Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/bin/bash
- #
- EXT="ewangunn.com"
- INT="zeus"
- LOCAL_ALIASES="ewangunn.com zeus localhost"
- TCP_SERVICES="http https ssh domain 236 237 smtp 7777 3979 3128 10000 4242 16697 mysql 1022 2727 3389"
- UDP_SERVICES="openvpn 1195 3979"
- ALL="0/0"
- OPENVPN_DEVICES="tun0 tap0"
- OPENVPN_NETWORKS="10.1.0.0/24 10.1.1.0/24"
- iptables -F INPUT
- iptables -F OUTPUT
- iptables -F FORWARD
- iptables -t nat -F PREROUTING
- iptables -t nat -F POSTROUTING
- iptables -P INPUT DROP
- iptables -P OUTPUT ACCEPT
- iptables -P FORWARD DROP
- # Allow localhost callbacks
- #for alias1 in $LOCAL_ALIASES
- #do
- # for alias2 in $LOCAL_ALIASES
- # do
- # iptables -A INPUT -s $alias1 -d $alias2 -j ACCEPT
- # done
- #done
- # Established connections remain
- iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
- iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
- # Proxy intercept (Squid: 3128; Privoxy: 8080)
- for device in $OPENVPN_DEVICES
- do
- iptables -t nat -A PREROUTING -i $device -p tcp --dport http -j REDIRECT --to-port 3128
- done
- # OpenVPN IPv4 Forwarding
- echo 1 > /proc/sys/net/ipv4/ip_forward
- for network in $OPENVPN_NETWORKS
- do
- iptables -t nat -A POSTROUTING -s $network -o eth0 -j MASQUERADE
- done
- # Allow internal VPN requests
- for device in $OPENVPN_DEVICES
- do
- iptables -A INPUT -i $device -j ACCEPT
- iptables -A FORWARD -i $device -j ACCEPT
- done
- # Easy incoming server connections
- for tcp_service in $TCP_SERVICES
- do
- iptables -A INPUT -p tcp -d $EXT --dport $tcp_service -s $ALL -m state --state NEW -j ACCEPT
- done
- for udp_service in $UDP_SERVICES
- do
- iptables -A INPUT -p udp -d $EXT --dport $udp_service -s $ALL -m state --state NEW -j ACCEPT
- done
- # Output rules
- #for tcp_service in $TCP_SERV
- #do
- #iptables -A OUTPUT -o eth0 -p tcp -d $ALL --dport $FREE_PORTS -s $EXT --sport $tcp_service -m state --state ESTABLISHED -j ACCEPT
- #done
- #for udp_service in $UDP_SERV
- #do
- #iptables -A OUTPUT -o eth0 -p udp -d $ALL --dport $FREE_PORTS -s $EXT --sport $udp_service -m state --state ESTABLISHED -j ACCEPT
- #done
- #iptables -A OUTPUT -o eth0 -d $VPN_NET -s $INT -j ACCEPT
- #iptables -A OUTPUT -p udp -s $INT --sport 53 -d $VPN_NET --dport 53 -m state --state ESTABLISHED -j ACCEPT
- # List rules
- iptables -L
- iptables -L -t nat
Add Comment
Please, Sign In to add comment