Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. #!/bin/bash
  2. #
  3. # Modelo Firewall By Thiago Laurito
  4. #
  5. # Site <http://slackdummies.blogspot.com>
  6. # Email <thiago.laurito@gmail.com>
  7. # Data 27/01/2011 01:33 :)
  8. #
  9.  
  10. # Carregando Módulos para funcoes especificas do Iptables.
  11. modprobe    ip_tables
  12. modprobe    iptable_nat
  13. modprobe    ip_conntrack
  14. modprobe    ip_conntrack_ftp
  15. modprobe    ip_nat_ftp
  16. modprobe    ipt_LOG
  17. modprobe    ipt_REJECT
  18. modprobe    ipt_MASQUERADE
  19. modprobe    ipt_state
  20. modprobe    ipt_multiport
  21. modprobe    iptable_mangle
  22. modprobe    ipt_tos
  23. modprobe    ipt_limit
  24. modprobe    ipt_mark
  25. modprobe    ipt_MARK
  26.  
  27. # Alteracoes de protecao no Kernel
  28. echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  29. echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
  30.  
  31. # Habilitando ip_forward para roteamento na rede através do Firewall.
  32. echo "1" > /proc/sys/net/ipv4/ip_forward
  33.  
  34. # Habilitando broadcast echo Protection
  35. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  36.  
  37. # Disabilitando Source Routed Packets
  38. for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
  39.     echo 0 > $f
  40. done
  41.  
  42. # Habilitando TCP SYN Cookie Protection
  43. echo 1 > /proc/sys/net/ipv4/tcp_syncookies
  44.  
  45. # Disabilitando ICMP Redirect Acceptance
  46. for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
  47.     echo 0 > $f
  48. done
  49.  
  50. # Nao Envia Redirect Messages
  51. for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
  52.     echo 0 > $f
  53. done
  54.  
  55. # Disabilitando ICMP Redirect Acceptance
  56. for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
  57.     echo 0 > $f
  58. done
  59.  
  60. # Dropando Spoofed Packets.
  61. for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
  62.     echo 1 > $f
  63. done
  64.  
  65. # Log packets com enderecos impossiveis.
  66. for f in /proc/sys/net/ipv4/conf/*/log_martians; do
  67.     echo 1 > $f
  68. done
  69.  
  70. # Limpando as regras default Chain.
  71. iptables -F
  72. iptables -F INPUT
  73. iptables -F OUTPUT
  74. iptables -F FORWARD
  75. iptables -t mangle -F
  76. iptables -t nat -F
  77. iptables -X
  78. iptables -X -t nat
  79. iptables -X -t mangle
  80.  
  81. # Zera os Contadores
  82. iptables -Z
  83.  
  84. # Aplicando Police nas Chains INPUT/FORWARD/OUTPUT
  85. iptables -P INPUT DROP
  86. iptables -P FORWARD DROP
  87. iptables -P OUTPUT ACCEPT
  88.  
  89. # Liberacao interna entre os processos do FIrewall
  90. iptables -I INPUT -i lo -j ACCEPT
  91. iptables -I OUTPUT -o lo -j ACCEPT
  92. iptables -I INPUT -m state --state ESTABLISHED -j ACCEPT
  93. iptables -I INPUT -m state --state RELATED -j ACCEPT
  94. iptables -I INPUT -p icmp -j ACCEPT
  95.  
  96. # Bloqueio Shealt Scan.
  97. iptables -A FORWARD -m comment --comment "Bloqueio Shealt Scan" -p tcp --tcp-flags SYN,ACK, FIN, -m limit --limit 1/s -j ACCEPT
  98.  
  99. # Bloqueio Contra SYN-FLOODS
  100. iptables -A FORWARD -m comment --comment "Bloqueio SYN-FLOODS" -p tcp --syn -m limit --limit 1/s -j ACCEPT
  101.  
  102. # Bloqueio Ping da Morte
  103. iptables -A FORWARD -m comment --comment "Bloqueio Ping da Morte" -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
  104.  
  105. # Liberando tráfego IPV6
  106. ip6tables -A INPUT -i lo -j ACCEPT
  107. ip6tables -A INPUT -p icmpv6 -i eth1 -j ACCEPT
  108. ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  109. ip6tables -A INPUT -j DROP
  110.  
  111. # Liberando SNMP
  112. iptables -A INPUT -m comment --comment "Liberacao SNMP" -p udp --dport 161 -j ACCEPT
  113. iptables -A FORWARD -m comment --comment "Liberacao SNMP" -p udp --dport 161 -j ACCEPT
  114.  
  115. # Liberando acesso da rede interna (Trocar para o IP Rede.)
  116. iptables -A INPUT -p tcp --syn -s 192.168.1.0/24 -j ACCEPT
  117. iptables -A FORWARD -p tcp --syn -s 192.168.1.0/24 -j ACCEPT
  118. iptables -A OUTPUT -p tcp --syn -s 192.168.1.0/24 -j ACCEPT