#Iptables - пример исполнения конфигурационного файла
#ps: камрад Pashutik, если ты это читаешь, пасиб за идейку с функциями

#!/bin/bash

fw_setup () {
    lan_ip="192.168.100.0/24";
    lan_int="enp0s3";
    dns_ip="8.8.8.8"
}

fw_clean () {
    iptables -F;
    iptables -X;
    iptables -t nat -F;
    iptables -t nat -X;
    iptables -t mangle -F;
    iptables -t mangle -X;
    echo "Rules flushed...";
}
fw_policy () {
    iptables -P INPUT DROP;
    iptables -P FORWARD DROP;
    iptables -P OUTPUT DROP;
    echo "Set default Policy...";
}
fw_loopback () {
    iptables -A INPUT -i lo -j ACCEPT;
    iptables -A OUTPUT -o lo -j ACCEPT;
}
fw_sesions () {
    iptables -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT;
    iptables -A OUTPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT;
}
fw_attack () {
    # Block zero-packets
    iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP;
    # Block XMAS
    iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP;
    # Block syn-flood
    iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP;
}
fw_services () {
    #
    ###### INCOMING ######
    #
    # SSH
    iptables -A INPUT -s $lan_ip -p tcp --dport 22 -j ACCEPT;
    # HTTP
    iptables -A INPUT -p tcp --dport 80 -j ACCEPT;
    # HTTPS
    iptables -A INPUT -p tcp --dport 443 -j ACCEPT;
    # ICMP
    iptables -A INPUT -p icmp -j ACCEPT;
    #
    #
    ###### OUTGOING ######
    #
    #
    # DNS requests
    iptables -A OUTPUT -d $dns_ip -p udp --dport 53 -j ACCEPT;
    # ICMP
    iptables -A OUTPUT -p icmp -j ACCEPT;
    # System updates
    iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT;
    iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT;
    #
    echo "All services configured...";
}
fw_undefined () {
    iptables -N undef_in;
    iptables -N undef_fw;
    iptables -N undef_out;
    iptables -A INPUT -j undef_in;
    iptables -A FORWARD -j undef_fw;
    iptables -A OUTPUT -j undef_out;
}
fw_logging () {
    iptables -A undef_in -j LOG --log-level 7 --log-prefix "Iptables: DROP INPUT ";
    iptables -A undef_in -j DROP;
    iptables -A undef_fw -j LOG --log-level 7 --log-prefix "Iptables: DROP FORWARD ";
    iptables -A undef_fw -j DROP;
    iptables -A undef_out -j LOG --log-level 7 --log-prefix "Iptables: DROP OUTPUT ";
    iptables -A undef_out -j DROP;
}
fw_save_rules () {
    /sbin/service iptables save;
    echo "New rules saved";
}
fw_config () {
    fw_setup;
    fw_clean;
    fw_policy;
    fw_loopback;
    fw_sesions;
    fw_attack;
    fw_services;
    fw_undefined;
    fw_logging;
    fw_save_rules;
}

fw_config

exit