#!/bin/sh

IF="eth0"
IF6="eth0"
IPTABLES=`which iptables`
IP6TABLES=`which ip6tables`


BASEDIR="/etc/firewall/"
TCP_PORTS="opened-tcp-ports"
UDP_PORTS="opened-udp-ports"
TCP_PORTS6="opened-tcp6-ports"
UDP_PORTS6="opened-udp6-ports"
BLACKLIST_IP="blacklist-ip"
BLACKLIST_IP6="blacklist-ip6"

SPOOF_IPS="0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3"


/bin/echo -n "Setting up firewall rules: "

if [ ! -d ${BASEDIR} ]; then
    mkdir -p ${BASEDIR}
fi

if [ ! -f ${BASEDIR}${TCP_PORTS} ]; then
    touch ${BASEDIR}${TCP_PORTS}
fi
if [ ! -f ${BASEDIR}${UDP_PORTS} ]; then
    touch ${BASEDIR}${UDP_PORTS}
fi
if [ ! -f ${BASEDIR}${TCP_PORTS6} ]; then
    touch ${BASEDIR}${TCP_PORTS6}
fi
if [ ! -f ${BASEDIR}${UDP_PORTS6} ]; then
    touch ${BASEDIR}${UDP_PORTS6}
fi
if [ ! -f ${BASEDIR}${BLACKLIST_IP} ]; then
    touch ${BASEDIR}${BLACKLIST_IP}
fi
if [ ! -f ${BASEDIR}${BLACKLIST_IP6} ]; then
    touch ${BASEDIR}${BLACKLIST_IP6}
fi

# Aktuális szabályok ürítése, láncok törlése
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -X -t nat

# Alap policy ACCEPT
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT


# Támadások és portscan ellen védelem

# SYN scan
$IPTABLES -N SYNSCAN
$IPTABLES -A SYNSCAN -m recent --set --name BLACKLIST_30M --rsource
$IPTABLES -I SYNSCAN -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] (Maybe) SYN scan: "

$IPTABLES -I INPUT -p tcp -m state --state NEW -m multiport --dports 23,79 -j SYNSCAN

# FIN scan
$IPTABLES -N FINSCAN
$IPTABLES -A FINSCAN -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] FIN scan: "
$IPTABLES -A FINSCAN -j DROP

$IPTABLES -I INPUT -p tcp --tcp-flags ALL FIN -j FINSCAN

# ACK scan
$IPTABLES -N ACKSCAN
$IPTABLES -A ACKSCAN -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] ACK scan: "
$IPTABLES -A ACKSCAN -j DROP

$IPTABLES -I INPUT -p tcp ! --syn -m state --state NEW -j ACKSCAN

# XMAS scan
$IPTABLES -N XMASSCAN
$IPTABLES -A XMASSCAN -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] XMAS scan: "
$IPTABLES -A XMASSCAN -j DROP

$IPTABLES -I INPUT -p tcp --tcp-flags ALL ALL -j XMASSCAN
$IPTABLES -I INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j XMASSCAN
$IPTABLES -I INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j XMASSCAN


# NULL scan
$IPTABLES -N NULLSCAN
$IPTABLES -A NULLSCAN -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] NULL scan: "
$IPTABLES -A NULLSCAN -j DROP

$IPTABLES -I INPUT -p tcp --tcp-flags ALL NONE -j NULLSCAN

# IP spoofing
$IPTABLES -N IPSPOOFING
$IPTABLES -A IPSPOOFING -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] IP spoofing: "
$IPTABLES -A IPSPOOFING -j DROP

echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

for ip in $SPOOF_IPS
do
    $IPTABLES -I INPUT -i $IF -s $ip -j IPSPOOFING
done


# UDP scan (Üres UDP csomagok)
$IPTABLES -N UDPSCAN
$IPTABLES -A UDPSCAN -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] UDP scan: "
$IPTABLES -A UDPSCAN -j DROP

$IPTABLES -I INPUT -p udp -m length --length 0:28 -j UDPSCAN

# ICMP flood

$IPTABLES -N ICMPFLOOD
$IPTABLES -A ICMPFLOOD -m limit --limit 2/s --limit-burst 2 -j RETURN
$IPTABLES -A ICMPFLOOD -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "[Firewall] ICMP flood: "
$IPTABLES -A ICMPFLOOD -m recent --set --name BLACKLIST_30M --rsource

$IPTABLES -I INPUT -p icmp -j ICMPFLOOD

# UDP flood

$IPTABLES -N UDPFLOOD
#Ez még nincs kész :))

# SYN flood

$IPTABLES -N SYNFLOOD
$IPTABLES -A SYNFLOOD -m limit --limit 2/s --limit-burst 2 -j RETURN
$IPTABLES -A SYNFLOOD -m limit --limit 1/min --limit-burst 2 -j LOG --log-prefix "[Firewall] SYN flood: "
$IPTABLES -A SYNFLOOD -m recent --set --name BLACKLIST_30M --rsource

$IPTABLES -I INPUT -p tcp --syn -j SYNFLOOD

# Invalid packages
$IPTABLES -A INPUT -m state --state INVALID -j DROP


#30 perces tiltólista
$IPTABLES -I INPUT -m recent --update --seconds 1800 --hitcount 1 --name BLACKLIST_30M --rsource -j REJECT --reject-with icmp-host-unreachable






# Bejövő TCP portok nyitása
for port in $(cat ${BASEDIR}${TCP_PORTS})
do
    $IPTABLES -A INPUT -i $IF -p tcp -m state --syn --state NEW --dport $port -j ACCEPT
done

# Bejövő UDP portok nyitása
for port in $(cat ${BASEDIR}${UDP_PORTS})
do
    $IPTABLES -A INPUT -i $IF -p tcp -m state --syn --state NEW --dport $port -j ACCEPT
done

# IPv4 feketelistás IP-k

for ip in $(cat ${BASEDIR}${BLACKLIST_IP})
do
    $IPTABLES -A INPUT -i $IF -s $ip -j REJECT --reject-with icmp-host-unreachable
done

# Néhány bejövő kapcsolat logolása...
$IPTABLES -A INPUT -i $IF -p tcp -m state --syn --state NEW --dport 32500 -j LOG --log-prefix "[Firewall] Incoming SSH connection: "


# Minden egyéb elutasítása
$IPTABLES -A INPUT -i $IF -p tcp -m state --state NEW -j REJECT --reject-with icmp-host-unreachable
$IPTABLES -A INPUT -i $IF -p udp -m state --state NEW -j REJECT --reject-with icmp-host-unreachable