API tools faq
paste
Guest User

rc.firewall.sh

a guest
Mar 4th, 2014
346
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 40.37 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2. #
  3. # rc.firewall.sh
  4.  
  5. IPT=/usr/sbin/iptables
  6. IP6TABLES="ip6tables"
  7. IPTABLES_RESTORE="iptables-restore"
  8. IP6TABLES_RESTORE="ip6tables-restore"
  9. IPSET="ipset"
  10. DEPMOD=/sbin/depmod
  11. MODPROBE=/sbin/modprobe
  12.  
  13. $IPT -F
  14. $IPT -X
  15. $IPT -t mangle -F
  16. $IPT -t mangle -X
  17. $IPT -t nat -F
  18. $IPT -t nat -X
  19.  
  20.  
  21. # Default Policy
  22. $IPT -P FORWARD DROP
  23. $IPT -P INPUT DROP
  24. $IPT -P OUTPUT DROP
  25.  
  26. # Completely disable IPv6.
  27.  
  28. $IP6TABLES -F
  29. $IP6TABLES -X
  30. $IP6TABLES -t nat -F
  31. $IP6TABLES -t nat -X
  32. $IP6TABLES -t mangle -F
  33. $IP6TABLES -t mangle -X
  34. $IP6TABLES -P INPUT DROP
  35. $IP6TABLES -P FORWARD DROP
  36. $IP6TABLES -P OUTPUT DROP
  37.  
  38. echo -e "\nDefault Policy set"
  39.  
  40. FWVER=1.0
  41.  
  42. #
  43. #               Initial SIMPLE IP Masquerade test for 2.6 / 2.4 kernels
  44. #               using IPTABLES.
  45. #
  46. #               Once IP Masquerading has been tested, with this simple
  47. #               ruleset, it is highly recommended to use a stronger
  48. #               IPTABLES ruleset either given later in this HOWTO or
  49. #               from another reputable resource.
  50. #
  51. #
  52. #
  53. # Log:
  54. #       0.76 - Added comments on why the default policy is ACCEPT
  55. #       0.75 - Added more kernel modules to the comments section
  56. #       0.74 - the ruleset now uses modprobe vs. insmod
  57. #       0.73 - REJECT is not a legal policy yet; back to DROP
  58. #       0.72 - Changed the default block behavior to REJECT not DROP
  59. #       0.71 - Added clarification that PPPoE users need to use
  60. #              "ppp0" instead of "eth0" for their external interface
  61. #       0.70 - Added commented option for IRC nat module
  62. #            - Added additional use of environment variables
  63. #            - Added additional formatting
  64. #       0.63 - Added support for the IRC IPTABLES module
  65. #       0.62 - Fixed a typo on the MASQ enable line that used eth0
  66. #              instead of $EXTIF
  67. #       0.61 - Changed the firewall to use variables for the internal
  68. #              and external interfaces.
  69. #       0.60 - 0.50 had a mistake where the ruleset had a rule to DROP
  70. #              all forwarded packets but it didn't have a rule to ACCEPT
  71. #              any packets to be forwarded either
  72. #            - Load the ip_nat_ftp and ip_conntrack_ftp modules by default
  73. #       0.50 - Initial draft
  74. #
  75.  
  76. echo -e "\n\nLoading simple rc.firewall-iptables version $FWVER..\n"
  77.  
  78. # The location of the iptables and kernel module programs
  79. #
  80. #   If your Linux distribution came with a copy of iptables,
  81. #   most likely all the programs will be located in /sbin.  If
  82. #   you manually compiled iptables, the default location will
  83. #   be in /usr/local/sbin
  84. #
  85. # ** Please use the "whereis iptables" command to figure out
  86. # ** where your copy is and change the path below to reflect
  87. # ** your setup
  88. #
  89.  
  90. #Setting the EXTERNAL and INTERNAL interfaces for the network
  91. #
  92. #  Each IP Masquerade network needs to have at least one
  93. #  external and one internal network.  The external network
  94. #  is where the natting will occur and the internal network
  95. #  should preferably be addressed with a RFC1918 private address
  96. #  scheme.
  97. #
  98. #  For this example, "eth0" is external and "eth1" is internal"
  99. #
  100. #
  101. #  NOTE:  If this doesnt EXACTLY fit your configuration, you must
  102. #         change the EXTIF or INTIF variables above. For example:
  103. #
  104. #            If you are a PPPoE or analog modem user:
  105. #
  106. #               EXTIF="ppp0"
  107. #
  108. #
  109. EXTIF="eth0"
  110. INTIF="eth1"
  111. echo "   External Interface:  $EXTIF"
  112. echo "   Internal Interface:  $INTIF"
  113.  
  114.  
  115. #======================================================================
  116. #== No editing beyond this line is required for initial MASQ testing ==
  117.  
  118.  
  119. echo -en "   loading modules: "
  120.  
  121. # Need to verify that all modules have all required dependencies
  122. #
  123. ####echo "  - Verifying that all kernel modules are ok"
  124. ####$DEPMOD -a
  125.  
  126. # With the new IPTABLES code, the core MASQ functionality is now either
  127. # modular or compiled into the kernel.  This HOWTO shows ALL IPTABLES
  128. # options as MODULES.  If your kernel is compiled correctly, there is
  129. # NO need to load the kernel modules manually.
  130. #
  131. #  NOTE: The following items are listed ONLY for informational reasons.
  132. #        There is no reason to manual load these modules unless your
  133. #        kernel is either mis-configured or you intentionally disabled
  134. #        the kernel module autoloader.
  135. #
  136.  
  137. # Upon the commands of starting up IP Masq on the server, the
  138. # following kernel modules will be automatically loaded:
  139. #
  140. # NOTE:  Only load the IP MASQ modules you need.  All current IP MASQ
  141. #        modules are shown below but are commented out from loading.
  142. # ===============================================================
  143.  
  144. echo "----------------------------------------------------------------------"
  145.  
  146. #Load the main body of the IPTABLES module - "iptable"
  147. #  - Loaded automatically when the "iptables" command is invoked
  148. #
  149. #  - Loaded manually to clean up kernel auto-loading timing issues
  150. #
  151. echo -en "\nip_tables, "
  152. $MODPROBE ip_tables
  153.  
  154.  
  155. #Load the IPTABLES filtering module - "iptable_filter"
  156. #  - Loaded automatically when filter policies are activated
  157.  
  158.  
  159. #Load the stateful connection tracking framework - "ip_conntrack"
  160. #
  161. # The conntrack  module in itself does nothing without other specific
  162. # conntrack modules being loaded afterwards such as the "ip_conntrack_ftp"
  163. # module
  164. #
  165. #  - This module is loaded automatically when MASQ functionality is
  166. #    enabled
  167. #
  168. #  - Loaded manually to clean up kernel auto-loading timing issues
  169. #
  170. echo -en "\nip_conntrack, "
  171. $MODPROBE ip_conntrack
  172.  
  173.  
  174. #Load the FTP tracking mechanism for full FTP tracking
  175. #
  176. # Enabled by default -- insert a "#" on the next line to deactivate
  177. #
  178. echo -en "\nip_conntrack_ftp, "
  179. $MODPROBE ip_conntrack_ftp
  180.  
  181.  
  182. #Load the IRC tracking mechanism for full IRC tracking
  183. #
  184. # Enabled by default -- insert a "#" on the next line to deactivate
  185. #
  186. echo -en "\nip_conntrack_irc, "
  187. $MODPROBE ip_conntrack_irc
  188.  
  189.  
  190. #Load the general IPTABLES NAT code - "iptable_nat"
  191. #  - Loaded automatically when MASQ functionality is turned on
  192. #
  193. #  - Loaded manually to clean up kernel auto-loading timing issues
  194. #
  195. echo -en "\niptable_nat, "
  196. $MODPROBE iptable_nat
  197.  
  198.  
  199. #Loads the FTP NAT functionality into the core IPTABLES code
  200. # Required to support non-PASV FTP.
  201. #
  202. # Enabled by default -- insert a "#" on the next line to deactivate
  203. #
  204. echo -en "\nip_nat_ftp, "
  205. $MODPROBE ip_nat_ftp
  206.  
