] ; then
  550. echo
  551. echo "Your kernel lacks LOG support reqiored by this script. Aborting."
  552. exit 3
  553. fi
  554.  
  555. # Check for stateful matching
  556. ${IPTABLES} -A SYSTEST -m state --state ESTABLISHED -j ACCEPT > /dev/null 2>&1
  557. if [ "$?" != "0" ] ; then
  558. echo
  559. echo "Your kernel lacks stateful matching, this would break this script. Aborting."
  560. exit 3
  561. fi
  562.  
  563. # Check for the limit match
  564. ${IPTABLES} -A SYSTEST -m limit -j ACCEPT > /dev/null 2>&1
  565. if [ "$?" != "0" ] ; then
  566. echo
  567. echo "Support not found for limiting needed by this script. Aborting."
  568. exit 3
  569. fi
  570.  
  571. # Check for REJECT
  572. ${IPTABLES} -A SYSTEST -j REJECT > /dev/null 2>&1
  573. if [ "$?" != "0" ] ; then
  574. echo
  575. echo "Support not found for the REJECT target needed by this script. Aborting."
  576. exit 3
  577. fi
  578.  
  579. # Check DROP sanity
  580. if [ "$DROP" = "" ] ; then
  581. echo
  582. echo "There needs to be a DROP policy (try TREJECT)!"
  583. exit 1
  584. fi
  585. if [ "$DROP" = "ACCEPT" ] ; then
  586. echo
  587. echo "The DROP policy is set to ACCEPT; there is no point in loading the firewall as there wouldn't be one."
  588. exit 2
  589. fi
  590. if [ "$DROP" = "ULDROP" ] || [ "$DROP" = "ULREJECT" ] || [ "$DROP" = "ULTREJECT" ] ; then
  591. if [ "$HAVE_ULOG" != "true" ] ; then
  592. echo
  593. echo "You have selected a ULOG policy, but your system lacks ULOG support."
  594. echo "Please choose a policy that your system has support for."
  595. exit 5
  596. fi
  597. fi
  598.  
  599. # Problems with blackholes?
  600. if [ "$BLACKHOLE" != "" ] && [ "$BLACKHOLE_DROP" = "" ] ; then
  601. echo
  602. echo "You can't use blackholes and not have a policy for them!"
  603. exit 1
  604. fi
  605.  
  606. # Flush and remove the chain SYSTEST
  607. ${IPTABLES} -F SYSTEST
  608. ${IPTABLES} -X SYSTEST
  609.  
  610. # Seems ok...
  611. echo "passed"
  612. fi #from override option
  613.  
  614. # ===============================================
  615. # ----------------Preprocessing------------------
  616. # ===============================================
  617.  
  618. # Turn TCP_ALLOW and UDP_ALLOW into ALLOW_HOSTWISE
  619. echo -n "Performing TCP_ALLOW and UDP_ALLOW alias preprocessing..."
  620. if [ "$TCP_ALLOW" != "" ] ; then
  621. for rule in ${TCP_ALLOW} ; do
  622. ALLOW_HOSTWISE_TCP="${ALLOW_HOSTWISE_TCP} 0/0>$rule"
  623. done
  624. fi
  625. if [ "$UDP_ALLOW" != "" ] ; then
  626. for rule in ${UDP_ALLOW} ; do
  627. ALLOW_HOSTWISE_UDP="${ALLOW_HOSTWISE_UDP} 0/0>$rule"
  628. done
  629. fi
  630. echo "done"
  631.  
  632.  
  633. # ===============================================
  634. # -------Set some Kernel stuff via SysCTL--------
  635. # ===============================================
  636.  
  637. # Turn on IP forwarding
  638.  
  639. if [ "$INTERNAL_LAN" != "" ] && [ "$OVERRIDE_NO_FORWARD" != "TRUE" ] ; then
  640. echo -n "Checking IP Forwarding..."
  641. if [ -e /proc/sys/net/ipv4/ip_forward ] ; then
  642. echo 1 > /proc/sys/net/ipv4/ip_forward
  643. echo "enabled."
  644. else
  645. echo "support not found! This will cause problems if you need to do any routing."
  646. fi
  647. fi
  648.  
  649. # Enable TCP Syncookies
  650. echo -n "Checking IP SynCookies..."
  651. if [ -e /proc/sys/net/ipv4/tcp_syncookies ] ; then
  652. if [ "$USE_SYNCOOKIES" = "TRUE" ] ; then
  653. echo 1 > /proc/sys/net/ipv4/tcp_syncookies
  654. echo "enabled."
  655. else
  656. echo 0 > /proc/sys/net/ipv4/tcp_syncookies
  657. echo "disabled."
  658. fi
  659. else
  660. echo "support not found, but that's OK."
  661. fi
  662.  
  663. # Enable Route Verification to prevent martians and other such crud that
  664. # seems to be commonplace on the internet today
  665. echo -n "Checking Route Verification..."
  666. if [ "$INET_IFACE" != "" ] ; then
  667. for dev in ${INET_IFACE} ; do
  668. if [ -e /proc/sys/net/ipv4/conf/$dev/rp_filter ] ; then
  669. if [ "$RP_FILTER" = "TRUE" ] ; then
  670. echo 1 > /proc/sys/net/ipv4/conf/$dev/rp_filter
  671. echo -n "activated:$dev "
  672. else
  673. echo 0 > /proc/sys/net/ipv4/conf/$dev/rp_filter
  674. echo -n "disabled:$dev "
  675. fi
  676. else
  677. echo "not found:$dev "
  678. fi
  679. done
  680. fi
  681.  
