Firewall-SOSDG/rc.firewall

341 lines
9.4 KiB
Plaintext
Raw Normal View History

2009-08-13 13:53:20 -06:00
#/bin/bash
2010-06-21 22:34:28 -06:00
# v0.9
2009-08-13 13:53:20 -06:00
# By Brielle Bruns <bruns@2mbit.com>
2009-08-13 17:13:29 -06:00
# URL: http://www.sosdg.org/freestuff/firewall
# License: GPLv3
2010-06-21 22:50:30 -06:00
echo -e "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-="
2010-06-21 22:49:41 -06:00
echo -e "SOSDG/Firewall v0.9"
echo -e "Brielle Bruns <bruns@2mbit.com>"
2010-06-21 22:50:57 -06:00
echo -e "http://www.sosdg.org/freestuff/firewall"
echo -e "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"
2010-06-21 22:49:41 -06:00
2009-08-13 14:42:01 -06:00
BASEDIR=/etc/firewall-sosdg
2009-08-13 17:13:29 -06:00
TWEAKS=$BASEDIR/tweaks
#BASEDIR=`pwd`
2009-08-13 13:53:20 -06:00
. $BASEDIR/options
$IPTABLES --flush &>/dev/null
$IPTABLES -F OUTPUT &>/dev/null
$IPTABLES -F PREROUTING &>/dev/null
$IPTABLES -F POSTROUTING &>/dev/null
2010-06-19 22:22:36 -06:00
$IPTABLES -F -t mangle &>/dev/null
2009-08-13 13:53:20 -06:00
if [ $NAT ]; then
$IPTABLES -F -t nat &>/dev/null
fi
$IPTABLES -F -t raw &>/dev/null
2009-08-19 15:10:47 -06:00
$BASEDIR/prerun
2009-08-13 13:53:20 -06:00
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
2010-06-21 22:49:41 -06:00
if [ "$TRUSTEDIP" ]; then
echo -ne "\E[33mAdding trusted IP:\E[37m "
for i in $TRUSTEDIP; do
echo -n "$i "
$IPTABLES -A INPUT -s $i -j ACCEPT
$IPTABLES -A OUTPUT -d $i -j ACCEPT
done
echo -ne "\n"
fi
2009-08-29 18:52:40 -06:00
if [ $BLOCKEDIP ]; then
2010-06-21 22:34:28 -06:00
echo -en "\E[33mAdding blocked IPs:\E[37m "
2009-08-29 18:52:40 -06:00
for i in `grep -v "\#" $BLOCKEDIP`; do
2009-08-29 18:57:39 -06:00
echo -n "$i "
2009-08-29 18:54:17 -06:00
$IPTABLES -A INPUT -s $i -j DROP
$IPTABLES -A OUTPUT -d $i -j DROP
2009-08-29 18:52:40 -06:00
done
echo -ne "\n"
2009-08-29 18:57:39 -06:00
fi
2009-08-29 18:52:40 -06:00
2010-06-19 15:41:27 -06:00
if [ "$STRIPECN" ]; then
2010-06-21 22:34:28 -06:00
echo -en "\E[33mStripping ECN off of TCP packets to \E[37m"
2010-06-19 15:41:27 -06:00
for i in $STRIPECN; do
2010-06-21 22:34:28 -06:00
echo -en "$i "
2010-06-19 15:41:27 -06:00
$IPTABLES -A PREROUTING -t mangle -p tcp -d $i -j ECN \
2010-06-19 15:44:54 -06:00
--ecn-tcp-remove
2010-06-19 15:41:27 -06:00
done
2010-06-21 22:45:40 -06:00
echo -ne "\n"
2010-06-19 15:41:27 -06:00
fi
2010-05-15 11:29:54 -06:00
if [ "$CLAMPMSS" ]; then
2010-06-21 22:34:28 -06:00
echo -e "\E[33mClamping MSS to PMTU...\E[37m"
2010-05-15 11:07:40 -06:00
for i in $CLAMPMSS; do
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
2010-05-15 11:10:59 -06:00
--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
2010-05-15 11:07:40 -06:00
$IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
2010-05-15 11:10:59 -06:00
--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
2010-05-15 11:07:40 -06:00
