Untitled

#! /bin/bash
###############################################################################
# Autor: Tácio de Jesus Andrade
# Criação: 11/04/2011 por - Tacio de Jesus Andrade
# Modificação: 27/04/2018 por - José Carlos Jeske
#
# Função: Arquivo de Configuração Padrão do Firewall IpTables
# Utilização: Mova-o para o diretório /etc/init.d/ (em distros Debian-Like)
#             e adicione o serviço para iniciar com o Sistema (pode-se utilizar
#             o rcconf ou o comando de carregamento do serviço de sua distro)
#
# Material disponibilizado no link :
# https://www.vivaolinux.com.br/etc/Firewall.sh-3/
# https://www.vivaolinux.com.br/topico/Squid-Iptables/Liberar-Maquina-do-proxy-e-firewall
# https://www.vivaolinux.com.br/topico/Squid-Iptables/Liberar-Porta-VOIP
# https://sempreupdate.com.br/como-funciona-os-logs-no-linux/
# https://www.vivaolinux.com.br/topico/Servidores-Linux-para-iniciantes/Identificacao-de-ataque-ao-servidor
# https://www.security.unicamp.br/blog/log-o-aliado-do-administrador/
# http://memoria.rnp.br/newsgen/9905/logs.html
# https://forum.gamemods.com.br/threads/detectando-invasao-pelo-log-do-apache.33810/
# http://bvserver.com/como-posso-viewificair-se-a-porta-5060-est-aberta-em-centos.html
#
###############################################################################
# Você deve colocar em um local conveniente no seu sistema, por exemplo:
# - Dentro do diretório /etc/init.d/
# - Dar permissão de execução chmod +x firewall.sh
# - Colocar para rodar na inicialização do sistema. coloca assim dentro do arquivo /etc/rc.local: bash /etc/init.d/firewall.sh
# - Para Rodar ele digite   bash /etc/init.d/firewall.sh
#
# ou
# Gerando boot do firewall na inicialização
# digita isso aqui no prompt: echo "/etc/init.d/firewall.sh" >> /etc/rc.d/rc.local
#
###############################################################################


function IniciaFirewall(){


    ###############
    # TITULO ABRE #
    ###############
    echo "Iniciando a Configuração do Firewall"

    echo "Carregando Módulos..."
    # carrega modulos
    /sbin/modprobe iptable_nat
    /sbin/modprobe ip_conntrack
    /sbin/modprobe ip_conntrack_ftp
    /sbin/modprobe ip_nat_ftp
    /sbin/modprobe ipt_LOG
    /sbin/modprobe ipt_REJECT
    /sbin/modprobe ipt_MASQUERADE


    ########################################
    # Habilita o Roteamento do Kernel Zera #
    ########################################
    echo "Habilitando Roteamento do Kernel"
      echo 1 >/proc/sys/net/ipv4/ip_forward


    #########################################
    # Habilita a Proteção contra spoofing 2 #
    #########################################
    echo "Habilitando Proteção contra spoofing 2"
      echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
      echo 1 > /proc/sys/net/ipv4/tcp_syncookies
      echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
      echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses


    ########################
    # Zera todas as Regras #
    ########################
    echo "Regras Zeradas"
      iptables -F
      iptables -t mangle -F
      iptables -t nat -F
      iptables -X


    ################################################
    # Definindo a Politica Padrao - fechando tudo  #
    ################################################
    echo "Fechando tudo"
      iptables -P INPUT DROP
      iptables -P FORWARD DROP
      # Aceitando todas as saidas
      iptables -P OUTPUT ACCEPT


    ############################################################################
    # Impede ataques DoS a maquina limitando a quantidade de respostas do ping #
    ############################################################################
    #echo "Previne ataques DoS"
    #  iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

    #################################
    # Bloqieia completamente o ping #
    #################################
    echo "Bloqueia o pings"
      iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

    ##########################
    # Politicas de segurança #
    ##########################
    echo "Implementação de politicas de segurança"
      echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route   # Impede falsear pacote
      echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects      # Perigo de descobrimento de rotas de roteamento (desativar em roteador)
      echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts    # Risco de DoS
      echo 1 > /proc/sys/net/ipv4/tcp_syncookies                 # Só inicia a conexão quando recebe a confirmação, diminuindo a banda gasta
      echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter         # Faz o firewall responder apenas a placa de rede que recebeu o pacote
      iptables -A INPUT -m state --state INVALID -j DROP         # Elimina os pacotes invalidos


    #################################
    # Libera conexoes estabelecidas #
    #################################
    echo "Liberando conexões estabelecidas"
      iptables -A INPUT   -m state --state RELATED,ESTABLISHED -j ACCEPT
      iptables -A FORWARD -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT
      iptables -A OUTPUT  -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT


    #################################
    # Libera interface loopback     #
    #################################
    echo "Liberando interface loopback "
      iptables -A INPUT -i lo -j ACCEPT


    #################################
    # Registro de Logs              #
    #################################
    echo "Registrando Logs "
      iptables -A FORWARD -m multiport -p tcp --dport 5800,5900,6000 -j LOG --log-prefix="[ACESSO VNC]"
      iptables -A INPUT -p tcp --dport 22    --syn -j LOG --log-prefix="[TENTATIVA ACESSO SSH]"
      iptables -A INPUT -p tcp --dport 2222  --syn -j LOG --log-prefix="[TENTATIVA ACESSO SSH]"
      iptables -A INPUT -p tcp --dport 21    --syn -j LOG --log-prefix="[TENTATIVA ACESSO FTP]"
      iptables -A INPUT -p tcp --dport 10000 --syn -j LOG --log-prefix="[TENTATIVA ACESSO WEBMIN]"


    #######################################################################################
    #                           GERANDO REGRAS DE SEGURANÇA                               #
    #######################################################################################

    echo "Protegendo contra Port Scanners "
      iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 5/s -j ACCEPT

    # proteção contra traceroute
    echo "Proteção contra traceroute"
      iptables -A INPUT -p udp -s 0/0 -i eth0 --dport 33435:33525 -j REJECT

    # Protecoes contra pacotes invalidos
    echo "Proteção contra pacotes invalidos "
      iptables -A INPUT -m state --state INVALID -j REJECT


    ###############################################################################
    #                      REGRAS PARA INPUT -  ENTRADA                           #
    ###############################################################################


    # libera ping para rede do piso 1
    # iptables -A INPUT -s 192.168.1.0/24 -p icmp --icmp-type 8 -j ACCEPT


    ###############################################################################
    #                      Liberação do TRONCO                                    #
    ###############################################################################
    echo "Liberando entrada e saida do Tronco
      iptables -I INPUT -s 200.184.77.169 -j ACCEPT
      iptables -I OUTPUT -d 200.184.77.169 -j ACCEPT

    #######################################################################################
    # Libera o acesso via SSH e Limita o número de tentativas de acesso a 4 a cada minuto #
    # Nas placas de rede  eth0 e eth1                                                     #
    #######################################################################################
    echo "Liberando o SSH"
      iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
      iptables -I INPUT -p tcp --dport 22 -i eth1 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
      iptables -A INPUT -p tcp --dport 22 -j ACCEPT
      iptables -A INPUT -p udp --dport 22 -j ACCEPT


    #######################################################################################
    # Regras para o HTTP E WEB e WEBADMIN
    #######################################################################################
    echo "Liberando as portas para acesso HTTP e WEB "
      # Aqui consegui liberar para navegação no browse  no servidor 192.168.1.111
      iptables -A INPUT   -p tcp        --dport 443 -j ACCEPT
      iptables -A INPUT   -p tcp        --dport  80 -j ACCEPT
      iptables -A INPUT   -p tcp        --dport 10000 -j ACCEPT

    ##################################################################################################
    # Regras para o Acesso do Asterisk / Issabel = portas SIP (5060:5062 E 10000:20000 )( 4569 AIX ) #
    ##################################################################################################
    echo "Liberando as portas para o Asterisk "
       iptables -A INPUT   -d 192.168.1.0/24 -p tcp --dport 5060:5062    -j ACCEPT
       iptables -A INPUT   -d 192.168.1.0/24 -p udp --dport 5060:5062    -j ACCEPT
       iptables -A INPUT   -d 192.168.1.0/24 -p tcp --dport 10000:20000  -j ACCEPT
       iptables -A INPUT   -d 192.168.1.0/24 -p udp --dport 10000:20000  -j ACCEPT


    #######################################################################################
    # Priorizando paoctes da Rede                                                         #
    #######################################################################################
    echo "Priorizando pacotes da Rede"
      iptables -t mangle -A PREROUTING     -p tcp --dport 5060:5062   -j TOS --set-tos 16
      iptables -t mangle -A PREROUTING     -p udp --dport 1000:20000  -j TOS --set-tos 8
      iptables -t mangle -A PREROUTING     -p tcp --dport 80          -j TOS --set-tos 8
      iptables -t mangle -A PREROUTING     -p udp --dport 80          -j TOS --set-tos 8
      iptables -t mangle -A OUTPUT -o eth0 -p tcp --dport 5060:5062   -j TOS --set-tos 16
      iptables -t mangle -A OUTPUT -o eth0 -p udp --dport 10000:20000 -j TOS --set-tos 8
      iptables -t mangle -A OUTPUT -o eth0 -p tcp --dport 80          -j TOS --set-tos 8
      iptables -t mangle -A OUTPUT -o eth0 -p udp --dport 80          -j TOS --set-tos 8


    ##################
    # Libera o Samba #
    ##################
    #echo "Liberando o Samba"
    #  iptables -A INPUT -p tcp --dport 137:139 -j ACCEPT
    #  iptables -A INPUT -p udp --dport 137:139 -j ACCEPT

    ###################
    # Libera o Apache #
    ###################
    #echo "Liberando o Apache"
    #  iptables -A INPUT -p tcp --dport 80 -j ACCEPT

    ################
    # TITULO FECHA #
    ################
    echo "Configuração do Firewall Concluida."
}


function LiberaFirewall(){
     echo "Finalizando o Firewall"
     rm -rf /var/lock/subsys/firewall

     # -----------------------------------------------------------------
     # Remove todas as regras existentes
     # -----------------------------------------------------------------
       iptables -F
       iptables -X
       iptables -t mangle -F
     # -----------------------------------------------------------------
     # Reseta as politicas padrões, aceitar tudo
     # -----------------------------------------------------------------
       iptables -P INPUT   ACCEPT
       iptables -P OUTPUT  ACCEPT
       iptables -P FORWARD ACCEPT

}

case $1 in
    start)
        IniciaFirewall
        exit 0
    ;;
    stop)
        LiberaFirewall
        exit 1
    ;;
    restart)
        LiberaFirewall;IniciaFirewall
        exit 2
    ;;
    *)
        echo
        echo "Use ||start|| para iniciar as regras desse Firewall, ||restart|| para reiniciar e ||stop|| para descartar todas as politicas de seguranca, NAO FACA ISSO!"
        echo
        exit 3
    ;;
esac

# FIM: tudo que não for explicitamente permitido será negado!