  682. if [ "$LAN_IFACE" != "" ] ; then
  683. for dev in ${LAN_IFACE} ; do
  684. if [ -e /proc/sys/net/ipv4/conf/$dev/rp_filter ] ; then
  685. if [ "$RP_FILTER" = "TRUE" ] ; then
  686. echo 1 > /proc/sys/net/ipv4/conf/$dev/rp_filter
  687. echo -n "activated:$dev "
  688. else
  689. echo 0 > /proc/sys/net/ipv4/conf/$dev/rp_filter
  690. echo -n "disabled:$dev "
  691. fi
  692. else
  693. echo "not found:$dev "
  694. fi
  695. done
  696. fi
  697.  
  698. if [ "$DMZ_IFACE" != "" ] ; then
  699. if [ -e /proc/sys/net/ipv4/conf/$DMZ_IFACE/rp_filter ] ; then
  700. if [ "$RP_FILTER" = "TRUE" ] ; then
  701. echo 1 > /proc/sys/net/ipv4/conf/$DMZ_IFACE/rp_filter
  702. echo -n "activated:${DMZ_IFACE} "
  703. else
  704. echo 0 > /proc/sys/net/ipv4/conf/$DMZ_IFACE/rp_filter
  705. echo -n "disabled:${DMZ_IFACE} "
  706. fi
  707. else
  708. echo "not found:${DMZ_IFACE} "
  709. fi
  710. fi
  711. echo
  712.  
  713. # Tell the Kernel to Ignore Source Routed Packets
  714. echo -n "Refusing Source Routed Packets via SysCtl..."
  715. if [ "$INET_IFACE" != "" ] ; then
  716. for dev in ${INET_IFACE} ; do
  717. if [ -e /proc/sys/net/ipv4/conf/$dev/accept_source_route ] ; then
  718. if [ "$ACCEPT_SOURCE_ROUTE" = "TRUE" ] ; then
  719. echo "1" > /proc/sys/net/ipv4/conf/$dev/accept_source_route
  720. echo -n "disabled:$dev "
  721. else
  722. echo "0" > /proc/sys/net/ipv4/conf/$dev/accept_source_route
  723. echo -n "activated:$dev "
  724. fi
  725. else
  726. echo "not found:$dev "
  727. fi
  728. done
  729. fi
  730.  
  731. if [ "$LAN_IFACE" != "" ] ; then
  732. for dev in ${LAN_IFACE} ; do
  733. if [ -e /proc/sys/net/ipv4/conf/$dev/accept_source_route ] ; then
  734. if [ "$ACCEPT_SOURCE_ROUTE" = "TRUE" ] ; then
  735. echo "1" > /proc/sys/net/ipv4/conf/$dev/accept_source_route
  736. echo -n "disabled:$dev "
  737. else
  738. echo "0" > /proc/sys/net/ipv4/conf/$dev/accept_source_route
  739. echo -n "activated:$dev "
  740. fi
  741. else
  742. echo "not found:$dev "
  743. fi
  744. done
  745. fi
  746.  
  747. if [ "$DMZ_IFACE" != "" ] ; then
  748. if [ -e /proc/sys/net/ipv4/conf/$DMZ_IFACE/accept_source_route ] ; then
  749. if [ "$ACCEPT_SOURCE_ROUTE" = "TRUE" ] ; then
  750. echo "1" > /proc/sys/net/ipv4/conf/$DMZ_IFACE/accept_source_route
  751. echo -n "disabled:${DMZ_IFACE} "
  752. else
  753. echo "0" > /proc/sys/net/ipv4/conf/$DMZ_IFACE/accept_source_route
  754. echo -n "activated:${DMZ_IFACE} "
  755. fi
  756. else
  757. echo "not found:${DMZ_IFACE} "
  758. fi
  759. fi
  760. echo
  761.  
  762. # ===============================================
  763. # --------Actual NetFilter Stuff Follows---------
  764. # ===============================================
  765.  
  766. # Flush everything
  767. # If you need compatability, you can comment some or all of these out,
  768. # but remember, if you re-run it, it'll just add the new rules in, it
  769. # won't remove the old ones for you then, this is how it removes them.
  770. echo -n "Flush: "
  771. ${IPTABLES} -t filter -F INPUT
  772. echo -n "INPUT "
  773. ${IPTABLES} -t filter -F OUTPUT
  774. echo -n "OUTPUT1 "
  775. ${IPTABLES} -t filter -F FORWARD
  776. echo -n "FORWARD "
  777. ${IPTABLES} -t nat -F PREROUTING
  778. echo -n "PREROUTING1 "
  779. ${IPTABLES} -t nat -F OUTPUT
  780. echo -n "OUTPUT2 "
  781. ${IPTABLES} -t nat -F POSTROUTING
  782. echo -n "POSTROUTING "
  783. ${IPTABLES} -t mangle -F PREROUTING
  784. echo -n "PREROUTING2 "
  785. ${IPTABLES} -t mangle -F OUTPUT
  786. echo -n "OUTPUT3"
  787. echo
  788.  
  789. # Create new chains
  790. # Output to /dev/null in case they don't exist from a previous invocation
  791. echo -n "Creating chains: "
  792. for chain in ${FILTER_CHAINS} ; do
  793. ${IPTABLES} -t filter -F ${chain} > /dev/null 2>&1
  794. ${IPTABLES} -t filter -X ${chain} > /dev/null 2>&1
  795. ${IPTABLES} -t filter -N ${chain}
  796. echo -n "${chain} "
  797. done
  798. if [ ${HAVE_ULOG} = "true" ] || [ ${HAVE_ULOG} = "" ] ; then
  799. for chain in ${UL_FILTER_CHAINS} ; do
  800. ${IPTABLES} -t filter -F ${chain} > /dev/null 2>&1
  801. ${IPTABLES} -t filter -X ${chain} > /dev/null 2>&1
  802. ${IPTABLES} -t filter -N ${chain}
  803. echo -n "${chain} "
  804. done
  805. fi
  806. echo
  807.  