  207.  
  208. #Loads the IRC NAT functionality into the core IPTABLES code
  209. # Required to support NAT of IRC DCC requests
  210. #
  211. # Disabled by default -- remove the "#" on the next line to activate
  212. #
  213. #echo -e "ip_nat_irc"
  214. #$MODPROBE ip_nat_irc
  215.  
  216. echo -e "\n----------------------------------------------------------------------"
  217.  
  218. # Just to be complete, here is a partial list of some of the other
  219. # IPTABLES kernel modules and their function.  Please note that most
  220. # of these modules (the ipt ones) are automatically loaded by the
  221. # master kernel module for proper operation and don't need to be
  222. # manually loaded.
  223. # --------------------------------------------------------------------
  224. #
  225. #    ip_nat_snmp_basic - this module allows for proper NATing of some
  226. #                        SNMP traffic
  227. #
  228. #    iptable_mangle    - this target allows for packets to be
  229. #                        manipulated for things like the TCPMSS
  230. #                        option, etc.
  231. #
  232. # --
  233. #
  234. #    ipt_mark       - this target marks a given packet for future action.
  235. #                     This automatically loads the ipt_MARK module
  236. #
  237. #    ipt_tcpmss     - this target allows to manipulate the TCP MSS
  238. #                     option for braindead remote firewalls.
  239. #                     This automatically loads the ipt_TCPMSS module
  240. #
  241. #    ipt_limit      - this target allows for packets to be limited to
  242. #                     to many hits per sec/min/hr
  243. #
  244. #    ipt_multiport  - this match allows for targets within a range
  245. #                     of port numbers vs. listing each port individually
  246. #
  247. #    ipt_state      - this match allows to catch packets with various
  248. #                     IP and TCP flags set/unset
  249. #
  250. #    ipt_unclean    - this match allows to catch packets that have invalid
  251. #                     IP/TCP flags set
  252. #
  253. #    iptable_filter - this module allows for packets to be DROPped,
  254. #                     REJECTed, or LOGged.  This module automatically
  255. #                     loads the following modules:
  256. #
  257. #                     ipt_LOG - this target allows for packets to be
  258. #                               logged
  259. #
  260. #                     ipt_REJECT - this target DROPs the packet and returns
  261. #                                  a configurable ICMP packet back to the
  262. #                                  sender.
  263. #
  264.  
  265. echo -e "   Done loading modules.\n"
  266.  
  267.  
  268.  
  269. #CRITICAL:  Enable IP forwarding since it is disabled by default since
  270. #
  271. #           Redhat Users:  you may try changing the options in
  272. #                          /etc/sysconfig/network from:
  273. #
  274. #                       FORWARD_IPV4=false
  275. #                             to
  276. #                       FORWARD_IPV4=true
  277. #
  278. echo "   Enabling forwarding.."
  279. echo "1" > /proc/sys/net/ipv4/ip_forward
  280. echo "0" > /proc/sys/net/ipv6/conf/all/forwarding
  281.  
  282. # Dynamic IP users:
  283. #
  284. #   If you get your IP address dynamically from SLIP, PPP, or DHCP,
  285. #   enable this following option.  This enables dynamic-address hacking
  286. #   which makes the life with Diald and similar programs much easier.
  287. #
  288. echo "   Enabling DynamicAddr.."
  289. echo "1" > /proc/sys/net/ipv4/ip_dynaddr
  290.  
  291.  
  292. # Enable simple IP forwarding and Masquerading
  293. #
  294. #  NOTE:  In IPTABLES speak, IP Masquerading is a form of SourceNAT or SNAT.
  295. #
  296. #  NOTE #2:  The following is an example for an internal LAN address in the
  297. #            192.168.0.x network with a 255.255.255.0 or a "24" bit subnet mask
  298. #            connecting to the Internet on external interface "eth0".  This
  299. #            example will MASQ internal traffic out to the Internet but not
  300. #            allow non-initiated traffic into your internal network.
  301. #
  302. #
  303. #         ** Please change the above network numbers, subnet mask, and your
  304. #         *** Internet connection interface name to match your setup
  305. #
  306.  
  307.  
  308. #Clearing any previous configuration
  309. #
  310. #  Unless specified, the defaults for INPUT and OUTPUT is ACCEPT
  311. #    The default for FORWARD is DROP (REJECT is not a valid policy)
  312. #
  313. #   Isn't ACCEPT insecure?  To some degree, YES, but this is our testing
  314. #   phase.  Once we know that IPMASQ is working well, I recommend you run
  315. #   the rc.firewall-*-stronger rulesets which set the defaults to DROP but
  316. #   also include the critical additional rulesets to still let you connect to
  317. #   the IPMASQ server, etc.
  318. #
  319.  
  320.  
  321. # DISABLE TCP TIMESTAMPS ON LINUX
  322. # http://www.tmltechnologies.com/html-2012/index.php/linux-rescue-kits/82-secret/91-disable-tcp-timestamps-on-linux
  323. #echo 0 > /proc/sys/net/ipv4/tcp_timestamps
  324. echo 1 > /proc/sys/net/ipv4/tcp_timestamps
  325.  
  326. #for i in /proc/sys/net/ipv4/conf/all/mc_forwarding; do echo 0 > $i; done # doesn't work with my current setup
  327.  
  328.  
  329. echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
  330. echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
  331. echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
  332. echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
  333. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  334. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
  335. echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  336. echo 1 > /proc/sys/net/ipv4/tcp_syncookies
  337. for i in /proc/sys/net/ipv4/conf/all/send_redirects; do echo 0 > $i; done
  338. for i in /proc/sys/net/ipv4/conf/all/proxy_arp; do echo 0 > $i; done
  339. for i in /proc/sys/net/ipv4/conf/all/secure_redirects; do echo 1 > $i; done
  340. for i in /proc/sys/net/ipv4/conf/all/bootp_relay; do echo 0 > $i; done
  341.  
  342.  
  343. echo -n "Block Broadcast Response"
  344. #net.ipv4.icmp_echo_ignore_broadcasts=1
  345.  
  346. echo -n "Enable protection for bad icmp error messages"
  347. #net.ipv4.icmp_ignore_bogus_error_responses = 1
  348.  
  349. echo -n "Enable syncookies for SYN flood attack protection"
  350. #net.ipv4.tcp_syncookies = 1
  351.  
  352. echo -n "Log spoofed, source routed, and redirect packets"
  353. #net.ipv4.conf.all.log_martians = 1
  354. net.ipv4.conf.default.log_martians = 1
  355.  
  356. echo -n "Don't allow source routed packets"
  357. #net.ipv4.conf.all.accept_source_route = 0
  358. net.ipv4.conf.default.accept_source_route = 0
  359.  
  360. echo -n "Turn on reverse path filtering"
  361. #net.ipv4.conf.all.rp_filter = 1
  362. net.ipv4.conf.default.rp_filter = 1
  363.  
  364. echo -n "Don't allow outsiders to alter the routing tables"
  365. #net.ipv4.conf.all.accept_redirects = 0
  366. net.ipv4.conf.default.accept_redirects = 0
  367. #net.ipv4.conf.all.secure_redirects = 0
  368. #net.ipv4.conf.default.secure_redirects = 0
  369.  
  370. echo -n "Don't pass traffic between networks or act as a router"
  371. #net.ipv4.conf.all.send_redirects = 0
  372. #net.ipv4.conf.default.send_redirects = 0
  373.  
  374. echo -n "Disable Core Dumps"
  375. fs.suid_dumpable = 0
  376.  
  377.  
  378. $IPSET flush
  379. $IPSET destroy blacklist
  380. $IPSET destroy IANA
  381. $IPSET create blacklist hash:ip hashsize 4096
  382. $IPSET create IANA hash:net
  383. $IPSET restore < /usr/local/security/blacklists/blacklist
  384. $IPSET restore < /usr/local/security/blacklists/IANA
  385.  
  386.  
  387.  
  388.  
  389.  
  390.  
  391.  
  392.  
  393. echo "Setting up Mangle"
  394. # Generated by iptables-save v1.4.20 on Sun Mar  2 00:55:26 2014
  395. #$IPT -t mangle -P PREROUTING ACCEPT
  396. #$IPT -t mangle -P INPUT ACCEPT
  397. #$IPT -t mangle -P FORWARD ACCEPT
  398. #$IPT -t mangle -P OUTPUT ACCEPT
  399. #$IPT -t mangle -P POSTROUTING ACCEPT
  400. #$IPT -t mangle -A PREROUTING -i lo -j ACCEPT
  401. #$IPT -t mangle -A PREROUTING -i eth1 -j ACCEPT
  402. #$IPT -t mangle -A PREROUTING -s 192.168.0.0/16 -i eth1 -j ACCEPT
  403. #$IPT -t mangle -A PREROUTING -d 192.168.0.0/16 -i eth1 -j ACCEPT
  404. #$IPT -t mangle -A PREROUTING -s 10.0.0.0/8 -i eth0 -j DROP
  405. #$IPT -t mangle -A PREROUTING -s 169.254.0.0/16 -i eth0 -j DROP
  406. #$IPT -t mangle -A PREROUTING -s 172.16.0.0/12 -i eth0 -j DROP
  407. #$IPT -t mangle -A PREROUTING -s 192.168.0.0/16 -i eth0 -j DROP
  408. #$IPT -t mangle -A PREROUTING -d 10.0.0.0/8 -i eth0 -j DROP
  409. #$IPT -t mangle -A PREROUTING -d 168.254.0.0/16 -i eth0 -j DROP
  410. #$IPT -t mangle -A PREROUTING -d 172.16.0.0/12 -i eth0 -j DROP
  411. #$IPT -t mangle -A PREROUTING -d 192.168.0.0/16 -i eth0 -j DROP
  412. #$IPT -t mangle -A FORWARD -o lo -j ACCEPT
  413. #$IPT -t mangle -A FORWARD -o eth0 -j ACCEPT
  414. #$IPT -t mangle -A FORWARD -o eth1 -j ACCEPT
  415. #$IPT -t mangle -A OUTPUT -o lo -j ACCEPT
  416. #$IPT -t mangle -A OUTPUT -o eth0 -j ACCEPT
  417. #$IPT -t mangle -A OUTPUT -o eth1 -j ACCEPT
  418. #$IPT -t mangle -A POSTROUTING -o lo -j ACCEPT
  419. #$IPT -t mangle -A POSTROUTING -o eth0 -j ACCEPT
  420. #$IPT -t mangle -A POSTROUTING -o eth1 -j ACCEPT
  421. # Completed on Sun Mar  2 00:55:26 2014
  422. # Generated by iptables-save v1.4.20 on Sun Mar  2 00:55:26 2014
  423.  
  424.  
  425.  
  426.  
  427.  
  428.  
  429. echo "Setting up NAT"
  430. $IPT -t nat -A PREROUTING -i eth0 -m state --state RELATED,ESTABLISHED -j DNAT --to-destination windows_ip
  431. $IPT -t nat -A PREROUTING -i eth0 -p udp -m udp --dport p2pport1 -j DNAT --to-destination windows_ip:p2pport1
  432. $IPT -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport utorrent_port -j DNAT --to-destination windows_ip:utorrent_port
  433. $IPT -t nat -A PREROUTING -i eth0 -p udp -m udp --dport utorrent_port -j DNAT --to-destination windows_ip:utorrent_port
  434. $IPT -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport p2pport2 -j DNAT --to-destination windows_ip:p2pport2
  435. $IPT -t nat -A PREROUTING -i eth0 -p udp -m udp --dport p2pport2 -j DNAT --to-destination windows_ip:p2pport2
  436. $IPT -t nat -A PREROUTING -i eth1 -j ACCEPT
  437. $IPT -t nat -A OUTPUT -o lo -j ACCEPT
  438. $IPT -t nat -A OUTPUT -o eth0 -j ACCEPT
  439. $IPT -t nat -A OUTPUT -o eth1 -j ACCEPT
  440.  
  441.  
  442. echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
  443. $IPT -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
  444.  
  445.  
  446. # These two rules did not work
  447. #$IPT -t nat -A POSTROUTING -i eth1 -o eth0 -j MASQUERADE
  448. #$IPT -t nat -A POSTROUTING -o eth0 -s windows_ip/32 -d ! 192.168.0.0/24 -j MASQUERADE
  449.  
  450. ######$IPT -t nat -A POSTROUTING -s windows_ip/32 -o eth0 -j MASQUERADE
  451. #$IPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  452.  
  453. $IPT -t nat -A POSTROUTING -o lo -j ACCEPT
  454. $IPT -t nat -A POSTROUTING -o eth0 -j ACCEPT
  455. $IPT -t nat -A POSTROUTING -o eth1 -j ACCEPT
  456. # Completed on Sun Mar  2 00:55:26 2014
  457. # Generated by iptables-save v1.4.20 on Sun Mar  2 00:55:26 2014
  458.  
  459.  
  460.  
  461.  
  462.  
  463.  
  464.  
  465.  
  466.  
  467. # Filter
  468.  
  469. echo "   Clearing any existing rules and setting default policy."
  470. # Filter Chains
  471.  
  472. echo "Setting up Chains"
  473. # Established, Related
  474. $IPT -N ESTABLISHED_FWD
  475. $IPT -N ESTABLISHED_IN
  476. $IPT -N ESTABLISHED_OUT
  477.  
  478. # Bad / Invalid Flags
  479. $IPT -N BAD_FLAGS_FWD
  480. $IPT -N BAD_FLAGS_IN
  481. $IPT -N BAD_FLAGS_OUT
  482.  
  483. # Blacklist
  484. $IPT -N BLACKLISTED_IN
  485. $IPT -N BLACKLISTED_OUT
  486. $IPT -N BLACKLISTED_FWD_OUT
  487. $IPT -N BLACKLISTED_FWD_IN
  488.  
  489.  
  490. # Broadcast / DHCP
  491. $IPT -N BROADCAST_IN
  492. $IPT -N BROADCAST_OUT
  493. $IPT -N BROADCAST_TO_DHCP
  494. $IPT -N IP_TO_DHCP_OUT
  495. $IPT -N DHCP_TO_BROADCAST
  496. $IPT -N DHCP_TO_IP
  497.  
  498. # DNS
  499. $IPT -N DNS_OUT
  500.  
  501. # Default Access in and out
  502. $IPT -N DEFAULT_FWD_OUT
  503. $IPT -N DEFAULT_FWD_IN
  504. $IPT -N DEFAULT_IN
  505. $IPT -N DEFAULT_OUT
  506.  
  507. # SSH access
  508. $IPT -N WIN_TO_LINUX_SSH_IN
  509.  
  510. # Access to Synergy
  511. $IPT -N SYNERGY_IN
  512. $IPT -N SYNERGY_OUT
  513. $IPT -N ACCESS_TO_SYNERGY
  514.  
  515. # Miscellaneous access
  516. $IPT -N GITHUB_OUT
  517. $IPT -N SLACKBUILD_RSYNC_OUT
  518.  
  519. # Chaos and Tarpit
  520. $IPT -N CHAOS_DELUDE_UDP_FWD
  521. $IPT -N CHAOS_DELUDE_UDP_IN
  522. $IPT -N CHAOS_TARPIT_TCP_FWD
  523. $IPT -N CHAOS_TARPIT_TCP_IN
  524.  
  525. # Log and Drop
  526. $IPT -N DROP_ALL_FWD
  527. $IPT -N DROP_ALL_IN
  528. $IPT -N DROP_ALL_OUT
  529. $IPT -N DROP_INVALID
  530.  
  531. # Access to Loopback
  532. $IPT -N LOCALHOST_TRAFFIC
  533.  
  534. # Block public access to loopback
  535. $IPT -N LOOPBACK_TO_PUBLIC
  536. $IPT -N PUBLIC_TO_LOOPBACK
  537.  
  538. # IANA Spoofs
  539. $IPT -N SPOOFED_FWD_OUT
  540. $IPT -N SPOOFED_FWD_IN
  541. $IPT -N SPOOFED_IN_1
  542. $IPT -N SPOOFED_IN_2
  543. $IPT -N SPOOFED_OUT_1
  544. $IPT -N SPOOFED_OUT_2
  545.  
  546. # Internal Spoofs
  547.  
  548. # Ip Spoofs
  549. $IPT -N SPOOFED_IP_FWD_1
  550. $IPT -N SPOOFED_IP_FWD_2
  551. $IPT -N SPOOFED_IP_IN_1
  552. $IPT -N SPOOFED_IP_IN_2
  553. $IPT -N SPOOFED_IP_OUT_1
  554. $IPT -N SPOOFED_IP_OUT_2
  555.  
  556. # Linux Spoofs
  557. $IPT -N SPOOFED_LINUX_FWD_1
  558. $IPT -N SPOOFED_LINUX_FWD_2
  559. $IPT -N SPOOFED_LINUX_IN_1
  560. $IPT -N SPOOFED_LINUX_IN_2
  561. $IPT -N SPOOFED_LINUX_OUT_1
  562. $IPT -N SPOOFED_LINUX_OUT_2
  563.  
  564. # Windows Spoofs
  565. $IPT -N SPOOFED_WINDOWS_FWD_1
  566. $IPT -N SPOOFED_WINDOWS_FWD_2
  567. $IPT -N SPOOFED_WIN_IN_1
  568. $IPT -N SPOOFED_WIN_IN_2
  569. $IPT -N SPOOFED_WIN_OUT_1
  570. $IPT -N SPOOFED_WIN_OUT_2
  571.  
  572. # Access to router
  573. $IPT -N WIN_TO_ROUTER_FWD_OUT
  574. $IPT -N WIN_TO_ROUTER_FWD_IN
  575. $IPT -N WIN_TO_ROUTER_IN
  576. $IPT -N WIN_TO_ROUTER_OUT
  577.  
  578. # Problematic Rules
  579. $IPT -N PROBLEMATIC_FORWARD_RULES
  580.  
  581.  
  582.  
  583.  
  584.  
  585.  
  586.  
  587.  
  588.  
  589.  
  590. echo "Forward"
  591.  
  592. # Established, Related
  593. $IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ESTABLISHED_FWD
  594.  
  595. # Suggestion by lartc.org/howto/lartc.cookbook.mtu-mss.html
  596. # Circumventing Path MTU Discovery issues with MSS Clamping (for ADSL, cable, PPPoE & PPtP users)
  597. # As explained above, Path MTU Discovery doesn't work as well as it should anymore.
  598. # If you know for a fact that a hop somewhere in your network has a limited (<1500) MTU, you cannot rely on PMTU Discovery finding this out.
  599. # Besides MTU, there is yet another way to set the maximum packet size, the so called Maximum Segment Size.
  600. # This is a field in the TCP Options part of a SYN packet. Recent Linux kernels, and a few PPPoE drivers
  601. # (notably, the excellent Roaring Penguin one), feature the possibility to 'clamp the MSS'. The good thing about this is
  602. # that by setting the MSS value, you are telling the remote side unequivocally
  603. # 'do not ever try to send me packets bigger than this value'. No ICMP traffic is needed to get this to work.
  604. # The bad thing is that it's an obvious hack - it breaks 'end to end' by modifying packets.
  605. # Having said that, we use this trick in many places and it works like a charm.
  606.  
  607. $IPT -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
  608.  
  609.  
  610. echo "   FWD: Allow all connections OUT and only existing and related ones IN"
  611. $IPT -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
  612. $IPT -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
  613.  
  614. #echo "Allowing forward input from eth0 and output to eth1"
  615. #$IPT -A FORWARD -d windows_ip/32 -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
  616.  
  617. #echo "Allowing forward input from eth1 and output to eth0"
  618. #$IPT -A FORWARD -s windows_ip/32 -i eth1 -o eth0 -j ACCEPT
  619.  
  620.  
  621. # Bad / Invalid Flags
  622. $IPT -A FORWARD -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j BAD_FLAGS_FWD
  623. $IPT -A FORWARD -m state --state INVALID -j DROP_INVALID
  624.  
  625. # Blacklist
  626. $IPT -A FORWARD -m set --match-set blacklist src -j BLACKLISTED_FWD_OUT
  627. $IPT -A FORWARD -m set --match-set blacklist dst -j BLACKLISTED_FWD_IN
  628.  
  629. # Internal Spoofs
  630. $IPT -A FORWARD -s public_ip/32 -d public_ip/32 -o eth0 -j SPOOFED_IP_FWD_1
  631. $IPT -A FORWARD -s public_ip/32 -d public_ip/32 -o eth1 -j SPOOFED_IP_FWD_2
  632. $IPT -A FORWARD -s linux_ip/32 -d linux_ip/32 -o eth1 -j SPOOFED_LINUX_FWD_1
  633. $IPT -A FORWARD -s linux_ip/32 -d linux_ip/32 -o eth0 -j SPOOFED_LINUX_FWD_2
  634. $IPT -A FORWARD -s windows_ip/32 -d windows_ip/32 -o eth1 -j SPOOFED_WINDOWS_FWD_1
  635. $IPT -A FORWARD -s windows_ip/32 -d windows_ip/32 -o eth0 -j SPOOFED_WINDOWS_FWD_2
  636.  
  637. # Access to Synergy
  638. $IPT -A FORWARD -p tcp -m tcp --dport real_ssh_port2 -j ACCESS_TO_SYNERGY
  639.  
  640. # Access to router
  641. $IPT -A FORWARD -s windows_ip/32 -i eth1 -m state --state NEW -j WIN_TO_ROUTER_FWD_OUT
  642. $IPT -A FORWARD -d windows_ip/32 -o eth1 -m state --state NEW -j WIN_TO_ROUTER_FWD_IN
  643.  
  644. # Access to loopback
  645. $IPT -A FORWARD -s 127.0.0.0/31 -d 127.0.0.0/31 -i lo -j LOCALHOST_TRAFFIC
  646. $IPT -A FORWARD -s 127.0.0.0/31 -d 127.0.0.0/31 -o lo -j LOCALHOST_TRAFFIC
  647.  
  648. # IANA Spoofs
  649. $IPT -A FORWARD -s 0.0.0.0/8 -j SPOOFED_FWD_OUT
  650. $IPT -A FORWARD -d 0.0.0.0/8 -j SPOOFED_FWD_IN
  651. $IPT -A FORWARD -m set --match-set IANA dst -j SPOOFED_FWD_OUT
  652. $IPT -A FORWARD -m set --match-set IANA src -j SPOOFED_FWD_IN
  653.  
  654. # Default in and out to Windows
  655. $IPT -A FORWARD -s windows_ip/32 -i eth1 -j DEFAULT_FWD_IN
  656. $IPT -A FORWARD -s windows_ip/32 -o eth0 -j DEFAULT_FWD_IN
  657. $IPT -A FORWARD -d windows_ip/32 -o eth1 -j DEFAULT_FWD_OUT
  658. $IPT -A FORWARD -d windows_ip/32 -i eth0 -j DEFAULT_FWD_OUT
  659.  
  660. # Chaos and Tarpit
  661. $IPT -A FORWARD -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j CHAOS_TARPIT_TCP_FWD
  662. $IPT -A FORWARD -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j CHAOS_TARPIT_TCP_FWD
  663. $IPT -A FORWARD -i eth0 -p tcp -m tcp --dport 1:1023 -j CHAOS_TARPIT_TCP_FWD
  664. $IPT -A FORWARD -i eth0 -p tcp -m tcp --dport 6000:6063 -j CHAOS_TARPIT_TCP_FWD
  665. $IPT -A FORWARD -i eth0 -p tcp -m tcp -m multiport --dports 5631,5060,5061,2967,8080,9943,9981,6667,1433,3306,2049,5432,1935,4321,1080 -j CHAOS_TARPIT_TCP_FWD
  666. $IPT -A FORWARD -i eth0 -p tcp -m tcp -m multiport --dports 3128,5000,5431,5900,5901,5800,5801,3389,3390,5222,5223,5269,5270 -j CHAOS_TARPIT_TCP_FWD
  667. $IPT -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j CHAOS_TARPIT_TCP_FWD
  668. $IPT -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j CHAOS_TARPIT_TCP_FWD
  669. $IPT -A FORWARD -p tcp -m tcp --dport 1:1023 -j CHAOS_TARPIT_TCP_FWD
  670. $IPT -A FORWARD -p tcp -m tcp --dport 6000:6063 -j CHAOS_TARPIT_TCP_FWD
  671. $IPT -A FORWARD -p tcp -m tcp -m multiport --dports 5631,5060,5061,2967,8080,9943,9981,6667,1433,3306,2049,5432,1935,4321,1080 -j CHAOS_TARPIT_TCP_FWD
  672. $IPT -A FORWARD -p tcp -m tcp -m multiport --dports 3128,5000,5431,5900,5901,5800,5801,3389,3390,5222,5223,5269,5270 -j CHAOS_TARPIT_TCP_FWD
  673. $IPT -A FORWARD -o eth1 -j CHAOS_TARPIT_TCP_FWD
  674. $IPT -A FORWARD -i eth0 -p udp -m udp --dport 33434:33524 -j CHAOS_DELUDE_UDP_FWD
  675. $IPT -A FORWARD -i eth0 -p udp -m udp --sport 1 --dport 1023 -j CHAOS_DELUDE_UDP_FWD
  676. $IPT -A FORWARD -i eth0 -p udp -m udp -m multiport --dports 4000,1194,5632,1645,1900,22555,4444,2049,1024 -j CHAOS_DELUDE_UDP_FWD
  677. $IPT -A FORWARD -p udp -m udp --dport 33434:33524 -j CHAOS_DELUDE_UDP_FWD
  678. $IPT -A FORWARD -p udp -m udp --sport 1 --dport 1023 -j CHAOS_DELUDE_UDP_FWD
  679. $IPT -A FORWARD -p udp -m udp -m multiport --dports 4000,1194,5632,1645,1900,22555,4444,2049,1024 -j CHAOS_DELUDE_UDP_FWD
  680. $IPT -A FORWARD -o eth1 -j CHAOS_DELUDE_UDP_FWD
  681.  
  682. $IPT -A FORWARD -j LOG
  683. $IPT -A FORWARD -j DROP_ALL_FWD
  684.  
  685.  
  686.  
  687.  
  688.  
  689.  
  690.  
  691.  
  692.  
  693.  
  694. echo "Input"
  695. # Established, Related
  696. $IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ESTABLISHED_IN
  697.  
  698. # DISABLE TCP TIMESTAMPS to get rid of unreachables, may significantly hurt performance of programs that rely on it
  699. $IPT -A INPUT -p icmp --icmp-type timestamp-request -j DROP
  700.  
  701.  
  702. # Bad / Invalid Flags
  703. $IPT -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j BAD_FLAGS_IN
  704. $IPT -A INPUT -m state --state INVALID -j DROP_INVALID
  705.  
  706. # Blacklist
  707. $IPT -A INPUT -m set --match-set blacklist src -j BLACKLISTED_IN
  708.  
  709. # Broadcast / DHCP
  710. $IPT -A INPUT -s 0.0.0.0/32 -d 255.255.255.255/32 -i eth0 -p udp -m udp --sport 67 --dport 68 -j BROADCAST_IN
  711. $IPT -A INPUT -d 255.255.255.255/32 -i eth0 -p udp -m udp --sport 67 --dport 68 -j DHCP_TO_BROADCAST
  712. $IPT -A INPUT -d public_ip/32 -i eth0 -p udp -m udp --sport 67 --dport 68 -j DHCP_TO_IP
  713.  
  714. # Internal spoofs
  715. $IPT -A INPUT -s public_ip/32 -d public_ip/32 -i eth0 -j SPOOFED_IP_IN_1
  716. $IPT -A INPUT -s public_ip/32 -d public_ip/32 -i eth1 -j SPOOFED_IP_IN_2
  717. $IPT -A INPUT -s linux_ip/32 -d linux_ip/32 -i eth1 -j SPOOFED_LINUX_IN_1
  718. $IPT -A INPUT -s linux_ip/32 -d linux_ip/32 -i eth0 -j SPOOFED_LINUX_IN_2
  719. $IPT -A INPUT -s windows_ip/32 -d windows_ip/32 -i eth1 -j SPOOFED_WIN_IN_1
  720. $IPT -A INPUT -s windows_ip/32 -d windows_ip/32 -i eth0 -j SPOOFED_WIN_IN_2
  721.  
  722. # Block public access to loopback
  723. $IPT -A INPUT -s public_ip/32 -d 127.0.0.1/32 -j PUBLIC_TO_LOOPBACK
  724. $IPT -A INPUT -s 127.0.0.1/32 -d public_ip/32 -j LOOPBACK_TO_PUBLIC
  725.  
  726. # Synergy access
  727. $IPT -A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -p tcp -m tcp --dport real_ssh_port2 -j SYNERGY_IN
  728. $IPT -A INPUT -p tcp -m tcp --dport real_ssh_port2 -j ACCESS_TO_SYNERGY
  729.  
  730. # Router access
  731. $IPT -A INPUT -s router_ip/32 -i eth0 -m state --state NEW -j WIN_TO_ROUTER_IN
  732.  
  733. # Access to loopback
  734. $IPT -A INPUT -s 127.0.0.0/31 -d 127.0.0.0/31 -i lo -j LOCALHOST_TRAFFIC
  735.  
  736. # IANA Spoofs
  737. $IPT -A INPUT -s 0.0.0.0/8 -j SPOOFED_IN_1
  738. $IPT -A INPUT -d 0.0.0.0/8 -j SPOOFED_IN_2
  739. $IPT -A FORWARD -m set --match-set IANA src -j SPOOFED_IN_1
  740. $IPT -A FORWARD -m set --match-set IANA dst -j SPOOFED_IN_2
  741.  
  742. # SSH access
  743. $IPT -A INPUT -s windows_ip/32 -d linux_ip/32 -i eth1 -p tcp -m tcp --dport real_ssh_port1 -j WIN_TO_LINUX_SSH_IN
  744.  
  745. # Default In
  746. $IPT -A INPUT -d public_ip/32 -i eth0 -j DEFAULT_IN
  747.  
  748. # Chaos and Tarpit
  749. $IPT -A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j CHAOS_TARPIT_TCP_IN
  750. $IPT -A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j CHAOS_TARPIT_TCP_IN
  751. $IPT -A INPUT -i eth0 -p tcp -m tcp --dport 1:1023 -j CHAOS_TARPIT_TCP_IN
  752. $IPT -A INPUT -i eth0 -p tcp -m tcp --dport 6000:6063 -j CHAOS_TARPIT_TCP_IN
  753. $IPT -A INPUT -i eth0 -p tcp -m tcp -m multiport --dports 5631,5060,5061,2967,8080,9943,9981,6667,1433,3306,2049,5432,1935,4321,1080 -j CHAOS_TARPIT_TCP_IN
  754. $IPT -A INPUT -i eth0 -p tcp -m tcp -m multiport --dports 3128,5000,5431,5900,5901,5800,5801,3389,3390,5222,5223,5269,5270 -j CHAOS_TARPIT_TCP_IN
  755. $IPT -A INPUT -i eth0 -p udp -m udp --dport 33434:33524 -j CHAOS_DELUDE_UDP_IN
  756. $IPT -A INPUT -i eth0 -p udp -m udp --sport 1 --dport 1023 -j CHAOS_DELUDE_UDP_IN
  757. $IPT -A INPUT -i eth0 -p udp -m udp -m multiport --dports 4000,1194,5632,1645,1900,22555,4444,2049,1024 -j CHAOS_DELUDE_UDP_IN
  758.  
  759. #echo "Allowing input from eth1, might be needed for internal communications, i.e ssh"
  760. $IPT -A INPUT -d linux_ip -i eth1 -j ACCEPT
  761.  
  762. $IPT -A INPUT -j LOG
  763. $IPT -A INPUT -j DROP_ALL_IN
  764.  
  765.  
  766.  
  767.  
  768.  
  769.  
  770.  
  771.  
  772.  
  773. echo "Output"
  774.  
  775. $IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ESTABLISHED_OUT
  776.  
  777. # DISABLE TCP TIMESTAMPS to get rid of unreachables, may significantly hurt performance of programs that rely on it
  778. iptables -A OUTPUT -p icmp --icmp-type timestamp-reply -j DROP
  779.  
  780. # Invalid / Bad
  781. $IPT -A OUTPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j BAD_FLAGS_OUT
  782. $IPT -A OUTPUT -m state --state INVALID -j DROP_INVALID
  783.  
  784. # Blacklist
  785. $IPT -A OUTPUT -m set --match-set blacklist dst -j BLACKLISTED_OUT
  786.  
  787. # Broadcast / DHCP
  788. $IPT -A OUTPUT -s 0.0.0.0/32 -d 255.255.255.255/32 -o eth0 -p udp -m udp --sport 68 --dport 67 -j BROADCAST_OUT
  789. $IPT -A OUTPUT -s 0.0.0.0/32 -o eth0 -p udp -m udp --sport 68 --dport 67 -j BROADCAST_TO_DHCP
  790. $IPT -A OUTPUT -s public_ip/32 -o eth0 -p udp -m udp --sport 68 --dport 67 -j IP_TO_DHCP_OUT
  791.  
  792. # Internal Spoofs
  793. $IPT -A OUTPUT -s public_ip/32 -d public_ip/32 -o eth0 -j SPOOFED_IP_OUT_1
  794. $IPT -A OUTPUT -s public_ip/32 -d public_ip/32 -o eth1 -j SPOOFED_IP_OUT_2
  795. $IPT -A OUTPUT -s linux_ip/32 -d linux_ip/32 -o eth1 -j SPOOFED_LINUX_OUT_1
  796. $IPT -A OUTPUT -s linux_ip/32 -d linux_ip/32 -o eth0 -j SPOOFED_LINUX_OUT_2
  797. $IPT -A OUTPUT -s windows_ip/32 -d windows_ip/32 -o eth1 -j SPOOFED_WIN_OUT_1
  798. $IPT -A OUTPUT -s windows_ip/32 -d windows_ip/32 -o eth0 -j SPOOFED_WIN_OUT_2
  799.  
  800. #Block access to loopback from the public
  801. $IPT -A OUTPUT -s public_ip/32 -d 127.0.0.1/32 -j PUBLIC_TO_LOOPBACK
  802. $IPT -A OUTPUT -s 127.0.0.1/32 -d public_ip/32 -j LOOPBACK_TO_PUBLIC
  803.  
  804. # Synergy access
  805. $IPT -A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -o lo -p tcp -m tcp --dport real_ssh_port2 -j SYNERGY_OUT
  806. $IPT -A OUTPUT -p tcp -m tcp --dport real_ssh_port2 -j ACCESS_TO_SYNERGY
  807.  
  808. # Access to router
  809. $IPT -A OUTPUT -d router_ip/32 -o eth0 -j WIN_TO_ROUTER_OUT
  810.  
  811. # Loopback access
  812. $IPT -A OUTPUT -s 127.0.0.0/31 -d 127.0.0.0/31 -o lo -j LOCALHOST_TRAFFIC
  813.  
  814. # IANA Spoofs
  815. $IPT -A OUTPUT -s 0.0.0.0/8 -j SPOOFED_OUT_1
  816. $IPT -A OUTPUT -d 0.0.0.0/8 -j SPOOFED_OUT_2
  817. $IPT -A FORWARD -m set --match-set IANA src -j SPOOFED_OUT_1
  818. $IPT -A FORWARD -m set --match-set IANA dst -j SPOOFED_OUT_2
  819.  
  820. # Miscellaneous out
  821. $IPT -A OUTPUT -s public_ip/32 -d slackbuild_ip/32 -o eth0 -p tcp -m tcp --dport 873 -j SLACKBUILD_RSYNC_OUT
  822. $IPT -A OUTPUT -s public_ip/32 -d github_ip/22 -o eth0 -p tcp -m tcp --dport 9418 -j GITHUB_OUT
  823.  
  824. # DNS out
  825. $IPT -A OUTPUT -s public_ip/32 -o eth0 -p tcp -m tcp --dport 53 -j DNS_OUT
  826. $IPT -A OUTPUT -s public_ip/32 -o eth0 -p udp -m udp --dport 53 -j DNS_OUT
  827.  
  828. # DEFAULT out
  829. $IPT -A OUTPUT -s public_ip/32 -o eth0 -j DEFAULT_OUT
  830.  
  831. #echo "Allowing output to eth1, this might be needed for internal communications, i.e. ssh"
  832. $IPT -A OUTPUT -s linux_ip/32 -o eth1 -j ACCEPT
  833.  
  834. $IPT -A OUTPUT -j LOG
  835. $IPT -A OUTPUT -j DROP_ALL_OUT
  836.  
  837.  
  838.  
  839.  
  840.  
  841.  
  842.  
  843.  
  844.  
  845.  
  846. echo "Finalizing Chains"
  847.  
  848. echo "Setting up Established, Related"
  849. $IPT -A ESTABLISHED_FWD -j ACCEPT
  850. $IPT -A ESTABLISHED_IN -j ACCEPT
  851. $IPT -A ESTABLISHED_OUT -j ACCEPT
  852.  
  853. echo "Setting up Synergy"
  854. $IPT -A SYNERGY_IN -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -p tcp -m tcp --dport real_ssh_port2 -j ACCEPT
  855. $IPT -A SYNERGY_OUT -s 127.0.0.1/32 -d 127.0.0.1/32 -o lo -p tcp -m tcp --dport real_ssh_port2 -j ACCEPT
  856. $IPT -A ACCESS_TO_SYNERGY -j LOG --log-prefix "ACCESS_TO_SYNERGY -- DENY " --log-level 6
  857. $IPT -A ACCESS_TO_SYNERGY -j DROP
  858.  
  859. echo "Setting up Bad and Invalid Flags"
  860. $IPT -A BAD_FLAGS_FWD -j LOG --log-prefix "BAD_FLAGS_FWD -- DENY " --log-level 6
  861. $IPT -A BAD_FLAGS_FWD -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
  862. $IPT -A BAD_FLAGS_IN -j LOG --log-prefix "BAD_FLAGS_IN -- DENY " --log-level 6
  863. $IPT -A BAD_FLAGS_IN -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
  864. $IPT -A BAD_FLAGS_OUT -j LOG --log-prefix "BAD_FLAGS_OUT -- DENY " --log-level 6
  865. $IPT -A BAD_FLAGS_OUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
  866. $IPT -A DROP_INVALID -j LOG --log-prefix "DROP_INVALID state -- DENY " --log-level 7
  867. $IPT -A DROP_INVALID -j DROP
  868.  
  869.  
  870. echo "Setting up Blacklist"
  871. $IPT -A BLACKLISTED_IN -j LOG --log-prefix "BLACKLISTED_IN -- DENY " --log-level 6
  872. $IPT -A BLACKLISTED_IN -j DROP
  873. $IPT -A BLACKLISTED_OUT -j LOG --log-prefix "BLACKLISTED_OUT -- DENY " --log-level 6
  874. $IPT -A BLACKLISTED_OUT -j DROP
  875. $IPT -A BLACKLISTED_FWD_OUT -j LOG --log-prefix "BLACKLISTED_FWD_OUT -- DENY " --log-level 6
  876. $IPT -A BLACKLISTED_FWD_OUT -j DROP
  877. $IPT -A BLACKLISTED_FWD_IN -j LOG --log-prefix "BLACKLISTED_FWD_IN -- DENY " --log-level 6
  878. $IPT -A BLACKLISTED_FWD_IN -j DROP
  879.  
