iptable setup

Lemuria.org

#! /bin/sh
#
# firewall   setting up IPTables firewalling
#
# tom-at-lemuria-dot-org
# if you find any bugs, you may keep them :)
#

IPTABLES=”/sbin/iptables”

set -e

case “$1” in
start)
   echo “Starting firewall: ”
   modprobe ip_conntrack
   echo -n “setting default policy: ”
   # syncookies and NO ip-forwarding
   echo 1 > /proc/sys/net/ipv4/tcp_syncookies
   echo 0 > /proc/sys/net/ipv4/ip_forward
   $IPTABLES -F
   $IPTABLES -X
   $IPTABLES -Z
   $IPTABLES -P INPUT DROP
   $IPTABLES -P FORWARD DROP
   $IPTABLES -P OUTPUT DROP
    $IPTABLES -N in_icmp
   $IPTABLES -N in_tcp
   $IPTABLES -N in_udp
   $IPTABLES -A INPUT -p tcp -j in_tcp
   $IPTABLES -A INPUT -p udp -j in_udp
   $IPTABLES -A INPUT -p icmp -j in_icmp
   echo “done”
   echo -n “spoofing, redirect and broadcast protection/logging: ”
   echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
   echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
   echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
   echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    echo “done”
   echo -n “enabling scan detection: ”
   if [ -f /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ipt_psd.o ]; then
      $IPTABLES -A INPUT -m psd -m limit –limit 5/minute -j LOG –log-prefix ‘#### Port Scan ####’
      echo “psd enabled”
   else
      $IPTABLES -A INPUT -p icmp –icmp-type echo-request -m limit –limit 5/minute -j LOG –log-prefix ‘#### Ping Scan ####’
      # high rate for stealth scans, since they could be legitimate connection
      # attempts as well
      $IPTABLES -A in_tcp -p tcp –tcp-flags SYN,ACK,FIN,RST RST -m limit –limit 1/s –limit-burst 5 -j LOG –log-level info –log-prefix ‘#### Stealth Scan ####’
      $IPTABLES -A in_tcp -p tcp –tcp-flags ALL FIN,URG,PSH -m limit –limit 5/m -j LOG –log-level info –log-prefix ‘#### XMAS Scan ####’
      $IPTABLES -A in_tcp -p tcp –tcp-flags SYN,RST SYN,RST -m limit –limit 5/m -j LOG –log-level info –log-prefix ‘#### SYN/RST Scan ####’
      $IPTABLES -A in_tcp -p tcp –tcp-flags SYN,FIN SYN,FIN -m limit –limit 5/m -j LOG –log-level info –log-prefix ‘#### SYN/FIN Scan ####’
      echo “limited detection enabled (no ipt_psd module)”
   fi
   echo -n “flood, fragment and various other protections: ”
   # we allow 4 TCP connects per second, no more
   $IPTABLES -N syn-flood
   $IPTABLES -A INPUT -p tcp –syn -j syn-flood
   $IPTABLES -A syn-flood -m limit –limit 1/s –limit-burst 4 -j RETURN
   $IPTABLES -A syn-flood -j DROP
   # new connections that have no syn set are most probably evil
   $IPTABLES -A INPUT -p tcp ! –syn -m state –state NEW -j DROP
   # invalid packets
   $IPTABLES -A INPUT -p tcp -m state –state INVALID -m limit –limit 10/m -j LOG –log-level info –log-prefix “### Invalid Packet ###”
   $IPTABLES -A INPUT -p tcp –tcp-option 64 -m limit –limit 5/m -j LOG –log-level info –log-prefix “### Bad TCP FLAG(64) ###”
   $IPTABLES -A INPUT -p tcp –tcp-option 128 -m limit –limit 5/m -j LOG –log-level info –log-prefix “### Bad TCP FLAG(128) ###”
   echo “done”
   echo -n “setting up ICMP: ”
   # we allow echo requests and replies
   # could limit replies to could limit replies to related, but since we
   # answer ping requests, where would be the point in that?
   $IPTABLES -A in_icmp -p icmp –icmp-type 0 -j ACCEPT
   $IPTABLES -A in_icmp -p icmp –icmp-type 8 -j ACCEPT
   # we need destination unreachable
   $IPTABLES -A in_icmp -p icmp –icmp-type 3 -j ACCEPT
   # we are nice and allow traceroute, though it is not required
   $IPTABLES -A in_icmp -p icmp –icmp-type 11 -j ACCEPT
   $IPTABLES -A in_icmp -p icmp –icmp-type 30 -j ACCEPT
   echo “done”
   echo -n “enabling local and outgoing traffic: ”
   $IPTABLES -A INPUT -i lo -j ACCEPT
   $IPTABLES -I in_tcp -p tcp –dport 1024:65535 -m state –state ESTABLISHED,RELATED -j ACCEPT
   $IPTABLES -A OUTPUT -j ACCEPT
   # we are nice and reject instead of drop ident traffic
   $IPTABLES -I in_tcp -p tcp –dport auth –j REJECT
   echo “done”
   echo -n “enabling selected services:”
   $IPTABLES -I in_tcp -p tcp –dport http -m state –state NEW,ESTABLISHED -j ACCEPT
   echo -n ” http”
   $IPTABLES -I in_tcp -p tcp –dport ssh -m state –state NEW,ESTABLISHED -j ACCEPT
   echo -n ” ssh”
   $IPTABLES -I in_tcp -p tcp –dport smtp -m state –state NEW,ESTABLISHED -j ACCEPT
   echo -n ” smtp”
   $IPTABLES -I in_tcp -p tcp –dport imaps -m state –state NEW,ESTABLISHED -j ACCEPT
   echo -n ” imaps”
   $IPTABLES -I in_tcp -p tcp –dport domain -m state –state NEW,ESTABLISHED -j ACCEPT
   $IPTABLES -I in_udp -p udp –dport domain -m state –state NEW,ESTABLISHED -j ACCEPT
   echo -n ” dns”
   $IPTABLES -I in_tcp -p tcp –dport ftp -m state –state NEW,ESTABLISHED -j ACCEPT
   # active ftp
   $IPTABLES -I in_tcp -p tcp –dport ftp-data -m state –state ESTABLISHED,RELATED -j ACCEPT
   echo -n ” ftp”
   # quake3
   $IPTABLES -I in_udp -p udp –dport 1024:65535 -j ACCEPT
   echo -n ” quake (all UDP >1024)”
   echo ” – all done”
   echo “Firewall setup complete.”
   ;;
stop)
   echo -n “Shutting down firewall: ”
   $IPTABLES -F
   $IPTABLES -X
   $IPTABLES -P INPUT ACCEPT
   $IPTABLES -P FORWARD ACCEPT
   $IPTABLES -P OUTPUT ACCEPT
   echo “done”
   ;;
*)
   N=/etc/init.d/$NAME
   echo “Usage: $N {start|stop}” >&2
   exit 1
   ;;
esac

exit 0

Similar Posts:

Post a Comment

Your email is never published nor shared.