  808. # Default Policies
  809. # INPUT policy is drop as of 2.3.7-pre5
  810. # Policy can't be reject because of kernel limitations
  811. echo -n "Default Policies: "
  812. ${IPTABLES} -t filter -P INPUT DROP
  813. echo -n "INPUT:DROP "
  814. ${IPTABLES} -t filter -P OUTPUT ACCEPT
  815. echo -n "OUTPUT:ACCEPT "
  816. ${IPTABLES} -t filter -P FORWARD DROP
  817. echo -n "FORWARD:DROP "
  818. echo
  819.  
  820. # ===============================================
  821. # -------Chain setup before jumping to them------
  822. # ===============================================
  823.  
  824. #These logging chains are valid to specify in DROP= above
  825. #Set up LDROP
  826. echo -n "Setting up drop chains chains: "
  827. ${IPTABLES} -t filter -A LDROP -p tcp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "TCP Dropped "
  828. ${IPTABLES} -t filter -A LDROP -p udp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "UDP Dropped "
  829. ${IPTABLES} -t filter -A LDROP -p icmp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "ICMP Dropped "
  830. ${IPTABLES} -t filter -A LDROP -f -m limit --limit ${LOG_FLOOD} -j LOG --log-level 4 --log-prefix "FRAGMENT Dropped "
  831. ${IPTABLES} -t filter -A LDROP -j DROP
  832. echo -n "LDROP "
  833.  
  834. #And LREJECT too
  835. ${IPTABLES} -t filter -A LREJECT -p tcp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "TCP Rejected "
  836. ${IPTABLES} -t filter -A LREJECT -p udp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "UDP Rejected "
  837. ${IPTABLES} -t filter -A LREJECT -p icmp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "ICMP Rejected "
  838. ${IPTABLES} -t filter -A LREJECT -f -m limit --limit ${LOG_FLOOD} -j LOG --log-level 4 --log-prefix "FRAGMENT Rejected "
  839. ${IPTABLES} -t filter -A LREJECT -j REJECT
  840. echo -n "LREJECT "
  841.  
  842. #Don't forget TREJECT
  843. ${IPTABLES} -t filter -A TREJECT -p tcp -j REJECT --reject-with tcp-reset
  844. ${IPTABLES} -t filter -A TREJECT -p udp -j REJECT --reject-with icmp-port-unreachable
  845. ${IPTABLES} -t filter -A TREJECT -p icmp -j DROP
  846. ${IPTABLES} -t filter -A TREJECT -j REJECT
  847. echo -n "TREJECT "
  848.  
  849. #And LTREJECT
  850. ${IPTABLES} -t filter -A LTREJECT -p tcp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "TCP Rejected "
  851. ${IPTABLES} -t filter -A LTREJECT -p udp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "UDP Rejected "
  852. ${IPTABLES} -t filter -A LTREJECT -p icmp -m limit --limit ${LOG_FLOOD} -j LOG --log-level 6 --log-prefix "ICMP Rejected "
  853. ${IPTABLES} -t filter -A LTREJECT -f -m limit --limit ${LOG_FLOOD} -j LOG --log-level 4 --log-prefix "FRAGMENT Rejected "
  854. ${IPTABLES} -t filter -A LTREJECT -j TREJECT
  855. echo -n "LTREJECT "
  856.  
  857. #And ULOG stuff, same as above but ULOG instead of LOG
  858. if [ ${HAVE_ULOG} = "true" ] || [ ${HAVE_ULOG} = "" ] ; then
  859. ${IPTABLES} -t filter -A ULDROP -p tcp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LDROP_TCP
  860. ${IPTABLES} -t filter -A ULDROP -p udp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LDROP_UDP
  861. ${IPTABLES} -t filter -A ULDROP -p icmp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LDROP_ICMP
  862. ${IPTABLES} -t filter -A ULDROP -f -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LDROP_FRAG
  863. ${IPTABLES} -t filter -A ULDROP -j DROP
  864. echo -n "ULDROP "
  865.  
  866. ${IPTABLES} -t filter -A ULREJECT -p tcp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LREJECT_TCP
  867. ${IPTABLES} -t filter -A ULREJECT -p udp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LREJECT_UDP
  868. ${IPTABLES} -t filter -A ULREJECT -p icmp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LREJECT_UDP
  869. ${IPTABLES} -t filter -A ULREJECT -f -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LREJECT_FRAG
  870. ${IPTABLES} -t filter -A ULREJECT -j REJECT
  871. echo -n "ULREJECT "
  872.  
  873. ${IPTABLES} -t filter -A ULTREJECT -p tcp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LTREJECT_TCP
  874. ${IPTABLES} -t filter -A ULTREJECT -p udp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LTREJECT_UDP
  875. ${IPTABLES} -t filter -A ULTREJECT -p icmp -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LTREJECT_ICMP
  876. ${IPTABLES} -t filter -A ULTREJECT -f -m limit --limit ${LOG_FLOOD} -j ULOG --ulog-nlgroup 1 --ulog-prefix LTREJECT_FRAG
  877. ${IPTABLES} -t filter -A ULTREJECT -p tcp -j REJECT --reject-with tcp-reset
  878. ${IPTABLES} -t filter -A ULTREJECT -p udp -j REJECT --reject-with icmp-port-unreachable
  879. ${IPTABLES} -t filter -A ULTREJECT -p icmp -j DROP
  880. ${IPTABLES} -t filter -A ULTREJECT -j REJECT
  881. echo -n "ULTREJECT "
  882. fi
  883. #newline
  884. echo
  885.  