  880. echo "Setting up Broadcast and DHCP"
  881. $IPT -A BROADCAST_IN -s 0.0.0.0/32 -d 255.255.255.255/32 -i eth0 -p udp -m udp --sport 67 --dport 68 -j ACCEPT
  882. $IPT -A BROADCAST_OUT -s 0.0.0.0/32 -d 255.255.255.255/32 -o eth0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
  883. $IPT -A BROADCAST_TO_DHCP -d isp_ip1/32 -j ACCEPT
  884. $IPT -A BROADCAST_TO_DHCP -d isp_ip2/32 -j ACCEPT
  885. $IPT -A DHCP_TO_BROADCAST -s isp_ip1/32 -j ACCEPT
  886. $IPT -A DHCP_TO_BROADCAST -s isp_ip2/32 -j ACCEPT
  887. $IPT -A DHCP_TO_IP -s isp_ip1/32 -j ACCEPT
  888. $IPT -A DHCP_TO_IP -s isp_ip2/32 -j ACCEPT
  889.  
  890. echo "Setting up DNS"
  891. $IPT -A DNS_OUT -d 4.4.4.4/32 -j ACCEPT
  892. $IPT -A DNS_OUT -d 8.8.8.8/32 -j ACCEPT
  893. $IPT -A DNS_OUT -d isp_dns1/32 -j ACCEPT
  894. $IPT -A DNS_OUT -d isp_dns2/32 -j ACCEPT
  895. $IPT -A DNS_OUT -d 208.67.220.220/32 -j ACCEPT
  896. $IPT -A DNS_OUT -d 208.67.222.222/32 -j ACCEPT
  897.  
  898.  
  899. echo "Setting up Chaos and Tarpit"
  900. $IPT -A CHAOS_DELUDE_UDP_FWD -j LOG --log-prefix "CHAOS_DELUDE_UDP_FWD - eth1 " --log-level 6
  901. $IPT -A CHAOS_DELUDE_UDP_FWD -j CHAOS --delude
  902. $IPT -A CHAOS_DELUDE_UDP_IN -j LOG --log-prefix "CHAOS_DELUDE_UDP_IN - eth0 " --log-level 6
  903. $IPT -A CHAOS_DELUDE_UDP_IN -j CHAOS --delude
  904. $IPT -A CHAOS_TARPIT_TCP_FWD -j LOG --log-prefix "CHAOS_TARPIT_TCP_FWD - eth1 " --log-level 6
  905. $IPT -A CHAOS_TARPIT_TCP_FWD -j CHAOS --tarpit
  906. $IPT -A CHAOS_TARPIT_TCP_IN -j LOG --log-prefix "CHAOS_TARPIT_TCP_IN - eth0 " --log-level 6
  907. $IPT -A CHAOS_TARPIT_TCP_IN -j CHAOS --tarpit
  908.  
  909. echo "Setting up Default in and out for Windows"
  910. $IPT -A DEFAULT_FWD_OUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
  911. $IPT -A DEFAULT_FWD_OUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
  912. $IPT -A DEFAULT_FWD_OUT -p icmp -m icmp --icmp-type 0/0 -j ACCEPT
  913. $IPT -A DEFAULT_FWD_OUT -p icmp -m icmp --icmp-type 11/0 -j ACCEPT
  914. $IPT -A DEFAULT_FWD_OUT -p icmp -m icmp --icmp-type 11/1 -j ACCEPT
  915. $IPT -A DEFAULT_FWD_OUT -p tcp -m tcp -m multiport --dports utorrent_port,p2pport2 -j ACCEPT
  916. $IPT -A DEFAULT_FWD_OUT -p udp -m udp -m multiport --dports utorrent_port,p2pport1,p2pport2 -j ACCEPT
  917. $IPT -A DEFAULT_FWD_IN -p icmp -m icmp --icmp-type 8/0 -j ACCEPT
  918. $IPT -A DEFAULT_FWD_IN -p tcp -m tcp --sport utorrent_port -j ACCEPT
  919. $IPT -A DEFAULT_FWD_IN -p tcp -m tcp -m multiport --dports 21,80,8080,443,143,993,110,995,25,465 -j ACCEPT
  920. $IPT -A DEFAULT_FWD_IN -p udp -m udp --sport utorrent_port -j ACCEPT
  921. $IPT -A DEFAULT_FWD_IN -p udp -m udp --sport p2pport1 -j ACCEPT
  922. $IPT -A DEFAULT_FWD_IN -p udp -m udp --dport 123 -j ACCEPT
  923. $IPT -A DEFAULT_FWD_IN -m state --state RELATED,ESTABLISHED -j ACCEPT
  924.  
  925. echo "Setting up Default in and out for Linux"
  926. $IPT -A DEFAULT_IN -p icmp -m icmp --icmp-type 12 -j ACCEPT
  927. $IPT -A DEFAULT_IN -p icmp -m icmp --icmp-type 3 -j ACCEPT
  928. $IPT -A DEFAULT_IN -p icmp -m icmp --icmp-type 0/0 -j ACCEPT
  929. $IPT -A DEFAULT_IN -p icmp -m icmp --icmp-type 11/0 -j ACCEPT
  930. $IPT -A DEFAULT_IN -p icmp -m icmp --icmp-type 11/1 -j ACCEPT
  931. $IPT -A DEFAULT_OUT -p icmp -m icmp --icmp-type 8/0 -j ACCEPT
  932. $IPT -A DEFAULT_OUT -p tcp -m tcp -m multiport --dports 21,80,443,143,993,110,995,25,465 -j ACCEPT
  933. $IPT -A DEFAULT_OUT -p udp -m udp --dport 123 -j ACCEPT
  934. $IPT -A DEFAULT_OUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  935.  
  936. echo "Allowing access to router"
  937. $IPT -A WIN_TO_ROUTER_FWD_OUT -d router_gw_ip/32 -j ACCEPT
  938. $IPT -A WIN_TO_ROUTER_FWD_OUT -d router_gw_ip00/32 -j ACCEPT
  939. $IPT -A WIN_TO_ROUTER_FWD_IN -s router_gw_ip/32 -j ACCEPT
  940. $IPT -A WIN_TO_ROUTER_FWD_IN -s router_gw_ip00/32 -j ACCEPT
  941. $IPT -A WIN_TO_ROUTER_IN -d router_gw_ip/32 -j ACCEPT
  942. $IPT -A WIN_TO_ROUTER_IN -d linux_ip/32 -j ACCEPT
  943. $IPT -A WIN_TO_ROUTER_IN -d windows_ip/32 -j ACCEPT
  944. $IPT -A WIN_TO_ROUTER_OUT -s router_gw_ip/32 -j ACCEPT
  945. $IPT -A WIN_TO_ROUTER_OUT -s linux_ip/32 -j ACCEPT
  946. $IPT -A WIN_TO_ROUTER_OUT -s windows_ip/32 -j ACCEPT
  947.  
  948. echo "Logging and Dropping everything"
  949. $IPT -A DROP_ALL_FWD -j LOG --log-prefix "DROP_ALL_FWD -- DENY " --log-level 6
  950. $IPT -A DROP_ALL_FWD -j DROP
  951. $IPT -A DROP_ALL_IN -j LOG --log-prefix "DROP_ALL_IN -- DENY " --log-level 6
  952. $IPT -A DROP_ALL_IN -j DROP
  953. $IPT -A DROP_ALL_OUT -j LOG --log-prefix "DROP_ALL_OUT -- DENY " --log-level 6
  954. $IPT -A DROP_ALL_OUT -j DROP
  955.  
  956. # SSH access
  957. $IPT -A WIN_TO_LINUX_SSH_IN -j LOG --log-prefix "WINDOWS_TO_LINUX_SSH_IN -- AC" --log-level 6
  958. $IPT -A WIN_TO_LINUX_SSH_IN -j ACCEPT
  959.  
  960.  
  961. $IPT -A GITHUB_OUT -s public_ip/32 -d github_ip/22 -o eth0 -p tcp -m tcp --dport 9418 -j ACCEPT
  962. $IPT -A SLACKBUILD_RSYNC_OUT -s public_ip/32 -d slackbuild_ip/32 -o eth0 -p tcp -m tcp --dport 873 -j ACCEPT
  963.  
  964. # Broadcast / DHCP
  965. $IPT -A IP_TO_DHCP_OUT -d isp_ip1/32 -j ACCEPT
  966. $IPT -A IP_TO_DHCP_OUT -d isp_ip2/32 -j ACCEPT
  967.  
