Initial commit.
bruns@2mbit.com
parent
76ed7160cc
commit
4033c293c1
|
|
@ -0,0 +1,33 @@
|
|||
# Comment out the following to disable features
|
||||
IPTABLES=/sbin/iptables
|
||||
IP6TABLES=/sbin/ip6tables
|
||||
|
||||
NAT=1
|
||||
CONNTRACK=1
|
||||
FORWARD=1
|
||||
BLOCKINCOMING=1
|
||||
#CLAMPMSS=ppp0
|
||||
|
||||
|
||||
#IPV6
|
||||
IPV6=1
|
||||
#IPV6FORWARD=1
|
||||
IPV6BLOCKINCOMING=1
|
||||
#IPV6ROUTEDCLIENTBLOCK=1
|
||||
#IPV6INT=he-ipv6
|
||||
|
||||
#================
|
||||
TCPPORTS="20 21 22 53 80 113 123 443"
|
||||
UDPPORTS="53"
|
||||
TRUSTEDIP="127.0.0.1"
|
||||
DONTTRACK="127.0.0.1"
|
||||
FORWARDRANGE="192.168.1.0/24"
|
||||
NATRANGE="192.168.1.0/24"
|
||||
NATEXTIP="172.16.1.1"
|
||||
NATEXTIF="eth0"
|
||||
ALLOWEDPROTO="41 47 50 51"
|
||||
#================
|
||||
IPV6TRUSTED="::1"
|
||||
IPV6TCP=$TCPPORTS
|
||||
IPV6UDP=$UDPPORTS
|
||||
#IPV6FORWARDRANGE=""
|
||||
|
|
@ -0,0 +1,158 @@
|
|||
#/bin/bash
|
||||
# v0.2
|
||||
# By Brielle Bruns <bruns@2mbit.com>
|
||||
# URL: http://www.sosdg.org
|
||||
# License: GPLv2
|
||||
|
||||
BASEDIR=/etc/sosdg-firewall
|
||||
|
||||
|
||||
. $BASEDIR/options
|
||||
|
||||
$IPTABLES --flush &>/dev/null
|
||||
$IPTABLES -F OUTPUT &>/dev/null
|
||||
$IPTABLES -F PREROUTING &>/dev/null
|
||||
$IPTABLES -F POSTROUTING &>/dev/null
|
||||
if [ $NAT ]; then
|
||||
$IPTABLES -F -t nat &>/dev/null
|
||||
fi
|
||||
$IPTABLES -F -t raw &>/dev/null
|
||||
|
||||
$IPTABLES -A INPUT -i lo -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
echo -n "Adding trusted IP: "
|
||||
|
||||
for i in $TRUSTEDIP; do
|
||||
echo -n "$i "
|
||||
$IPTABLES -A INPUT -s $i -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -d $i -j ACCEPT
|
||||
done
|
||||
echo -ne "\n"
|
||||
|
||||
if [ $CLAMPMSS ]; then
|
||||
$IPTABLES -t mangle -o $CLAMPMSS -A FORWARD -p tcp \
|
||||
--tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 \
|
||||
-j TCPMSS --clamp-mss-to-pmtu
|
||||
|
||||
$IPTABLES -t mangle -o $CLAMPMSS -A OUTPUT -p tcp \
|
||||
--tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 \
|
||||
-j TCPMSS --clamp-mss-to-pmtu
|
||||
fi
|
||||
|
||||
$IPTABLES -A INPUT -j DROP -p udp --dport domain -m u32 --u32 \
|
||||
"0>>22&0x3C@12>>16=1&&0>>22&0x3C@20>>24=0&&0>>22&0x3C@21=0x00020001"
|
||||
|
||||
echo -n "Adding allowed port: "
|
||||
|
||||
for i in $TCPPORTS; do
|
||||
echo -n "TCP/$i "
|
||||
$IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT
|
||||
done
|
||||
|
||||
for i in $UDPPORTS; do
|
||||
echo -n "UDP/$i "
|
||||
#$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT
|
||||
$IPTABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
|
||||
done
|
||||
echo -en "\n"
|
||||
|
||||
echo -n "Adding allowed protocols: "
|
||||
|
||||
for i in $ALLOWEDPROTO; do
|
||||
echo -n "$i "
|
||||
$IPTABLES -A INPUT -p $i -j ACCEPT
|
||||