  886.  
  887. # Set up the per-proto ACCEPT chains
  888. echo -n "Setting up per-proto ACCEPT: "
  889.  
  890. # TCPACCEPT
  891. # SYN Flood "Protection"
  892. ${IPTABLES} -t filter -A TCPACCEPT -p tcp --syn -m limit --limit ${SYN_FLOOD} -j ACCEPT
  893. ${IPTABLES} -t filter -A TCPACCEPT -p tcp --syn -m limit --limit ${LOG_FLOOD} -j LOG --log-prefix "Possible SynFlood "
  894. ${IPTABLES} -t filter -A TCPACCEPT -p tcp --syn -j ${DROP}
  895. ${IPTABLES} -t filter -A TCPACCEPT -p tcp ! --syn -j ACCEPT
  896. # Log anything that hasn't matched yet and ${DROP} it since it isn't TCP and shouldn't be here
  897. ${IPTABLES} -t filter -A TCPACCEPT -m limit --limit ${LOG_FLOOD} -j LOG --log-prefix "Mismatch in TCPACCEPT "
  898. ${IPTABLES} -t filter -A TCPACCEPT -j ${DROP}
  899. echo -n "TCPACCEPT "
  900.  
  901. #UDPACCEPT
  902. ${IPTABLES} -t filter -A UDPACCEPT -p udp -j ACCEPT
  903. # Log anything not UDP and ${DROP} it since it's not supposed to be here
  904. ${IPTABLES} -t filter -A UDPACCEPT -m limit --limit ${LOG_FLOOD} -j LOG --log-prefix "Mismatch on UDPACCEPT "
  905. ${IPTABLES} -t filter -A UDPACCEPT -j ${DROP}
  906. echo -n "UDPACCEPT "
  907.  
  908. #Done
  909. echo
  910.  
  911. # =================================================
  912. # -------------------Exemptions--------------------
  913. # =================================================
  914. if [ "$SUPER_EXEMPT" != "" ] ; then
  915. echo -n "Super Exemptions: "
  916. for host in ${SUPER_EXEMPT} ; do
  917. ${IPTABLES} -t filter -A INPUT -s ${host} -j ACCEPT
  918. ${IPTABLES} -t filter -A OUTPUT -d ${host} -j ACCEPT
  919. ${IPTABLES} -t filter -A FORWARD -s ${host} -j ACCEPT
  920. ${IPTABLES} -t filter -A FORWARD -d ${host} -j ACCEPT
  921. echo -n "${host} "
  922. done
  923. echo
  924. fi
  925.  
  926.  
  927. # =================================================
  928. # ----------------Explicit Denies------------------
  929. # =================================================
  930.  
  931. #Blackholes will not be overridden by hostwise allows
  932. if [ "$BLACKHOLE" != "" ] ; then
  933. echo -n "Blackholes: "
  934. for host in ${BLACKHOLE} ; do
  935. ${IPTABLES} -t filter -A INPUT -s ${host} -j ${BLACKHOLE_DROP}
  936. ${IPTABLES} -t filter -A OUTPUT -d ${host} -j ${BLACKHOLE_DROP}
  937. ${IPTABLES} -t filter -A FORWARD -s ${host} -j ${BLACKHOLE_DROP}
  938. ${IPTABLES} -t filter -A FORWARD -d ${host} -j ${BLACKHOLE_DROP}
  939. echo -n "${host} "
  940. done
  941. echo
  942. fi
  943.  
  944. if [ "$DENY_ALL" != "" ] ; then
  945. echo -n "Denying hosts: "
  946. for rule in ${DENY_ALL} ; do
  947. echo "$rule" | {
  948. IFS='<' read shost dhost
  949. if [ "$dhost" == "" ] ; then
  950. ${IPTABLES} -t filter -A INPUT -s ${shost} -j ${DROP}
  951. ${IPTABLES} -t filter -A FORWARD -s ${shost} -j ${DROP}
  952. else
  953. ${IPTABLES} -t filter -A INPUT -s ${shost} -d ${dhost} -j ${DROP}
  954. ${IPTABLES} -t filter -A FORWARD -s ${shost} -d ${dhost} -j ${DROP}
  955. fi
  956. }
  957. echo -n "${rule} "
  958. done
  959. echo
  960. fi
  961.  
  962.  
  963.  
  964. if [ "$DENY_HOSTWISE_TCP" != "" ] ; then
  965. echo -n "Hostwise TCP Denies: "
  966. for rule in ${DENY_HOSTWISE_TCP} ; do
  967. echo "$rule" | {
  968. IFS='><' read shost port dhost
  969. echo "$port" | {
  970. IFS='-' read fsp lsp
  971. if [ "$dhost" == "" ] ; then
  972. if [ "$lsp" != "" ] ; then
  973. ${IPTABLES} -t filter -A INPUT -p tcp -s ${shost} --dport ${fsp}:${lsp} -j ${DROP}
  974. ${IPTABLES} -t filter -A FORWARD -p tcp -s ${shost} --dport ${fsp}:${lsp} -j ${DROP}
  975. else
  976. ${IPTABLES} -t filter -A INPUT -p tcp -s ${shost} --dport ${port} -j ${DROP}
  977. ${IPTABLES} -t filter -A FORWARD -p tcp -s ${shost} --dport ${port} -j ${DROP}
  978. fi
  979. else
  980. if [ "$lsp" != "" ] ; then
  981. ${IPTABLES} -t filter -A INPUT -p tcp -s ${shost} -d ${dhost} --dport ${fsp}:${lsp} -j ${DROP}
  982. ${IPTABLES} -t filter -A FORWARD -p tcp -s ${shost} -d ${dhost} --dport ${fsp}:${lsp} -j ${DROP}
  983. else
  984. ${IPTABLES} -t filter -A INPUT -p tcp -s ${shost} -d ${dhost} --dport ${port} -j ${DROP}
  985. ${IPTABLES} -t filter -A FORWARD -p tcp -s ${shost} -d ${dhost} --dport ${port} -j ${DROP}
  986. fi
  987. fi
  988. echo -n "${rule} "
  989. }
  990. }
  991. done
  992. echo
  993. fi
  994.  
  995. if [ "$DENY_HOSTWISE_UDP" != "" ] ; then
  996. echo -n "Hostwise UDP Denies: "
  997. for rule in ${DENY_HOSTWISE_UDP} ; do
  998. echo "$rule" | {
  999. IFS='><' read shost port dhost
  1000. echo "$port" | {
  1001. IFS='-' read fsp lsp
  1002. if [ "$dhost" == "" ] ; then
  1003. if [ "$lsp" != "" ] ; then
  1004. ${IPTABLES} -t filter -A INPUT -p udp -s ${shost} --dport ${fsp}:${lsp} -j ${DROP}
  1005. ${IPTABLES} -t filter -A FORWARD -p udp -s ${shost} --dport ${fsp}:${lsp} -j ${DROP}
  1006. else
  1007. ${IPTABLES} -t filter -A INPUT -p udp -s ${shost} --dport ${port} -j ${DROP}
  1008. ${IPTABLES} -t filter -A FORWARD -p udp -s ${shost} --dport ${port} -j ${DROP}
  1009. fi
  1010. else
  1011. if [ "$lsp" != "" ] ; then
  1012. ${IPTABLES} -t filter -A INPUT -p udp -s ${shost} -d ${dhost} --dport ${fsp}:${lsp} -j ${DROP}
  1013. ${IPTABLES} -t filter -A FORWARD -p udp -s ${shost} -d ${dhost} --dport ${fsp}:${lsp} -j ${DROP}
  1014. else
  1015. ${IPTABLES} -t filter -A INPUT -p udp -s ${shost} -d ${dhost} --dport ${port} -j ${DROP}
  1016. ${IPTABLES} -t filter -A FORWARD -p udp -s ${shost} -d ${dhost} --dport ${port} -j ${DROP}
  1017. fi
  1018. fi
  1019. echo -n "${rule} "
  1020. }
  1021. }
  1022. done
  1023. echo
  1024. fi
  1025.  
  1026.  
  1027.  
  1028. #Invalid packets are always annoying
  1029. echo -n "${DROP}ing invalid packets..."
  1030. ${IPTABLES} -t filter -A INETIN -m state --state INVALID -j ${DROP}
  1031. echo "done"
  1032.  
  1033.  
  1034. # ------------------------------------------------------------------------
  1035.  
  1036. # Internet jumps to INET chains and DMZ
  1037. # Set up INET chains
  1038. echo -n "Setting up INET chains: "
  1039. for inetdev in ${INET_IFACE} ; do
  1040. ${IPTABLES} -t filter -A INPUT -i $inetdev -j INETIN
  1041. for landev in ${LAN_IFACE} ; do
  1042. ${IPTABLES} -t filter -A FORWARD -i $inetdev -o $landev -j INETIN
  1043. done
  1044. echo -n "INETIN "
  1045.  
  1046. ${IPTABLES} -t filter -A OUTPUT -o $inetdev -j INETOUT
  1047. for landev in ${LAN_IFACE} ; do
  1048. ${IPTABLES} -t filter -A FORWARD -o $inetdev -i $landev -j INETOUT
  1049. done
  1050. echo -n "INETOUT "
  1051. echo
  1052. done
  1053.  
  1054. if [ "$BRAINDEAD_ISP" = "TRUE" ] ; then
  1055. ${IPTABLES} -t filter -A INETOUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  1056. fi
  1057.  
  1058. # For now we'll subject the DMZ to the same rules as the internet when going onto the trusted LAN
  1059. # And we'll let it go anywhere on the internet
  1060. if [ "$DMZ_IFACE" != "" ] ; then
  1061. echo -n "Setting up DMZ Chains: "
  1062. ${IPTABLES} -A OUTPUT -o ${DMZ_IFACE} -j DMZOUT
  1063. ${IPTABLES} -A FORWARD -i ${LAN_IFACE} -o ${DMZ_IFACE} -j DMZOUT
  1064. ${IPTABLES} -A FORWARD -i ${INET_IFACE} -o ${DMZ_IFACE} -j ACCEPT
  1065.  
  1066. echo -n "DMZOUT "
  1067. echo -n "DMZ for Internet Forwarding to INETOUT..."
  1068. ${IPTABLES} -A DMZOUT -j INETOUT
  1069.  
  1070. ${IPTABLES} -A INPUT -i ${DMZ_IFACE} -j DMZIN
  1071.  
  1072. echo -n "DMZIN "
  1073. echo
  1074. echo -n "DMZ for LAN and localhost Forwarding to INETIN..."
  1075. ${IPTABLES} -A FORWARD -i ${DMZ_IFACE} -o ${LAN_IFACE} -j DMZOUT
  1076. ${IPTABLES} -A FORWARD -i ${DMZ_IFACE} -o ${INET_IFACE} -j ACCEPT
  1077. ${IPTABLES} -A DMZOUT -o ${LAN_IFACE} -j INETIN
  1078. echo "done"
  1079. echo -n "done"
  1080. fi
  1081.  
  1082. # ------------------------------------------------------------------------
  1083.  
  1084.  
  1085. # Local traffic to internet or crossing subnets
  1086. # This should cover what we need if we don't use masquerading
  1087. # Unfortunately, MAC address matching isn't bidirectional (for
  1088. # obvious reasons), so IP based matching is done here
  1089. echo -n "Local Traffic Rules: "
  1090. if [ "$INTERNAL_LAN" != "" ] ; then
  1091. for subnet in ${INTERNAL_LAN} ; do
  1092. ${IPTABLES} -t filter -A INPUT -s ${subnet} -j ACCEPT
  1093. ${IPTABLES} -t filter -A FORWARD -s ${subnet} -o ${INET_IFACE} -i ${INET_IFACE} -j ACCEPT
  1094. echo -n "${subnet}:ACCEPT "
  1095. done
  1096. fi
  1097.  
  1098. # 127.0.0.0/8 used to need an entry in INTERNAL_LAN, but routing of that isn't needed
  1099. # so an allow is placed on INPUT so that the computer can talk to itself :)
  1100. ${IPTABLES} -t filter -A INPUT -i ${LOOP_IFACE} -j ACCEPT
  1101. echo -n "loopback:ACCEPT "
  1102.  
  1103. # DHCP server magic
  1104. # Allow broadcasts from LAN to UDP port 67 (DHCP server)
  1105. if [ "$DHCP_SERVER" = "TRUE" ] ; then
  1106. for dev in ${LAN_IFACE} ; do
  1107. ${IPTABLES} -t filter -A INPUT -i $dev -p udp --dport 67 -j ACCEPT
  1108. done
  1109. echo -n "dhcp:ACCEPT"
  1110. fi
  1111. echo #newline from local traffic rules
  1112.  
  1113.  
  1114.  
  1115. if [ "$PROXY" != "" ] ; then
  1116. echo -n "Setting up Transparent Proxy to ${PROXY}: "
  1117. for subnet in ${INTERNAL_LAN} ; do
  1118. echo "$PROXY" | {
  1119. IFS=':' read host port
  1120. if [ "$host" = "localhost" ] || [ "$host" = "127.0.0.1" ] ; then
  1121. ${IPTABLES} -t nat -A PREROUTING -s ${subnet} -p tcp --dport 80 -j REDIRECT --to-port ${port}
  1122. echo -n "${subnet}:PROXY "
  1123. else
  1124. ${IPTABLES} -t nat -A PREROUTING -s ! ${host} -p tcp --dport 80 -j DNAT --to-destination ${host}:${port}
  1125. ${IPTABLES} -t nat -A POSTROUTING -s ${subnet} -d ${host} -j SNAT --to-source ${MY_IP} #Destination changed in PREROUTING
  1126. echo -n "${subnet}:PROXY "
  1127. fi
  1128. }
  1129. done
  1130. echo
  1131. fi
  1132.  
  1133. if [ "$ALLOW_OUT_TCP" != "" ] ; then
  1134. echo -n "Internet censorship TCP allows: "
  1135. for rule in ${ALLOW_OUT_TCP} ; do
  1136. echo "$rule" | {
  1137. IFS=':' read intip destip dport
  1138. ${IPTABLES} -t filter -A FORWARD -s ${intip} -d ${destip} -p tcp --dport ${dport} -o ${INET_IFACE} -j ACCEPT
  1139. echo -n "${intip}:${destip} "
  1140. }
  1141. done
  1142. echo
  1143. fi
  1144.  
  1145. # Set up basic NAT if the user wants it
  1146. if [ "$MASQ_LAN" != "" ] ; then
  1147. echo -n "Setting up masquerading: "
  1148. if [ "$MAC_MASQ" = "" ] ; then
  1149. for subnet in ${MASQ_LAN} ; do
  1150. ${IPTABLES} -t nat -A POSTROUTING -s ${subnet} -o ${INET_IFACE} -j MASQUERADE
  1151. echo -n "${subnet}:MASQUERADE "
  1152. done
  1153. else
  1154. for address in ${MAC_MASQ} ; do
  1155. ${IPTABLES} -t nat -A POSTROUTING -m mac --mac-source ${address} -o ${INET_IFACE} -j MASQUERADE
  1156. echo -n "${address}:MASQUERADE "
  1157. done
  1158. fi
  1159. echo
  1160. fi
  1161. if [ "$SNAT_LAN" != "" ] ; then #Static NAT used
  1162. echo -n "Setting up static NAT: "
  1163. if [ "$MAC_SNAT" = "" ] ; then
  1164. for rule in ${SNAT_LAN} ; do
  1165. echo "$rule" | {
  1166. IFS=':' read host destip
  1167. ${IPTABLES} -t nat -A POSTROUTING -s ${host} -o ${INET_IFACE} -j SNAT --to-source ${destip}
  1168. echo -n "${host}:SNAT "
  1169. }
  1170. done
  1171. else
  1172. for rule in ${MAC_SNAT} ; do
  1173. echo "$rule" | {
  1174. IFS=':' read address destip
  1175. ${IPTABLES} -t nat -A POSTROUTING -m mac --mac-source ${address} -o ${INET_IFACE} -j SNAT --to-source ${destip}
  1176. echo -n "${address}:SNAT "
  1177. }
  1178. done
  1179. fi
  1180. echo
  1181. fi
  1182.  
  1183. #TCP Port-Forwards
  1184. if [ "$TCP_FW" != "" ] ; then
  1185. echo -n "TCP Port Forwards: "
  1186. for rule in ${TCP_FW} ; do
  1187. echo "$rule" | {
  1188. IFS=':><' read srcport destport host shost
  1189. echo "$srcport" | {
  1190. IFS='-' read fsp lsp
  1191. if [ "$shost" = "" ] ; then
  1192. if [ "$lsp" != "" ] ; then
  1193. echo "$destport" | {
  1194. IFS='-' read fdp ldp
  1195. ${IPTABLES} -t nat -A PREROUTING -i ${INET_IFACE} -p tcp --dport ${fsp}:${lsp} -j DNAT --to-destination ${host}:${destport}
  1196. }
  1197. else
  1198. ${IPTABLES} -t nat -A PREROUTING -i ${INET_IFACE} -p tcp --dport ${srcport} -j DNAT --to-destination ${host}:${destport}
  1199. fi
  1200. else
  1201. if [ "$lsp" != "" ] ; then
  1202. echo "$destport" | {
  1203. IFS='-' read fdp ldp
  1204. ${IPTABLES} -t nat -A PREROUTING -p tcp -d ${shost} --dport ${fsp}:${lsp} -j DNAT --to-destination ${host}:${destport}
  1205. }
  1206. else
  1207. ${IPTABLES} -t nat -A PREROUTING -p tcp -d ${shost} --dport ${srcport} -j DNAT --to-destination ${host}:${destport}
  1208. fi
  1209. fi
  1210. echo -n "${rule} "
  1211. }
  1212. }
  1213. done
  1214. echo
  1215. fi
  1216.  
  1217. #UDP Port Forwards
  1218. if [ "$UDP_FW" != "" ] ; then
  1219. echo -n "UDP Port Forwards: "
  1220. for rule in ${UDP_FW} ; do
  1221. echo "$rule" | {
  1222. IFS=':><' read srcport destport host shost
  1223. echo "$srcport" | {
  1224. IFS='-' read fsp lsp
  1225. if [ "$shost" = "" ] ; then
  1226. if [ "$lsp" != "" ] ; then
  1227. echo "$destport" | {
  1228. IFS='-' read fdp ldp
  1229. ${IPTABLES} -t nat -A PREROUTING -i ${INET_IFACE} -p udp --dport ${fsp}:${lsp} -j DNAT --to-destination ${host}:${destport}
  1230. }
  1231. else
  1232. ${IPTABLES} -t nat -A PREROUTING -i ${INET_IFACE} -p udp --dport ${srcport} -j DNAT --to-destination ${host}:${destport}
  1233. fi
  1234. else
  1235. if [ "$lsp" != "" ] ; then
  1236. echo "$destport" | {
  1237. IFS='-' read fdp ldp
  1238. ${IPTABLES} -t nat -A PREROUTING -p udp -d ${shost} --dport ${fsp}:${lsp} -j DNAT --to-destination ${host}:${destport}
  1239. }
  1240. else
  1241. ${IPTABLES} -t nat -A PREROUTING -p udp -d ${shost} --dport ${srcport} -j DNAT --to-destination ${host}:${destport}
  1242. fi
  1243. fi
  1244. echo -n "${rule} "
  1245. }
  1246. }
  1247. done
  1248. echo
  1249. fi
  1250.  
  1251.  
  1252.  
  1253. # =================================================
  1254. # -------------------ICMP rules--------------------
  1255. # =================================================
  1256.  
  1257. if [ "$BAD_ICMP" != "" ] ; then
  1258. echo -n "${DROP}ing ICMP messages specified in BAD_ICMP..."
  1259. for message in ${BAD_ICMP} ; do
  1260. ${IPTABLES} -t filter -A INETIN -p icmp --icmp-type ${message} -j ${DROP}
  1261. echo -n "${message} "
  1262. done
  1263. echo
  1264. fi
  1265.  
  1266. # Flood "security"
  1267. # You'll still respond to these if they comply with the limits (set in config)
  1268. # There is a more elegant way to set this using sysctl, however this has the
  1269. # advantage that the kernel ICMP stack never has to process it, lessening
  1270. # the chance of a very serious flood overloading your kernel.
  1271. # This is just a packet limit, you still get the packets on the interface and
  1272. # still may experience lag if the flood is heavy enough
  1273. echo -n "Flood limiting: "
  1274. # Ping Floods (ICMP echo-request)
  1275. ${IPTABLES} -t filter -A INETIN -p icmp --icmp-type echo-request -m limit --limit ${PING_FLOOD} -j ACCEPT
  1276. ${IPTABLES} -t filter -A INETIN -p icmp --icmp-type echo-request -j ${DROP}
  1277. echo -n "ICMP-PING "
  1278. echo
  1279.  
  1280. echo -n "Allowing the rest of the ICMP messages in..."
  1281. ${IPTABLES} -t filter -A INETIN -p icmp --icmp-type echo-request -j ACCEPT
  1282. echo "done"
  1283.  
  1284.  
  1285.  
  1286. # ================================================================
  1287. # ------------Allow stuff we have chosen to allow in--------------
  1288. # ================================================================
  1289.  
  1290.  
  1291. # Hostwise allows
  1292. if [ "$ALLOW_HOSTWISE_TCP" != "" ] ; then
  1293. echo -n "Hostwise TCP Allows: "
  1294. for rule in ${ALLOW_HOSTWISE_TCP} ; do
  1295. echo "$rule" | {
  1296. IFS='><' read shost port dhost
  1297. echo "$port" | {
  1298. IFS='-' read fsp lsp
  1299. if [ "$dhost" == "" ] ; then
  1300. if [ "$lsp" != "" ] ; then
  1301. ${IPTABLES} -t filter -A INETIN -p tcp -s ${shost} --dport ${fsp}:${lsp} -j TCPACCEPT
  1302. else
  1303. ${IPTABLES} -t filter -A INETIN -p tcp -s ${shost} --dport ${port} -j TCPACCEPT
  1304. fi
  1305. else
  1306. if [ "$lsp" != "" ] ; then
  1307. ${IPTABLES} -t filter -A INETIN -p tcp -s ${shost} -d ${dhost} --dport ${fsp}:${lsp} -j TCPACCEPT
  1308. else
  1309. ${IPTABLES} -t filter -A INETIN -p tcp -s ${shost} -d ${dhost} --dport ${port} -j TCPACCEPT
  1310. fi
  1311. fi
  1312. echo -n "${rule} "
  1313. }
  1314. }
  1315. done
  1316. echo
  1317. fi
  1318.  
  1319. if [ "$ALLOW_HOSTWISE_UDP" != "" ] ; then
  1320. echo -n "Hostwise UDP Allows: "
  1321. for rule in ${ALLOW_HOSTWISE_UDP} ; do
  1322. echo "$rule" | {
  1323. IFS='><' read shost port dhost
  1324. echo "$port" | {
  1325. IFS='-' read fsp lsp
  1326. if [ "$dhost" == "" ] ; then
  1327. if [ "$lsp" != "" ] ; then
  1328. ${IPTABLES} -t filter -A INETIN -p udp -s ${shost} --dport ${fsp}:${lsp} -j UDPACCEPT
  1329. else
  1330. ${IPTABLES} -t filter -A INETIN -p udp -s ${shost} --dport ${port} -j UDPACCEPT
  1331. fi
  1332. else
  1333. if [ "$lsp" != "" ] ; then
  1334. ${IPTABLES} -t filter -A INETIN -p udp -s ${shost} -d ${dhost} --dport ${fsp}:${lsp} -j UDPACCEPT
  1335. else
  1336. ${IPTABLES} -t filter -A INETIN -p udp -s ${shost} -d ${dhost} --dport ${port} -j UDPACCEPT
  1337. fi
  1338. fi
  1339. echo -n "${rule} "
  1340. }
  1341. }
  1342. done
  1343. echo
  1344. fi
  1345.  
  1346. if [ "$ALLOW_HOSTWISE_PROTO" != "" ] ; then
  1347. echo -n "Hostwise IP Protocol Allows: "
  1348. for rule in ${ALLOW_HOSTWISE_PROTO} ; do
  1349. echo "$rule" | {
  1350. IFS='><' read shost proto dhost
  1351. if [ "$dhost" == "" ] ; then
  1352. ${IPTABLES} -t filter -A INETIN -p ${proto} -s ${shost} -j ACCEPT
  1353. else
  1354. ${IPTABLES} -t filter -A INETIN -p ${proto} -s ${shost} -d ${dhost} -j ACCEPT
  1355. fi
  1356. echo -n "${rule} "
  1357. }
  1358. done
  1359. echo
  1360. fi
  1361.  
  1362. echo -n "Allowing established outbound connections back in..."
  1363. ${IPTABLES} -t filter -A INETIN -m state --state ESTABLISHED -j ACCEPT
  1364. echo "done"
  1365.  
  1366. # RELATED on high ports only for security
  1367. echo -n "Allowing related inbound connections..."
  1368. ${IPTABLES} -t filter -A INETIN -p tcp --dport 1024:65535 -m state --state RELATED -j TCPACCEPT
  1369. ${IPTABLES} -t filter -A INETIN -p udp --dport 1024:65535 -m state --state RELATED -j UDPACCEPT
  1370. echo "done"
  1371.  
  1372.  
  1373. # =================================================
  1374. # ----------------Packet Mangling------------------
  1375. # =================================================
  1376.  
  1377.  
  1378. # TTL mangling
  1379. # This is probably just for the paranoid, but hey, isn't that what
  1380. # all security guys are? :)
  1381. if [ "$TTL_SAFE" != "" ] ; then
  1382. ${IPTABLES} -t mangle -A PREROUTING -i ${INET_IFACE} -j TTL --ttl-set ${TTL_SAFE}
  1383. fi
  1384.  
  1385. # Type of Service mangle optimizations (the ACTIVE FTP one will only work for uploads)
  1386. # Most routers tend to ignore these, it's probably better to use
  1387. # QoS. A packet scheduler like HTB is much more efficient
  1388. # at assuring bandwidth availability at the local end than
  1389. # ToS is.
  1390. if [ "$MANGLE_TOS_OPTIMIZE" = "TRUE" ] ; then
  1391. echo -n "Optimizing traffic: "
  1392. ${IPTABLES} -t mangle -A OUTPUT -p tcp --dport 23 -j TOS --set-tos Minimize-Delay
  1393. echo -n "telnet "
  1394. ${IPTABLES} -t mangle -A OUTPUT -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
  1395. echo -n "ssh "
  1396. ${IPTABLES} -t mangle -A OUTPUT -p tcp --dport 20 -j TOS --set-tos Minimize-Cost
  1397. echo -n "ftp-data "
  1398. ${IPTABLES} -t mangle -A OUTPUT -p tcp --dport 21 -j TOS --set-tos Minimize-Delay
  1399. echo -n "ftp-control "
  1400. ${IPTABLES} -t mangle -A OUTPUT -p udp --dport 4000:7000 -j TOS --set-tos Minimize-Delay
  1401. echo -n "diablo2 "
  1402. echo
  1403. fi
  1404.  
  1405. # What to do on those INET chains when we hit the end
  1406. echo -n "Setting up INET policies: "
  1407. # Drop if we cant find a valid inbound rule.
  1408. ${IPTABLES} -t filter -A INETIN -j ${DROP}
  1409. echo -n "INETIN:${DROP} "
  1410. # We can send what we want to the internet
  1411. ${IPTABLES} -t filter -A INETOUT -j ACCEPT
  1412. echo -n "INETOUT:ACCEPT "
  1413. echo
  1414.  
  1415. # All done!
  1416. echo -e "\033[44;32;1m Done Loading Firewall !\033[0m"
  1417.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!