# This is necessary to make sure that PMTU works
$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded \
-o $i -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded \
-i $i -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
-o $i -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed \
-i $i -j ACCEPT
done
2009-08-13 16:11:39 -06:00
echo -en "\n"
2010-06-21 22:45:40 -06:00
fi
2009-08-13 13:53:20 -06:00
$IPTABLES -A INPUT -j DROP -p udp --dport domain -m u32 --u32 \
"0>>22&0x3C@12>>16=1&&0>>22&0x3C@20>>24=0&&0>>22&0x3C@21=0x00020001"
2009-08-24 21:51:41 -06:00
if [ $CONNTRACK ]; then
$IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state NEW -j ACCEPT
fi
2010-06-21 22:34:28 -06:00
if [ "$BLOCKTCPPORTS" ] || [ "$BLOCKUDPPORTS" ]; then
echo -en "\E[33mBlocking outbound port:\E[37m "
2009-08-13 13:53:20 -06:00
2010-06-21 22:34:28 -06:00
if [ "$BLOCKTCPPORTS" ]; then
for i in $BLOCKTCPPORTS; do
echo -en "\E[35mTCP\E[37m/\E[32m$i "
$IPTABLES -A OUTPUT -p tcp --dport $i --syn -j DROP
done
fi
if [ "$BLOCKUDPPORTS" ]; then
for i in $BLOCKUDPPORTS; do
echo -en "\E[34mUDP\E[37m/\E[32m$i "
$IPTABLES -A OUTPUT -p udp --dport $i -j DROP
done
fi
echo -en "\n"
fi
2009-08-13 13:53:20 -06:00
2010-06-21 22:34:28 -06:00
if [ "$TCPPORTS" ] || [ "$UDPPORTS" ]; then
echo -en "\E[33mAdding allowed port:\E[37m "
if [ "$TCPPORTS" ]; then
for i in $TCPPORTS; do
echo -en "\E[35mTCP\E[37m/\E[32m$i "
$IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT
done
fi
if [ "$UDPPORTS" ]; then
for i in $UDPPORTS; do
echo -en "\E[34mUDP\E[37m/\E[32m$i "
#$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT
$IPTABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
$IPTABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
$IPTABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
done
fi
echo -en "\n\E[37m"
fi
2009-08-13 13:53:20 -06:00
2010-06-21 22:34:28 -06:00
if [ "$ALLOWEDPROTO" ]; then
echo -en "\E[33mAdding allowed protocols:\E[37m "
for i in $ALLOWEDPROTO; do
echo -n "$i "
$IPTABLES -A INPUT -p $i -j ACCEPT
$IPTABLES -A OUTPUT -p $i -j ACCEPT
done
echo -en "\n\E[37m"
fi
2009-08-13 13:53:20 -06:00
if [ $CONNTRACK ]; then
for i in $DONTTRACK; do
$IPTABLES -t raw -I PREROUTING -s $i -j NOTRACK
$IPTABLES -t raw -I PREROUTING -d $i -j NOTRACK
$IPTABLES -t raw -I OUTPUT -s $i -j NOTRACK
$IPTABLES -t raw -I OUTPUT -d $i -j NOTRACK
done
fi
2009-08-13 16:26:44 -06:00
2009-08-13 15:56:21 -06:00
if [ $ROUTING ]; then
2010-06-21 22:34:28 -06:00
echo -en "\E[33mAdding route:\E[37m "
2009-08-13 15:56:21 -06:00
for i in `grep -v "\#" $ROUTING`; do
ROUTE=( ${i//:/ } )
2009-08-13 16:16:53 -06:00
FWINT1=${ROUTE[0]}
FWINT2=${ROUTE[2]}
FWIP1=${ROUTE[1]}
FWIP2=${ROUTE[3]}
2010-06-21 22:43:58 -06:00
if [ -e "/proc/sys/net/ipv4/conf/$FWINT1/forwarding" ]; then
echo 1 > /proc/sys/net/ipv4/conf/$FWINT1/forwarding
fi
if [ -e "/proc/sys/net/ipv4/conf/$FWINT2/forwarding" ]; then
echo 1 > /proc/sys/net/ipv4/conf/$FWINT2/forwarding
fi
2009-08-13 16:21:23 -06:00
$IPTABLES -A FORWARD -i $FWINT1 -o $FWINT2 \
-s $FWIP1 -d $FWIP2 -j ACCEPT
2009-08-13 16:06:17 -06:00
if [ ${ROUTE[4]} == "1" ]; then
2010-06-21 22:53:43 -06:00
echo -en "\E[35m$FWINT1\E[37m:$FWIP1<->\E[34m$FWINT2\E[37m:$FWIP2 "
2009-08-13 16:16:53 -06:00
$IPTABLES -A FORWARD -o $FWINT1 -i $FWINT2 \
-d $FWIP1 -s $FWIP2 -j ACCEPT
2009-08-13 16:06:17 -06:00
else
2009-11-16 13:36:37 -07:00
echo -n "$FWINT1:$FWIP1->$FWINT2:$FWIP2 "
2009-08-13 16:06:17 -06:00
fi
2009-08-13 13:53:20 -06:00
done
2010-06-21 22:34:28 -06:00
echo -ne "\n"
2009-08-13 13:53:20 -06:00
fi
2009-08-13 16:26:44 -06:00
if [ $PORTFW ] && [ $NAT ]; then
2010-06-21 22:34:28 -06:00
echo -en "\E[33mAdding port forward for:\E[37m "
for i in `grep -v "\#" $PORTFW`; do
PORTADD=( ${i//:/ } )
$IPTABLES -A PREROUTING -t nat -i $NATEXTIF -p ${PORTADD[1]} \
--dport ${PORTADD[0]} -j DNAT --to \
${PORTADD[2]}:${PORTADD[3]}
$IPTABLES -A INPUT -p ${PORTADD[1]} -m state --state NEW \
--dport ${PORTADD[0]} -i $NATEXTIF -j ACCEPT
2010-06-21 22:41:43 -06:00
echo -en "\E[32m${PORTADD[0]}\E[37m/\E[35m${PORTADD[1]}\E[37m->${PORTADD[2]}:${PORTADD[3]} "
done
2010-06-21 22:41:43 -06:00
echo -ne "\n"
fi
2009-08-13 15:12:04 -06:00
if [ $LANDHCPSERVER ]; then
$IPTABLES -A INPUT -i $INTIF -s 0.0.0.0 -j ACCEPT
fi
2009-08-16 19:44:42 -06:00
2010-05-15 11:07:40 -06:00
2009-08-13 13:53:20 -06:00
if [ $NAT ]; then
for i in $NATRANGE; do
$IPTABLES -A POSTROUTING -t nat -s $i -o $NATEXTIF -j SNAT --to-source $NATEXTIP
done
2010-05-15 11:07:40 -06:00
# This is necessary to make sure that PMTU works
$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o $NATEXTIF \
-j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
-o $NATEXTIF -j ACCEPT
2009-08-13 13:53:20 -06:00
fi
$IPTABLES --policy INPUT ACCEPT
$IPTABLES --policy OUTPUT ACCEPT
$IPTABLES --policy FORWARD DROP
if [ $BLOCKINCOMING ]; then
$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -A INPUT -p udp -j DROP
fi
#================[IPv6]================
if [ $IPV6 ]; then
$IP6TABLES --flush &>/dev/null
$IP6TABLES -F OUTPUT &>/dev/null
$IP6TABLES -F PREROUTING &>/dev/null
$IP6TABLES -F POSTROUTING &>/dev/null
2010-06-21 22:34:28 -06:00
echo -ne "\E[33mAdding trusted IPv6:\E[37m "
2009-08-13 13:53:20 -06:00
$IP6TABLES -A INPUT -i lo -j ACCEPT
$IP6TABLES -A OUTPUT -o lo -j ACCEPT
for i in $IPV6TRUSTED; do
echo -n "$i "
$IP6TABLES -A INPUT -s $i -j ACCEPT
$IP6TABLES -A OUTPUT -d $i -j ACCEPT
done
2010-06-21 22:34:28 -06:00
echo -ne "\n\E[37m"
2009-08-13 13:53:20 -06:00
2010-05-15 11:07:40 -06:00
2010-05-15 11:29:54 -06:00
if [ "$CLAMPMSSIPV6" ]; then
2010-06-21 22:34:28 -06:00
echo -e "\E[33mClamping IPV6 MSS to PMTU...\E[37m"
2010-05-15 11:23:16 -06:00
for i in $CLAMPMSSIPV6; do
2010-05-15 11:15:39 -06:00
$IP6TABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
2010-05-15 11:25:10 -06:00
--mss 1280:1536
2010-05-15 11:15:39 -06:00
$IP6TABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
2010-05-15 11:25:10 -06:00
--mss 1280:1536
2010-05-15 11:15:39 -06:00
# This is necessary to make sure that PMTU works
2010-05-15 11:20:07 -06:00
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded \
2010-05-15 11:15:39 -06:00
-o $i -j ACCEPT
2010-05-15 11:20:07 -06:00
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type time-exceeded \
2010-05-15 11:15:39 -06:00
-i $i -j ACCEPT
2010-05-15 11:20:07 -06:00
$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big \
2010-05-15 11:15:39 -06:00
-o $i -j ACCEPT
2010-05-15 11:20:07 -06:00
$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type packet-too-big \
2010-05-15 11:15:39 -06:00
-i $i -j ACCEPT
done
2010-05-15 11:07:40 -06:00
fi
2009-08-13 13:53:20 -06:00
2010-06-21 22:34:28 -06:00
if [ "$BLOCKIPV6TCPPORTS" ] || [ "$BLOCKIPV6UDPPORTS" ]; then
echo -en "\E[33mBlocking outbound port:\E[37m "
if [ "$BLOCKIPV6TCPPORTS" ]; then
for i in $BLOCKIPV6TCPPORTS; do
echo -en "\E[35mTCP\E[37m/\E[32m$i "
$IP6TABLES -A OUTPUT -p tcp --dport $i --syn -j DROP
done
fi
if [ "$BLOCKIPV6UDPPORTS" ]; then
for i in $BLOCKIPV6UDPPORTS; do
echo -en "\E[34mUDP\E[37m/\E[32m$i "
$IP6TABLES -A OUTPUT -p udp --dport $i -j DROP
done
fi
echo -en "\n\E[37m"
fi
2009-08-13 13:53:20 -06:00
2010-06-21 22:34:28 -06:00
if [ "$IPV6TCP" ] || [ "$IPV6UDP" ]; then
echo -en "\E[33mAdding allowed IPv6 port:\E[37m "
if [ "$IPV6TCP" ]; then
for i in $IPV6TCP; do
echo -en "\E[35mTCP\E[37m/\E[32m$i "
$IP6TABLES -A INPUT -p tcp --dport $i -j ACCEPT
done
fi
if [ "$IPV6UDP" ]; then
for i in $IPV6UDP; do
echo -en "\E[34mUDP\E[37m/\E[32m$i "
$IP6TABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
$IP6TABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
$IP6TABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
done
fi
echo -en "\n\E[37m"
fi
fi
2009-08-23 16:47:45 -06:00
if [ $IPV6ROUTEDCLIENTBLOCK ]; then
$IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IP6TABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
2010-05-15 21:41:56 -06:00
$IP6TABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IP6TABLES -A OUTPUT -m state --state NEW -j ACCEPT
2009-08-23 16:47:45 -06:00
$IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p tcp --syn -j DROP
$IP6TABLES -A INPUT -i $IPV6INT -p tcp --syn -j DROP
$IP6TABLES -A INPUT -i $IPV6INT -p udp ! --dport 32768:65535 -j DROP
$IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p udp ! --dport 32768:65535 -j DROP
fi
2009-08-13 13:53:20 -06:00
if [ $IPV6FORWARDRANGE ]; then
for i in $IPV6FORWARDRANGE; do
$IP6TABLES -A FORWARD -s $i -j ACCEPT
$IP6TABLES -A FORWARD -d $i -j ACCEPT
done
fi
if [ $IPV6BLOCKINCOMING ]; then
$IP6TABLES -A INPUT -p tcp --syn -j DROP
$IP6TABLES -A INPUT -p udp -j DROP
fi
2009-08-13 17:13:29 -06:00
if [ $TWEAKS ]; then
for i in `grep -v "\#" $TWEAKS`; do
PROCOPT=( ${i//=/ } )
echo ${PROCOPT[1]} > /proc/sys/net/${PROCOPT[0]} &>/dev/null
done
fi
2009-08-13 13:53:20 -06:00
$BASEDIR/postrun