  968. # Loopback
  969. $IPT -A LOCALHOST_TRAFFIC -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -j ACCEPT
  970. $IPT -A LOCALHOST_TRAFFIC -s 127.0.0.1/32 -d 127.0.0.1/32 -o lo -j ACCEPT
  971.  
  972. # Block access to loopback from public
  973. $IPT -A LOOPBACK_TO_PUBLIC -j LOG --log-prefix "LOOPBACK_TO_PUBLIC -- DENY " --log-level 6
  974. $IPT -A LOOPBACK_TO_PUBLIC -j DROP
  975. $IPT -A PUBLIC_TO_LOOPBACK -j LOG --log-prefix "PUBLIC_TO_LOOPBACK -- DENY " --log-level 6
  976. $IPT -A PUBLIC_TO_LOOPBACK -j DROP
  977.  
  978. #$IPT -A PROBLEMATIC_FORWARD_RULES -d windows_ip/32 -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
  979. #$IPT -A PROBLEMATIC_FORWARD_RULES -s windows_ip/32 -i eth1 -o eth0 -j ACCEPT
  980. #$IPT -A PROBLEMATIC_FORWARD_RULES -o eth0 -m state --state NEW -j ACCEPT
  981.  
  982.  
  983. # IANA Spoofs
  984. $IPT -A SPOOFED_FWD_OUT -j LOG --log-prefix "SPOOFED_FWD_OUT -- DENY " --log-level 6
  985. $IPT -A SPOOFED_FWD_OUT -j DROP
  986. $IPT -A SPOOFED_FWD_IN -j LOG --log-prefix "SPOOFED_FWD_IN -- DENY " --log-level 6
  987. $IPT -A SPOOFED_FWD_IN -j DROP
  988. $IPT -A SPOOFED_IN_1 -j LOG --log-prefix "SPOOFED_IN_1 -- DENY " --log-level 6
  989. $IPT -A SPOOFED_IN_1 -j DROP
  990. $IPT -A SPOOFED_IN_2 -j LOG --log-prefix "SPOOFED_IN_2 -- DENY " --log-level 6
  991. $IPT -A SPOOFED_IN_2 -j DROP
  992. $IPT -A SPOOFED_OUT_1 -j LOG --log-prefix "SPOOFED_OUT_1 -- DENY " --log-level 6
  993. $IPT -A SPOOFED_OUT_1 -j DROP
  994. $IPT -A SPOOFED_OUT_2 -j LOG --log-prefix "SPOOFED_OUT_2 -- DENY " --log-level 6
  995. $IPT -A SPOOFED_OUT_2 -j DROP
  996.  
  997.  
  998. # Internal Spoofs
  999.  
  1000. # Spoofed Ip
  1001. $IPT -A SPOOFED_IP_FWD_1 -j LOG --log-prefix "SPOOFED_HOME_IP_FWD_1 -- DENY" --log-level 6
  1002. $IPT -A SPOOFED_IP_FWD_1 -j DROP
  1003. $IPT -A SPOOFED_IP_FWD_2 -j LOG --log-prefix "SPOOFED_HOME_IP_FWD_2 -- DENY" --log-level 6
  1004. $IPT -A SPOOFED_IP_FWD_2 -j DROP
  1005. $IPT -A SPOOFED_IP_IN_1 -j LOG --log-prefix "SPOOFED_HOME_IP_IN_1 -- DENY " --log-level 6
  1006. $IPT -A SPOOFED_IP_IN_1 -j DROP
  1007. $IPT -A SPOOFED_IP_IN_2 -j LOG --log-prefix "SPOOFED_HOME_IP_IN_2 -- DENY " --log-level 6
  1008. $IPT -A SPOOFED_IP_IN_2 -j DROP
  1009. $IPT -A SPOOFED_IP_OUT_1 -j LOG --log-prefix "SPOOFED_HOME_IP_OUT_1 -- DENY" --log-level 6
  1010. $IPT -A SPOOFED_IP_OUT_1 -j DROP
  1011. $IPT -A SPOOFED_IP_OUT_2 -j LOG --log-prefix "SPOOFED_HOME_IP_OUT_2 -- DENY" --log-level 6
  1012. $IPT -A SPOOFED_IP_OUT_2 -j DROP
  1013.  
  1014. # Spoofed Linux Internal Ip
  1015. $IPT -A SPOOFED_LINUX_FWD_1 -j LOG --log-prefix "SPOOFED_LINUX_FWD_1 -- DENY " --log-level 6
  1016. $IPT -A SPOOFED_LINUX_FWD_1 -j DROP
  1017. $IPT -A SPOOFED_LINUX_FWD_2 -j LOG --log-prefix "SPOOFED_IN_LINUX_FWD_2 -- DEN" --log-level 6
  1018. $IPT -A SPOOFED_LINUX_FWD_2 -j DROP
  1019. $IPT -A SPOOFED_LINUX_IN_1 -j LOG --log-prefix "SPOOFED_LINUX_IN_1 -- DENY " --log-level 6
  1020. $IPT -A SPOOFED_LINUX_IN_1 -j DROP
  1021. $IPT -A SPOOFED_LINUX_IN_2 -j LOG --log-prefix "SPOOFED_LINUX_IN_2 -- DENY " --log-level 6
  1022. $IPT -A SPOOFED_LINUX_IN_2 -j DROP
  1023. $IPT -A SPOOFED_LINUX_OUT_1 -j LOG --log-prefix "SPOOFED_LINUX_OUT_1 -- DENY " --log-level 6
  1024. $IPT -A SPOOFED_LINUX_OUT_1 -j DROP
  1025. $IPT -A SPOOFED_LINUX_OUT_2 -j LOG --log-prefix "SPOOFED_LINUX_OUT_2 -- DENY " --log-level 6
  1026. $IPT -A SPOOFED_LINUX_OUT_2 -j DROP
  1027.  
  1028. # Spoofed Windows Internal Ip
  1029. $IPT -A SPOOFED_WINDOWS_FWD_1 -j LOG --log-prefix "SPOOFED_WINDOWS_FWD_1 -- DENY" --log-level 6
  1030. $IPT -A SPOOFED_WINDOWS_FWD_1 -j DROP
  1031. $IPT -A SPOOFED_WINDOWS_FWD_2 -j LOG --log-prefix "SPOOFED_WINDOWS_FWD_2 -- DENY" --log-level 6
  1032. $IPT -A SPOOFED_WINDOWS_FWD_2 -j DROP
  1033. $IPT -A SPOOFED_WIN_IN_1 -j LOG --log-prefix "SPOOFED_WINDOWS_IN_1 -- DENY " --log-level 6
  1034. $IPT -A SPOOFED_WIN_IN_1 -j DROP
  1035. $IPT -A SPOOFED_WIN_IN_2 -j LOG --log-prefix "SPOOFED_WINDOWS_IN_2 -- DENY " --log-level 6
  1036. $IPT -A SPOOFED_WIN_IN_2 -j DROP
  1037. $IPT -A SPOOFED_WIN_OUT_1 -j LOG --log-prefix "SPOOFED_WINDOWS_OUT_1 -- DENY" --log-level 6
  1038. $IPT -A SPOOFED_WIN_OUT_1 -j DROP
  1039. $IPT -A SPOOFED_WIN_OUT_2 -j LOG --log-prefix "SPOOFED_WINDOWS_OUT_2 -- DENY" --log-level 6
  1040. $IPT -A SPOOFED_WIN_OUT_2 -j DROP
  1041.  
  1042. # For psad
  1043. #/usr/sbin/iptables  -A INPUT   -j LOG
  1044. #/usr/sbin/iptables  -A FORWARD -j LOG
  1045. #/usr/sbin/iptables  -A OUTPUT  -j LOG
  1046. #/usr/sbin/ipt6ables -A INPUT   -j LOG
  1047. #/usr/sbin/ip6tables -A FORWARD -j LOG
  1048. #/usr/sbin/ip6tables -A OUTPUT  -j LOG
  1049.  
  1050. echo -e "\nrc.firewall.sh v$FWVER done.\n"
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!