API tools faq
paste
Guest User

rc.firewall

a guest
Jul 21st, 2012
399
0
Never
8
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.36 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2.  
  3. # Сценарий предназначен для настройки маршрутизации и
  4. # межсетевого экрана на маршрутизаторе офисной сети.
  5. # Для запуска переименуйте сценарий в rc.firewall
  6. # и дайте права доступа 755
  7.  
  8. # LAN/INET Configuration
  9. # Приведите в соответствие с настройками ваших сетей
  10. # следующие семь параметров!
  11. LAN_IFACE=eth1
  12. LAN_IP=192.168.1.22
  13. LAN_IP_RANGE=192.168.1.0/24
  14. LAN_BCAST_ADRESS=192.168.1.255/24
  15.  
  16. INET_IFACE=eth0
  17. STATIC_IP=172.26.38.226
  18. STATIC_BCAST_ADRESS=172.26.38.224
  19.  
  20. LO_IFACE=lo
  21. LOCALHOST_IP=127.0.0.1
  22.  
  23. #PPP0_IP=0.0.0.0
  24. #PPP0_IFACE=ppp0
  25. #PPP1_IP=0.0.0.0
  26. #PPP1_IFACE=ppp1
  27.  
  28. # IPTables Configuration.
  29. IPTABLES="/usr/sbin/iptables"
  30.  
  31. # Required modules
  32. /sbin/modprobe ip_tables
  33. /sbin/modprobe ip_nat
  34. /sbin/modprobe ip_conntrack
  35. /sbin/modprobe iptable_filter
  36. /sbin/modprobe iptable_mangle
  37. /sbin/modprobe iptable_nat
  38. /sbin/modprobe ipt_LOG
  39. /sbin/modprobe ipt_limit
  40. /sbin/modprobe ipt_state
  41. /sbin/modprobe nf_tproxy_core
  42.  
  43. # Non-Required modules
  44. /sbin/modprobe ipt_owner
  45. /sbin/modprobe ipt_REJECT
  46. /sbin/modprobe ipt_MASQUERADE
  47. /sbin/modprobe ip_conntrack_ftp
  48. /sbin/modprobe ip_conntrack_irc
  49. /sbin/modprobe ip_nat_ftp
  50. /sbin/modprobe ip_nat_irc
  51.  
  52. echo 1 > /proc/sys/net/ipv4/ip_forward
  53. echo 1 > /proc/sys/net/ipv4/conf/$INET_IFACE/proxy_arp
  54.  
  55. # Clear ALL rules
  56. $IPTABLES -F
  57. $IPTABLES -X
  58. $IPTABLES -t nat -F
  59. #----------------------------------------------------------------------------------------------------------
  60.  
  61. # Set default policies for the INPUT, FORWARD and OUTPUT chains
  62. $IPTABLES -P INPUT DROP
  63. $IPTABLES -P OUTPUT DROP
  64. $IPTABLES -P FORWARD DROP
  65.  
  66. # Create chain for bad tcp packets
  67. $IPTABLES -N bad_tcp_packets
  68.  
  69. # Create separate chains for ICMP, TCP and UDP to traverse
  70. $IPTABLES -N allowed
  71. $IPTABLES -N icmp_packets
  72. $IPTABLES -N tcp_packets
  73. $IPTABLES -N udpincoming_packets
  74. #$IPTABLES -N whitelist
  75.  
  76. # bad_tcp_packets chain
  77. $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
  78. $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "Bad TCP packet: "
  79. $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
  80.  
  81. # TCP sync rules
  82. $IPTABLES -A allowed -p TCP --syn -j ACCEPT
  83. $IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
  84. $IPTABLES -A allowed -p TCP -j DROP
  85.  
  86. #$IPTABLES -A whitelist -j ACCEPT
  87.  
  88. # ICMP rules
  89. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT
  90. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
  91. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 5 -j ACCEPT
  92. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
  93. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
  94.  
  95. # TCP rules
  96. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
  97. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed
  98. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 53 -j allowed
  99. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
  100. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 110 -j allowed
  101. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 3690 -j allowed
  102.  
  103. # UDP ports
  104. $IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
  105.  
  106. #----------------------------------------------------------------------------------------------------------
  107.  
  108. # PREROUTING chain
  109. #$IPTABLES -t nat -A PREROUTING -p tcp -s 83.237.192.219 --dport 3389 -j DNAT --to 10.0.0.4
  110. #$IPTABLES -t nat -A PREROUTING -p tcp --dport 3389 -j DNAT --to 192.168.1.12
  111. #$IPTABLES -t nat -A PREROUTING -p tcp -j DNAT --to-destination 10.0.0.69
  112.  
  113. # Black list
  114. #$IPTABLES -t nat -A PREROUTING -s 10.0.0.0/24 -p tcp --dport 80 -j DROP
  115. #$IPTABLES -t nat -A PREROUTING -s 10.0.0.65 -p tcp -j DROP
  116. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 218.202.223.0/24 -j DROP
  117. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 203.155.45.0/24 -j DROP
  118. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 203.145.172.0/24 -j DROP
  119. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 61.103.66.0/24 -j DROP
  120. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 61.189.192.0/24 -j DROP
  121. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 212.25.92.0/24 -j DROP
  122. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 213.176.8.0/24 -j DROP
  123. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 85.37.242.0/24 -j DROP
  124. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 194.167.228.0/24 -j DROP
  125. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 61.247.228.0/24 -j DROP
  126. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 194.185.192.0/24 -j DROP
  127. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 200.71.43.0/24 -j DROP
  128. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 211.233.14.0/24 -j DROP
  129. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 61.218.130.0/24 -j DROP
  130. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 217.199.177.0/24 -j DROP
  131. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 61.211.237.0/24 -j DROP
  132. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 61.211.237.0/24 -j DROP
  133. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 61.64.198.0/24 -j DROP
  134. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 218.108.49.0/24 -j DROP
  135. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 212.24.173.0/24 -j DROP
  136. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 70.88.217.0/24 -j DROP
  137. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 216.23.168.0/24 -j DROP
  138. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 69.60.114.0/24 -j DROP
  139. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 62.183.226.0/24 -j DROP
  140. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 213.227.43.0/24 -j DROP
  141. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 203.232.240.0/24 -j DROP
  142. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 202.8.87.0/24 -j DROP
  143. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 200.142.104.0/24 -j DROP
  144. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 200.89.142.0/24 -j DROP
  145. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 235.187.99.0/24 -j DROP
  146. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 213.207.57.0/24 -j DROP
  147. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 100.154.68.0/24 -j DROP
  148. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/8 -j DROP
  149. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 172.16.0.0/12 -j DROP
  150. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 192.168.0.0/16 -j DROP
  151. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -d 10.0.0.0/8 -j DROP
  152. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -d 172.16.0.0/12 -j DROP
  153. #$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -d 192.168.0.0/16 -j DROP
  154.  
  155. # ********* Redirect to SQUID **********
  156. #$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE -p tcp --dport 80 -j REDIRECT --to-port 3129
  157. #$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE -p tcp --dport 21 -j REDIRECT --to-port 3129
  158.  
  159.  
  160. #$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -p tcp -m socket -j DIVERT
  161. #$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -p tcp -m socket -j DIVERT
  162. #$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129
  163. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 80 -j TPROXY --on-port 3129
  164. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 8080 -j TPROXY --on-port 3129
  165. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 443 -j TPROXY --on-port 3129
  166. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 2080 -j TPROXY --on-port 3129
  167. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 2082 -j TPROXY --on-port 3129
  168. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 563 -j TPROXY --on-port 3129
  169. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 777 -j TPROXY --on-port 3129
  170. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 21 -j TPROXY --on-port 3129
  171. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 10000 -j TPROXY --on-port 3129
  172. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 110 -j TPROXY --on-port 3129
  173. $IPTABLES -t mangle -A PREROUTING '!' -d 192.168.1.22 -p tcp --dport 25 -j TPROXY --on-port 3129
  174.  
