iptables - базовый конфиг роутера

Iptables - базовый конфиг роутера

#!/bin/bash

fw_setup () {
    lan_range="192.168.100.0/24";
    lan_ip="192.168.100.1/24";
    lan_int="enp0s3";
    wan_int="enp0s8";
}
fw_clean () {
    iptables -F;
    iptables -X;
    iptables -t nat -F;
    iptables -t nat -X;
    iptables -t mangle -F;
    iptables -t mangle -X;
    echo "Rules flushed...";
}
fw_policy () {
    iptables -P INPUT DROP;
    iptables -P FORWARD DROP;
    iptables -P OUTPUT DROP;
    echo "Set default Policy...";
}
fw_loopback () {
    iptables -A INPUT -i lo -j ACCEPT;
    iptables -A OUTPUT -o lo -j ACCEPT;
}
fw_sesions () {
    iptables -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT;
    iptables -A OUTPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT;
}
fw_attack () {
    # Block zero-packets
    iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP;
    # Block XMAS
    iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP;
    # Block syn-flood
    iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP;
}
fw_forwarding () {
    iptables -A FORWARD -i $lan_int -o $wan_int -j ACCEPT;
    iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT;
}
fw_nat () {
    # Enable NAT 192.168.100.0/24 --> Ext_IP
    iptables -t nat -A POSTROUTING -s $lan_range -j MASQUERADE;
}
fw_port_forward () {
    iptables -t nat -A PREROUTING -p tcp -i $wan_int --dport 2222 -j DNAT --to-destination 192.168.100.2:22
    iptables -A FORWARD -p tcp -d 192.168.100.2 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
}
fw_services () {
    #
    ###### INCOMING ######
    #
    # SSH
    iptables -A INPUT -s $lan_range -p tcp --dport 22 -j ACCEPT;
    # HTTP
    iptables -A INPUT -p tcp --dport 80 -j ACCEPT;
    # HTTPS
    iptables -A INPUT -p tcp --dport 443 -j ACCEPT;
    # ICMP
    iptables -A INPUT -p icmp -j ACCEPT;
    #
    # Port-forwarding
    iptables -A INPUT -p tcp --dport 2222 -j ACCEPT;
    #
    ###### OUTGOING ######
    #
    # DHCP requests
    iptables -A OUTPUT -o $wan_int -p udp --sport 68 --dport 67 -j ACCEPT;
    #
    # DNS requests
    iptables -A OUTPUT -d $dns_ip -p udp --dport 53 -j ACCEPT;
    # ICMP
    iptables -A OUTPUT -p icmp -j ACCEPT;
    # System updates
    iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT;
    iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT;
    #
    echo "All services configured...";
}
fw_undefined () {
    iptables -N undef_in;
    iptables -N undef_fw;
    iptables -N undef_out;
    iptables -A INPUT -j undef_in;
    iptables -A FORWARD -j undef_fw;
    iptables -A OUTPUT -j undef_out;
}
fw_logging () {
    iptables -A undef_in -j LOG --log-level 7 --log-prefix "Iptables: DROP INPUT ";
    iptables -A undef_in -j DROP;
    iptables -A undef_fw -j LOG --log-level 7 --log-prefix "Iptables: DROP FORWARD ";
    iptables -A undef_fw -j DROP;
    iptables -A undef_out -j LOG --log-level 7 --log-prefix "Iptables: DROP OUTPUT ";
    iptables -A undef_out -j DROP;
}
fw_save_rules () {
    /sbin/service iptables save;
    echo "New rules saved";
}
fw_config () {
    echo "Config started"
    fw_setup;
    fw_clean;
    fw_policy;
    fw_loopback;
    fw_sesions;
    fw_attack;
    fw_forwarding;
    fw_nat;
    fw_port_forward;
    fw_services;
    fw_undefined;
    fw_logging;
    fw_save_rules;
    echo "END";
}
fw_config

exit 0