Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/bin/bash
- #
- # This file contains the Firewall rules
- # and the functions to be called by the init script.
- # DO NOT RUN THIS FILE DIRECTLY
- #
- ########################
- ### ###
- ### GLOBAL VARIABLES ###
- ### ###
- ########################
- #
- DEFAULT_POLICY='ACCEPT'
- GATEWAYINT='eth0'
- LOG_FILE='/var/log/firewall/firewall.log'
- DEFAULT_CHAINS='INPUT OUTPUT FORWARD'
- CUSTOM_CHAINS='WORKSTATIONS WINSERVERS DMZNETWORK DEVNETWORK'
- #
- #########################
- ### ###
- ### NETWORK VARIABLES ###
- ### ###
- #########################
- #
- ### WORKSTATIONS ###
- #
- WSINTERFACE='eth1'
- WSNETWORK='10.123.0.0/18'
- WSMERCHANDISE='10.123.1.0/24'
- WSCOMPLIANCE='10.123.2.0/24'
- WSCUSTSUPPORT='10.123.3.0/24'
- WSDEVDESIGN='10.123.4.0/24'
- WSFULFILLMENT='10.123.5.0/24'
- WSIT='10.123.6.0/24'
- WSBIZDEV='10.123.7.0/24'
- WSLEGAL_HR_PR='10.123.9.0/24'
- WSMARKETING='10.123.11.0/24'
- WSACCOUNTING='10.123.12.0/24'
- #
- ### WINSERVERS ###
- #
- WININTERFACE='eth2'
- WINNETWORK='10.123.64.0/18'
- VPN_AUTH='10.123.70.0/24'
- VPN_GENERAL='10.123.71.0/24'
- #
- ### DMZNETWORK ###
- #
- DMZINTERFACE='eth3'
- DMZNETWORK='10.123.128.0/18'
- #
- ### DEVNETWORK ###
- #
- DEVINTERFACE='eth4'
- DEVNETWORK='10.123.192.0/18'
- ICINGA='10.123.203.2'
- CACTI='10.123.203.4'
- #
- ### ATLNETWORK ###
- #
- ATLNETWORK='10.13.0.0/16'
- ATLNETWORK_VPN='10.14.0.0/24'
- #
- ######################
- ### ###
- ### IPTABLES RULES ###
- ### ###
- ######################
- #
- ### INITIALIZE ALL CHAINS ###
- #
- all() {
- input
- output
- forward
- workstations
- winservers
- devnetwork
- dmznetwork
- }
- #
- ### INPUT CHAIN ###
- #
- input() {
- iptables -A INPUT -p all -i lo -j ACCEPT -m comment --comment "ALLOW LOCALHOST"
- iptables -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "ALLOW ESTABLISHED and RELATED"
- iptables -A INPUT -p tcp -s $WSIT --dport 22 -m state --state NEW -j ACCEPT -m comment --comment "ALLOW IT to SSH"
- iptables -A INPUT -p all -j LOG --log-level warning --log-prefix "INPUT: "
- iptables -A INPUT -p all -j $DEFAULT_POLICY
- }
- #
- ### OUTPUT CHAIN ###
- #
- ouput() {
- iptables -A OUTPUT -p all -j LOG --log-level warning --log-prefix "OUTPUT: "
- iptables -A OUTPUT -p all -j $DEFAULT_POLICY
- }
- #
- ### FORWARD CHAIN ###
- #
- forward() {
- iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "ALLOW ESTABLISHED and RELATED"
- iptables -A FORWARD -o $WSINTERFACE -j WORKSTATIONS -m comment --comment "Forward TO:WORKSTATIONS"
- iptables -A FORWARD -o $WININTERFACE -j WINSERVERS -m comment --comment "Forward TO:WINSERVERS"
- iptables -A FORWARD -o $DMZINTERFACE -j DMZNETWORK -m comment --comment "Forward TO:DMZNETWORK"
- iptables -A FORWARD -o $DEVINTERFACE -j DEVNETWORK -m comment --comment "Forward TO:DEVNETOWRK"
- iptables -A forward -p all -j LOG --log-level warning --log-prefix "FORWARD: "
- iptables -A FORWARD -p all -j $DEFAULT_POLICY
- }
- #
- ### WORKSTAIONS CHAIN ###
- #
- workstations() {
- iptables -N WORKSTATIONS
- iptables -A WORKSTATIONS -p all -j LOG --log-level warning --log-prefix "WORKSTATIONS: "
- iptables -A WORKSTATIONS -p all -j $DEFAULT_POLICY
- }
- #
- ### WINSERVERS CHAIN ###
- #
- winservers() {
- iptables -N WINSERVERS
- iptables -A WINSERVERS -p all -j LOG --log-level warning --log-prefix "WINSERVERS: "
- iptables -A WINSERVERS -p all -j $DEFAULT_POLICY
- }
- #
- ### DEVNETWORK CHAIN ###
- #
- devnetwork() {
- iptables -N DEVNETWORK
- iptables -A DEVNETWORK -p icmp -m state --state NEW -j ACCEPT -m comment --comment "ALLOW ICMP"
- iptables -A DEVNETWORK -p all -s $ATLNETWORK -m state --state NEW -j ACCEPT -m comment --comment "ALLOW ATLNETWORK"
- iptables -A DEVNETWORK -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT -m comment --comment "ALLOW HTTP/HTTPS"
- iptables -A DEVNETWORK -p udp -m multiport --dports 53 -m state --state NEW -j ACCEPT -m comment --comment "ALLOW DNS"
- iptables -A DEVNETWORK -p all -j LOG --log-level warning --log-prefix "DEVNETWORK: "
- iptables -A DEVNETWORK -p all -j $DEFAULT_POLICY
- }
- #
- ### DMZNETWORK CHAIN ###
- #
- dmznetwork() {
- iptables -N DMZNETWORK
- iptables -A DMZNETWORK -p all -s $ICINGA -m state --state NEW -j ACCEPT -m comment --comment "ALLOW ICINGA"
- iptables -A DMZNETWORK -p all -s $CACTI -m state --state NEW -j ACCEPT -m comment --comment "ALLOW CACTI"
- iptables -A DMZNETWORK -p all -j LOG --log-level warning --log-prefix "DMZNETWORK: "
- iptables -A DMZNETWORK -p all -j $DEFAULT_POLICY
- }
- #
- ### Main Logic ###
- #
- case "$1" in
- all)
- all
- ;;
- input)
- input
- ;;
- output)
- output
- ;;
- forward)
- forward
- ;;
- workstations)
- workstations
- ;;
- winservers)
- winservers
- ;;
- devnetwork)
- devnetwork
- ;;
- dmznetwork)
- dmznetwork
- ;;
- *)
- echo
- ;;
- esac
- exit 0
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement