API tools faq
paste
Advertisement
Guest User

rc.firewall

a guest
Aug 17th, 2014
492
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 9.73 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2.  
  3. IP=`which ip`
  4.  
  5. # Сценарий предназначен для настройки маршрутизации и
  6. # межсетевого экрана на маршрутизаторе офисной сети.
  7. # Для запуска переименуйте сценарий в rc.firewall
  8. # и дайте права доступа 755
  9.  
  10. # LAN/INET Configuration
  11. # Приведите в соответствие с настройками ваших сетей
  12. # следующие семь параметров!
  13. LAN_IFACE=eth0
  14. LAN_IP=192.168.1.22
  15. LAN_IP_RANGE=192.168.1.0/24
  16. LAN_BCAST_ADRESS=192.168.1.255/24
  17.  
  18. LAN2_IP=192.168.2.22
  19. LAN2_IP_RANGE=192.168.2.0/24
  20. LAN2_BCAST_ADRESS=192.168.2.255/24
  21.  
  22. INET_IFACE=eth1
  23. STATIC_IP=192.168.100.1
  24. #echo $STATIC_IP
  25. LO_IFACE=lo
  26. LOCALHOST_IP=127.0.0.1
  27.  
  28. PPP0_IFACE=ppp0
  29. PPP0_IP=$($IP addr show $PPP0_IFACE | grep inet | cut -f6 -d ' ')
  30. echo $PPP0_IP
  31. #PPP1_IP=0.0.0.0
  32. #PPP1_IFACE=ppp1
  33.  
  34. # IPTables Configuration.
  35. IPTABLES="/usr/sbin/iptables"
  36. IPSET="/usr/sbin/ipset"
  37.  
  38. # Required modules
  39. /sbin/modprobe ip_tables
  40. #/sbin/modprobe ip_nat
  41. /sbin/modprobe ip_conntrack
  42. /sbin/modprobe iptable_filter
  43. /sbin/modprobe iptable_mangle
  44. /sbin/modprobe iptable_nat
  45. /sbin/modprobe ipt_LOG
  46. /sbin/modprobe ipt_limit
  47. /sbin/modprobe ipt_state
  48. #/sbin/modprobe nf_tproxy_core
  49.  
  50. # Non-Required modules
  51. /sbin/modprobe ipt_owner
  52. /sbin/modprobe ipt_REJECT
  53. /sbin/modprobe ipt_MASQUERADE
  54. /sbin/modprobe ip_conntrack_ftp
  55. /sbin/modprobe ip_conntrack_irc
  56. /sbin/modprobe ip_nat_ftp
  57. /sbin/modprobe ip_nat_irc
  58.  
  59. echo 1 > /proc/sys/net/ipv4/ip_forward
  60. echo 1 > /proc/sys/net/ipv4/conf/$INET_IFACE/proxy_arp
  61.  
  62. # Clear ALL rules
  63. $IPTABLES -F
  64. $IPTABLES -X
  65. $IPTABLES -t nat -F
  66. $IPSET -X
  67. #----------------------------------------------------------------------------------------------------------
  68. ## Create new ip sets
  69. $IPSET -N whitelist bitmap:ip,mac range $LAN_IP_RANGE
  70. $IPSET -N whitelistd bitmap:ip,mac range $LAN_IP_RANGE
  71. #$IPSET -N whitelist macipmap --network $LAN_IP_RANGE
  72. $IPSET -N ipwhite iphash
  73. ## Set ip sets
  74. # Whitelist
  75. for i in $(cat /home/scripts/iplist/ipmac.lst | cut -d '#' -f 1)
  76. do
  77.     if [ ! a"$i" == a ]; then
  78.         $IPSET add whitelist $i    #                  
  79.     fi
  80. done
  81.  
  82. for i in $(cat /home/scripts/iplist/ipmac_dubles.lst | cut -d '#' -f 1)
  83. do
  84.     if [ ! a"$i" == a ]; then
  85.         $IPSET add whitelistd $i    #                  
  86.     fi
  87. done
  88.  
  89. for i in $(cat /home/scripts/iplist/ip.lst | cut -d '#' -f 1)
  90. do
  91.     if [ ! a"$i" == a ]; then
  92.         $IPSET add ipwhite $i     #                    
  93.     fi
  94. done
  95.  
  96. # Set default policies for the INPUT, FORWARD and OUTPUT chains
  97. $IPTABLES -P INPUT DROP
  98. $IPTABLES -P OUTPUT DROP
  99. $IPTABLES -P FORWARD DROP
  100.  
  101. # Create chain for bad tcp packets
  102. $IPTABLES -N bad_tcp_packets
  103.  
  104. # Create separate chains for ICMP, TCP and UDP to traverse
  105. $IPTABLES -N allowed
  106. $IPTABLES -N icmp_packets
  107. $IPTABLES -N tcp_packets
  108. $IPTABLES -N udpincoming_packets
  109. #$IPTABLES -N fwtraf
  110. $IPTABLES -N fw_allow
  111.  
  112. # bad_tcp_packets chain
  113. $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
  114. $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-prefix "Bad TCP packet: "
  115. $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  116.  
  117. # TCP sync rules
  118. $IPTABLES -A allowed -p TCP --syn -j ACCEPT
  119. $IPTABLES -A allowed -p TCP -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  120. $IPTABLES -A allowed -p TCP -j DROP
  121.  
  122. # ICMP rules
  123. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT
  124. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
  125. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 5 -j ACCEPT
  126. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
  127. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
  128.  
  129. # TCP rules
  130. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
  131. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed
  132. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 53 -j allowed
  133. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
  134. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 110 -j allowed
  135. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 3690 -j allowed
  136. $IPTABLES -A fw_allow -j ACCEPT
  137. $IPTABLES -A fw_allow -m connlimit --connlimit-above 15 -j DROP
  138.  
  139. # UDP ports
  140. #$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
  141.  
  142. #----------------------------------------------------------------------------------------------------------
  143.  
  144. # PREROUTING chain
  145. #$IPTABLES -t nat -A PREROUTING -p tcp -s 83.237.192.219 --dport 3389 -j DNAT --to 10.0.0.4
  146. #$IPTABLES -t nat -A PREROUTING -p tcp --dport 3389 -j DNAT --to  192.168.1.12
  147. #$IPTABLES -t nat -A PREROUTING -p tcp -j DNAT --to-destination  10.0.0.69
  148.  
  149. # ********* Redirect to SQUID **********
  150. #$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE -p tcp --dport 80 -j REDIRECT --to-port 3129
  151. #$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE -p tcp --dport 21 -j REDIRECT --to-port 3129
  152. #$IPTABLES -t nat -A PREROUTING  -i $LAN_IFACE ! -d 192.168.1.22 -m set --match-set whitelist src,src -p tcp -m multiport --dport 80,2080,2082,8080 -j REDIRECT --to-port 3129
  153. #$IPTABLES -t nat -A PREROUTING  -i $LAN_IFACE ! -d 192.168.1.22 -m set --match-set whitelistd src,src -p tcp -m multiport --dport 80,2080,2082,8080 -j REDIRECT --to-port 3129
  154. #$IPTABLES -t mangle -A PREROUTING  -i $LAN_IFACE ! -d 192.168.1.22 -p tcp -m multiport --dport 21,25,80,110,443,563,1025,5190,2080,2082,8080,10000 -j TPROXY --on-port 3129
  155. #$IPTABLES -t mangle -A PREROUTING  -i $LAN_IFACE -p tcp -m multiport --dport 21,25,80,110,443,563,1025,5190,2080,2082,8080,10000 -j TPROXY --on-port 3129
  156.  
  157.  
  158. # POSTROUTING chain
  159. #$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -s $LAN_IP_RANGE -j SNAT --to-source $STATIC_IP
  160. $IPTABLES -t nat -A POSTROUTING -o $PPP0_IFACE -s $LAN_IP_RANGE -j SNAT --to-source $PPP0_IP
  161.  
  162. # FORWARD chain
  163. #$IPTABLES -A FORWARD -j LOG --log-level debug --log-prefix "IPT FORWARD packet died: "
  164. #$IPTABLES -A FORWARD -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-level notice --log-prefix "New not syn:"
  165. #$IPTABLES -A FORWARD -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  166. $IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
  167. $IPTABLES -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  168.  
  169. # Block out DHCP servers
  170. $IPTABLES -A FORWARD -p udp -i $LAN_IFACE --dport 67 -j DROP
  171. $IPTABLES -A FORWARD -p udp -i $LAN_IFACE --dport 68 -j DROP
  172. # Accept only for white listed adresses
  173. $IPTABLES -A FORWARD -p ALL -i $LAN_IFACE -m set --match-set whitelist src,src -j fw_allow
  174. $IPTABLES -A FORWARD -p ALL -i $LAN_IFACE -m set --match-set whitelistd src,src -j fw_allow
  175. #$IPTABLES -A FORWARD -p ALL -i $LAN_IFACE -m set ! --match-set whitelist src,src -j LOG --log-level notice --log-prefix "IPT not WHITELIST request: "
  176. $IPTABLES -A FORWARD -p ALL -i $LAN_IFACE -m set --match-set ipwhite src -j fw_allow
  177. #$IPTABLES -A FORWARD -p ALL -i $LAN_IFACE -m set ! --match-set ipwhite src -j LOG --log-level notice --log-prefix "IPT not IPWHITE request: "
  178.  
  179.  
  180. #$IPTABLES -A FORWARD -i $INET_IFACE -j ACCEPT
  181. #$IPTABLES -A FORWARD -i $PPP0_IFACE -j ACCEPT
  182. #$IPTABLES -A FORWARD -i $PPP1_IFACE -j ACCEPT
  183. $IPTABLES -A FORWARD -m limit --limit 1/hour --limit-burst 5 -j LOG --log-level notice --log-prefix "IPT FORWARD packet died: "
  184.  
  185. # INPUT chain
  186. #$IPTABLES -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-level notice --log-prefix "New not syn:"
  187. #$IPTABLES -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  188. $IPTABLES -A INPUT -p tcp -j bad_tcp_packets
  189. $IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
  190. $IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
  191. $IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets
  192. $IPTABLES -A INPUT -p ALL -d $STATIC_IP -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
  193. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d 255.255.255.255 -j ACCEPT
  194. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
  195. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_IP -j ACCEPT
  196. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN2_BCAST_ADRESS -j ACCEPT
  197. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN2_IP -j ACCEPT
  198. #$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -m set --match-set whitelist src -d $LAN_IP -j ACCEPT
  199. #$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -m set ! --match-set whitelist src -d $LAN_IP -j DROP
  200. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $STATIC_IP -j ACCEPT
  201. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -d $LOCALHOST_IP -j ACCEPT
  202. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -d $LAN_IP -j ACCEPT
  203. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -d $LAN2_IP -j ACCEPT
  204. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -d $STATIC_IP -j ACCEPT
  205. $IPTABLES -A INPUT -p ALL -i $PPP0_IFACE -d $PPP0_IP -j ACCEPT
  206. $IPTABLES -A INPUT -p ALL -i $PPP0_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
  207. #$IPTABLES -A INPUT -p ALL -i $PPP1_IFACE -d $PPP1_IP -j ACCEPT
  208. #$IPTABLES -A INPUT -p ALL -i $PPP1_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
  209. $IPTABLES -A INPUT -m limit --limit 1/hour --limit-burst 5 -j LOG --log-level notice --log-prefix "IPT INPUT packet died: "
  210.  
  211. # OUTPUT chain
  212. #$IPTABLES -A OUTPUT -p tcp ! --syn -m conntrack --ctstate NEW -j LOG --log-level notice --log-prefix "New not syn:"
  213. #$IPTABLES -A OUTPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  214. $IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
  215. $IPTABLES -A OUTPUT -p ALL -s $LOCALHOST_IP -j ACCEPT
  216. $IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
  217. $IPTABLES -A OUTPUT -p ALL -s $LAN2_IP -j ACCEPT
  218. $IPTABLES -A OUTPUT -p ALL -s $STATIC_IP -j ACCEPT
  219. $IPTABLES -A OUTPUT -p ALL -s $PPP0_IP -j ACCEPT
  220. #$IPTABLES -A OUTPUT -p ALL -s $PPP1_IP -j ACCEPT
  221. $IPTABLES -A OUTPUT -m limit --limit 1/hour --limit-burst 5 -j LOG --log-level notice --log-prefix "IPT OUTPUT packet died: "
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!