$IPTABLES -A OUTPUT -p $i -j ACCEPT
|
||||
done
|
||||
echo -en "\n"
|
||||
|
||||
|
||||
if [ $CONNTRACK ]; then
|
||||
for i in $DONTTRACK; do
|
||||
$IPTABLES -t raw -I PREROUTING -s $i -j NOTRACK
|
||||
$IPTABLES -t raw -I PREROUTING -d $i -j NOTRACK
|
||||
$IPTABLES -t raw -I OUTPUT -s $i -j NOTRACK
|
||||
$IPTABLES -t raw -I OUTPUT -d $i -j NOTRACK
|
||||
done
|
||||
fi
|
||||
|
||||
if [ $CONNTRACK ]; then
|
||||
for i in $FORWARDRANGE; do
|
||||
$IPTABLES -A FORWARD -s $i -j ACCEPT
|
||||
$IPTABLES -A FORWARD -d $i -j ACCEPT
|
||||
done
|
||||
fi
|
||||
|
||||
if [ $NAT ]; then
|
||||
for i in $NATRANGE; do
|
||||
$IPTABLES -A POSTROUTING -t nat -s $i -o $NATEXTIF -j SNAT --to-source $NATEXTIP
|
||||
done
|
||||
fi
|
||||
|
||||
$IPTABLES --policy INPUT ACCEPT
|
||||
$IPTABLES --policy OUTPUT ACCEPT
|
||||
$IPTABLES --policy FORWARD DROP
|
||||
|
||||
if [ $BLOCKINCOMING ]; then
|
||||
$IPTABLES -A INPUT -p tcp --syn -j DROP
|
||||
$IPTABLES -A INPUT -p udp -j DROP
|
||||
fi
|
||||
|
||||
|
||||
#================[IPv6]================
|
||||
if [ $IPV6 ]; then
|
||||
$IP6TABLES --flush &>/dev/null
|
||||
$IP6TABLES -F OUTPUT &>/dev/null
|
||||
$IP6TABLES -F PREROUTING &>/dev/null
|
||||
$IP6TABLES -F POSTROUTING &>/dev/null
|
||||
|
||||
echo -n "Adding trusted IPv6: "
|
||||
|
||||
$IP6TABLES -A INPUT -i lo -j ACCEPT
|
||||
$IP6TABLES -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
for i in $IPV6TRUSTED; do
|
||||
echo -n "$i "
|
||||
$IP6TABLES -A INPUT -s $i -j ACCEPT
|
||||
$IP6TABLES -A OUTPUT -d $i -j ACCEPT
|
||||
done
|
||||
echo -ne "\n"
|
||||
|
||||
if [ $IPV6ROUTEDCLIENTBLOCK ]; then
|
||||
$IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
$IP6TABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
$IP6TABLES -A FORWARD -i $IPV6INT -p tcp --syn -j DROP
|
||||
$IP6TABLES -A INPUT -i $IPV6INT -p tcp --syn -j DROP
|
||||
$IP6TABLES -A INPUT -i $IPV6INT -p udp ! --dport 32768:65535 -j DROP
|
||||
$IP6TABLES -A FORWARD -i $IPV6INT -p udp ! --dport 32768:65535 -j DROP
|
||||
fi
|
||||
|
||||
echo -n "Adding allowed IPv6 port: "
|
||||
|
||||
for i in $IPV6TCP; do
|
||||
echo -n "TCP/$i "
|
||||
$IP6TABLES -A INPUT -p tcp --dport $i -j ACCEPT
|
||||
done
|
||||
|
||||
for i in $IPV6UDP; do
|
||||
echo -n "UDP/$i "
|
||||
$IP6TABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
|
||||
$IP6TABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
|
||||
done
|
||||
echo -en "\n"
|
||||
|
||||
if [ $IPV6FORWARDRANGE ]; then
|
||||
for i in $IPV6FORWARDRANGE; do
|
||||
$IP6TABLES -A FORWARD -s $i -j ACCEPT
|
||||
$IP6TABLES -A FORWARD -d $i -j ACCEPT
|
||||
done
|
||||
fi
|
||||
|
||||
if [ $IPV6BLOCKINCOMING ]; then
|
||||
$IP6TABLES -A INPUT -p tcp --syn -j DROP
|
||||
$IP6TABLES -A INPUT -p udp -j DROP
|
||||
fi
|
||||
fi
|
||||
|
||||
$BASEDIR/postrun
|
||||
Loading…
Reference in New Issue