  175. # FORWARD chain
  176.  
  177.  
  178. # POSTROUTING chain
  179. $IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -s $LAN_IP_RANGE -j SNAT --to-source $STATIC_IP
  180. #$IPTABLES -A FORWARD -j LOG --log-level debug --log-prefix "IPT FORWARD packet died: "
  181. #$IPTABLES -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level notice --log-prefix "New not syn:"
  182. #$IPTABLES -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
  183. $IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
  184. $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  185.  
  186.  
  187. #$IPTABLES -t filter -A FORWARD -i eth1 -o eth0 -s 192.168.0.5 -m mac --mac-source 00:11:22:aa:bb:cc -j ACCEPT
  188. $IPTABLES -t filter -A FORWARD -i $LAN_IFACE -s 192.168.1.150 -j ACCEPT # White list
  189.  
  190.  
  191. $IPTABLES -t filter -A FORWARD -i $LAN_IFACE -j LOG --log-level notice --log-prefix "IPT FILTERED: "
  192. $IPTABLES -t filter -A FORWARD -i $LAN_IFACE -j DROP
  193.  
  194.  
  195.  
  196.  
  197. #$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
  198. $IPTABLES -A FORWARD -i $INET_IFACE -j ACCEPT
  199. #$IPTABLES -A FORWARD -i $PPP0_IFACE -j ACCEPT
  200. #$IPTABLES -A FORWARD -i $PPP1_IFACE -j ACCEPT
  201. $IPTABLES -A FORWARD -m limit --limit 1/hour --limit-burst 5 -j LOG --log-level notice --log-prefix "IPT FORWARD packet died: "
  202.  
  203. # INPUT chain
  204. #$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-level notice --log-prefix "New not syn:"
  205. #$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  206. $IPTABLES -A INPUT -p tcp -j bad_tcp_packets
  207. $IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
  208. $IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
  209. $IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets
  210. $IPTABLES -A INPUT -p ALL -d $STATIC_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
  211. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d 255.255.255.255 -j ACCEPT
  212. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
  213. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_IP -j ACCEPT
  214. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $STATIC_IP -j ACCEPT
  215. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -d $LOCALHOST_IP -j ACCEPT
  216. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -d $LAN_IP -j ACCEPT
  217. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -d $STATIC_IP -j ACCEPT
  218. #$IPTABLES -A INPUT -p ALL -i $PPP0_IFACE -d $PPP0_IP -j ACCEPT
  219. #$IPTABLES -A INPUT -p ALL -i $PPP0_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
  220. #$IPTABLES -A INPUT -p ALL -i $PPP1_IFACE -d $PPP1_IP -j ACCEPT
  221. #$IPTABLES -A INPUT -p ALL -i $PPP1_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
  222. $IPTABLES -A INPUT -m limit --limit 1/hour --limit-burst 5 -j LOG --log-level notice --log-prefix "IPT INPUT packet died: "
  223.  
  224. # OUTPUT chain
  225. #$IPTABLES -A OUTPUT -p tcp ! --syn -m state --state NEW -j LOG --log-level notice --log-prefix "New not syn:"
  226. #$IPTABLES -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP
  227. $IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
  228. $IPTABLES -A OUTPUT -p ALL -s $LOCALHOST_IP -j ACCEPT
  229. $IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
  230. $IPTABLES -A OUTPUT -p ALL -s $STATIC_IP -j ACCEPT
  231. #$IPTABLES -A OUTPUT -p ALL -s $PPP0_IP -j ACCEPT
  232. #$IPTABLES -A OUTPUT -p ALL -s $PPP1_IP -j ACCEPT
  233. $IPTABLES -A OUTPUT -m limit --limit 1/hour --limit-burst 5 -j LOG --log-level notice --log-prefix "IPT OUTPUT packet died: "
Advertisement
Comments
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • Tazlodorn
    Tazlodorn
    212 days
    # CSS 0.85 KB | 0 0
    view report reply
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
    8. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    9.  
    10. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).
  • User was banned
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!