Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- IPTS="/usr/sbin/iptables-save"
- IPTR="/usr/sbin/iptables-restore"
- INET_IFACE="eth1"
- INET_NET="192.168.231.0/24"
- INET_ADDRESS="192.168.231.165" #eth1 address
- LOCAL_IFACE="eth0"
- LOCAL_IP="192.168.112.112"
- LOCAL_NET="192.168.112.0/24"
- LOCAL_BCAST="192.168.112.255"
- VPN_IFACE="tun+"
- VPN_LOC_IP="192.168.26.1"
- VPN_NET="192.168.26.0/24"
- VPN_BCAST="192.168.26.255"
- HOME_NET="192.168.114.0/24"
- DSA_NET="192.168.18.0/24"
- STARGAZE="192.168.112.112"
- MODEM="192.168.231.117"
- DISK_IFACE="eth2"
- DISK_IP="192.168.113.113"
- DISK_NET="192.168.113.0/24"
- DISK_BCAST="192.168.113.255"
- if [ "$1" = "save" ]; then
- echo -n "Saving firewall to /etc/sysconfig/iptables ... "
- $IPTS > /etc/sysconfig/iptables
- echo "done"
- exit 0
- elif [ "$1" = "restore" ]; then
- echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
- $IPTR < /etc/sysconfig/iptables
- echo "done"
- exit 0
- fi
- echo "Loading kernel modules ..."
- /sbin/modprobe ip_tables
- /sbin/modprobe ip_conntrack
- /sbin/modprobe ip_nat_ftp
- /sbin/modprobe ip_conntrack_ftp
- /sbin/modprobe ip_conntrack_irc
- echo "Configuring /proc"
- if [ "$SYSCTL" = "" ]
- then
- echo "1" > /proc/sys/net/ipv4/ip_forward
- else
- $SYSCTL net.ipv4.ip_forward="1"
- fi
- if [ "$SYSCTL" = "" ]
- then
- echo "1" > /proc/sys/net/ipv4/tcp_syncookies
- else
- $SYSCTL net.ipv4.tcp_syncookies="1"
- fi
- if [ "$SYSCTL" = "" ]
- then
- echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
- else
- $SYSCTL net.ipv4.conf.all.rp_filter="1"
- fi
- if [ "$SYSCTL" = "" ]
- then
- echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
- else
- $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
- fi
- if [ "$SYSCTL" = "" ]
- then
- echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
- else
- $SYSCTL net.ipv4.conf.all.accept_source_route="0"
- fi
- if [ "$SYSCTL" = "" ]
- then
- echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
- else
- $SYSCTL net.ipv4.conf.all.secure_redirects="1"
- fi
- if [ "$SYSCTL" = "" ]
- then
- echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
- else
- $SYSCTL net.ipv4.conf.all.log_martians="1"
- fi
- echo "loading iptables rules"
- iptables-restore -v <<-EOF;
- # Generated by iptables-save v1.4.14 on Sat Aug 1 14:27:00 2015
- *mangle
- :PREROUTING ACCEPT [766:1016065]
- :INPUT ACCEPT [760:1014007]
- :FORWARD ACCEPT [6:2058]
- :OUTPUT ACCEPT [484:46782]
- :POSTROUTING ACCEPT [490:48840]
- COMMIT
- # Completed on Sat Aug 1 14:27:00 2015
- # Generated by iptables-save v1.4.14 on Sat Aug 1 14:27:00 2015
- *nat
- :PREROUTING ACCEPT [2:102]
- :INPUT ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- :POSTROUTING ACCEPT [0:0]
- :tcp_prebound - [0:0]
- :udp_prebound - [0:0]
- -A PREROUTING -p udp -i $INET_IF -j udp_prebound
- -A PREROUTING -p tcp -i $INET_IF -j tcp_prebound
- -A POSTROUTING -o $INET_IF -j MASQUERADE
- -A tcp_prebound -j RETURN
- -A udp_prebound -j RETURN
- COMMIT
- # Completed on Sat Aug 1 14:27:00 2015
- # Generated by iptables-save v1.4.14 on Sat Aug 1 14:27:00 2015
- *filter
- :INPUT DROP [2:102]
- :FORWARD DROP [0:0]
- :OUTPUT ACCEPT [469:45085]
- :bad_packets - [0:0]
- :icmp_packets - [0:0]
- :tcp_fwdbound - [0:0]
- :tcp_inbound - [0:0]
- :tcp_infwdbound - [0:0]
- :tcp_vpnbound - [0:0]
- :udp_fwdbound - [0:0]
- :udp_inbound - [0:0]
- :udp_infwdbound - [0:0]
- :udp_vpnbound - [0:0]
- -A INPUT -i lo -j ACCEPT
- -A INPUT -m conntrack --ctstate INVALID -j bad_packets
- -A INPUT -d 224.0.0.1/32 -j DROP
- -A INPUT -i $INET_IF -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- -A INPUT -i $VPN_IF -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- -A INPUT -s $LOCAL_NET -i $LOCAL_IF -j ACCEPT
- -A INPUT -d $LOCAL_BCAST -i $LOCAL_IF -j ACCEPT
- -A INPUT -i $LOCAL_IF -p icmp -j ACCEPT
- -A INPUT -i $DISK_IF -j ACCEPT
- -A INPUT -s $VPN_NET -i $VPN_IF -p tcp -j tcp_vpnbound
- -A INPUT -s $HOME_NET -i $VPN_IF -p tcp -j tcp_vpnbound
- -A INPUT -s $DSA_NET -i $VPN_IF -p tcp -j tcp_vpnbound
- -A INPUT -s $VPN_NET -i $VPN_IF -p udp -j udp_vpnbound
- -A INPUT -s $HOME_NET -i $VPN_IF -p udp -j udp_vpnbound
- -A INPUT -s $DSA_NET -i $VPN_IF -p udp -j udp_vpnbound
- -A INPUT -d $VPN_BCAST -i $VPN_IF -j ACCEPT
- -A INPUT -i $VPN_IF -p icmp -j ACCEPT
- -A INPUT -i $INET_IF -p tcp -j tcp_inbound
- -A INPUT -i $INET_IF -p udp -j udp_inbound
- -A INPUT -i $INET_IF -p icmp -j icmp_packets
- -A INPUT -m limit --limit 3/min --limit-burst 3 -j ULOG --ulog-prefix "INPUT packet died: "
- -A FORWARD -i $INET_IF -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- -A FORWARD -i $VPN_IF -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- -A FORWARD -i $LOCAL_IF -p tcp -j tcp_fwdbound
- -A FORWARD -i $DISK_IF -j ACCEPT
- -A FORWARD -i $LOCAL_IF -p udp -j udp_fwdbound
- -A FORWARD -i $LOCAL_IF -j ACCEPT
- -A FORWARD -s $VPN_NET -i $VPN_IF -p tcp -j tcp_vpnbound
- -A FORWARD -s $HOME_NET -i $VPN_IF -p tcp -j tcp_vpnbound
- -A FORWARD -s $DSA_NET -i $VPN_IF -p tcp -j tcp_vpnbound
- -A FORWARD -s $VPN_NET -i $VPN_IF -p udp -j udp_vpnbound
- -A FORWARD -s $HOME_NET -i $VPN_IF -p udp -j udp_vpnbound
- -A FORWARD -s $DSA_NET -i $VPN_IF -p udp -j udp_vpnbound
- -A FORWARD -i $VPN_IF -p icmp -j icmp_packets
- -A FORWARD -i $INET_IF -p tcp -j tcp_infwdbound
- -A FORWARD -i $INET_IF -p udp -j udp_infwdbound
- -A FORWARD -i $INET_IF -p icmp -j icmp_packets
- -A FORWARD -m limit --limit 3/min --limit-burst 3 -j ULOG --ulog-prefix "FORWARD packet died: "
- -A OUTPUT -m conntrack --ctstate INVALID -j DROP
- -A bad_packets -j ULOG --ulog-prefix "Invalid packet: "
- -A bad_packets -j DROP
- -A bad_packets -j RETURN
- -A icmp_packets -p icmp -m icmp --icmp-type 0 -j ACCEPT
- -A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
- -A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
- -A icmp_packets -p icmp -m icmp --icmp-type 9 -j ACCEPT
- -A icmp_packets -j RETURN
- -A tcp_fwdbound -j RETURN
- -A tcp_inbound -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable
- -A tcp_inbound -p tcp -m tcp --dport 51237 -j ACCEPT
- -A tcp_inbound -p tcp -m multiport --dports 34567:34569 -j ACCEPT
- -A tcp_inbound -j RETURN
- -A tcp_infwdbound -j RETURN
- -A tcp_vpnbound -p tcp -m multiport --dports 80,8080,10000,6600,38000,22,51237,53 -j ACCEPT
- -A tcp_vpnbound -p tcp -m multiport --dports 3389:3391,3395,5901,5801,139,445,34122:34128 -j ACCEPT
- -A tcp_vpnbound -j RETURN
- -A udp_fwdbound -j RETURN
- -A udp_inbound -p udp -m udp --dport 113 -j REJECT --reject-with icmp-port-unreachable
- -A udp_inbound -p udp -m multiport --dports 137,138 -j DROP
- -A udp_inbound -p udp -m multiport --dports 34567:34569 -j ACCEPT
- -A udp_inbound -p udp -m udp --dport 1194 -j ACCEPT
- -A udp_inbound -s $MODEM -p udp -m udp --dport 123 -j ACCEPT
- -A udp_inbound -j RETURN
- -A udp_infwdbound -j RETURN
- -A udp_vpnbound -p udp -m udp --dport 53 -j ACCEPT
- -A udp_vpnbound -p udp -m multiport --dports 137,139,445 -j ACCEPT
- -A udp_vpnbound -j RETURN
- COMMIT
- # Completed on Sat Aug 1 14:27:00 2015
- EOF
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement