#/bin/sh # v0.9.4 # By Brielle Bruns # URL: http://www.sosdg.org/freestuff/firewall # License: GPLv3 # # Copyright (C) 2009 - 2010 Brielle Bruns # Copyright (C) 2009 - 2010 The Summit Open Source Development Group # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program. If not, see . echo "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Firewall/SOSDG v0.9.4 Brielle Bruns http://www.sosdg.org/freestuff/firewall This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=" BASEDIR=/etc/firewall-sosdg TWEAKS=$BASEDIR/tweaks #BASEDIR=`pwd` . $BASEDIR/options . $BASEDIR/include/functions $IPTABLES --flush &>/dev/null $IPTABLES -F OUTPUT &>/dev/null $IPTABLES -F PREROUTING &>/dev/null $IPTABLES -F POSTROUTING &>/dev/null $IPTABLES -F -t mangle &>/dev/null if [ $NAT ]; then $IPTABLES -F -t nat &>/dev/null fi $IPTABLES -F -t raw &>/dev/null if [ -s "$BASEDIR/include/ipv4_custom_flush" ]; then display_c YELLOW "Loading custom flush rules..." . "$BASEDIR/include/ipv4_custom_flush" fi $BASEDIR/prerun $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT if [ -s "$BASEDIR/include/ipv4_custom_trust" ]; then display_c YELLOW "Loading custom trust rules..." . "$BASEDIR/include/ipv4_custom_trust" fi if [ "$TRUSTEDIP" ]; then display_c YELLOW "Adding trusted IP: " N for i in $TRUSTEDIP; do echo -n "$i " $IPTABLES -A INPUT -s $i -j ACCEPT $IPTABLES -A OUTPUT -d $i -j ACCEPT done echo -ne "\n" fi if [ -s "$BASEDIR/include/ipv4_custom_blockip" ]; then display_c YELLOW "Loading custom ip block rules..." . "$BASEDIR/include/ipv6_custom_blockip" fi if [ $BLOCKEDIP ]; then display_c YELLOW "Adding blocked IPs: " N for i in `grep -v "\#" $BLOCKEDIP`; do echo -n "$i " $IPTABLES -A INPUT -s $i -j DROP $IPTABLES -A OUTPUT -d $i -j DROP done echo -ne "\n" fi if [ "$STRIPECN" ]; then display_c YELLOW "Stripping ECN off of TCP packets to " N for i in $STRIPECN; do echo -en "$i " $IPTABLES -A PREROUTING -t mangle -p tcp -d $i -j ECN \ --ecn-tcp-remove done echo -ne "\n" fi if [ -s "$BASEDIR/include/ipv4_custom_mssclamp" ]; then display_c YELLOW "Loading custom MSS Clamp rules..." . "$BASEDIR/include/ipv4_custom_mssclamp" fi if [ "$CLAMPMSS" ]; then display_c YELLOW "Clamping MSS to PMTU..." for i in $CLAMPMSS; do $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \ --clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536 $IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \ --clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536 # This is necessary to make sure that PMTU works $IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded \ -o $i -j ACCEPT $IPTABLES -A INPUT -p icmp --icmp-type time-exceeded \ -i $i -j ACCEPT $IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \ -o $i -j ACCEPT $IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed \ -i $i -j ACCEPT done echo -en "\n" fi $IPTABLES -A INPUT -j DROP -p udp --dport domain -m u32 --u32 \ "0>>22&0x3C@12>>16=1&&0>>22&0x3C@20>>24=0&&0>>22&0x3C@21=0x00020001" if [ -s "$BASEDIR/include/ipv4_custom_conntrack" ]; then display_c YELLOW "Loading custom conntrack rules..." . "$BASEDIR/include/ipv4_custom_conntrack" fi if [ $CONNTRACK ]; then $IPTABLES -A INPUT -m state --state NEW -j ACCEPT $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -m state --state NEW -j ACCEPT $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A OUTPUT -m state --state NEW -j ACCEPT $IPTABLES -A INPUT -m state --state INVALID -j DROP $IPTABLES -A OUTPUT -m state --state INVALID -j DROP $IPTABLES -A FORWARD -m state --state INVALID -j DROP fi if [ -s "$BASEDIR/include/ipv4_custom_blockoutports" ]; then display_c YELLOW "Loading custom blocked outbound port rules..." . "$BASEDIR/include/ipv4_custom_blockoutports" fi if [ "$BLOCKTCPPORTS" ] || [ "$BLOCKUDPPORTS" ]; then display_c YELLOW "Blocking outbound port: " N if [ "$BLOCKTCPPORTS" ]; then for i in $BLOCKTCPPORTS; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IPTABLES -A OUTPUT -p tcp --dport $i --syn -j DROP if [ "$NATRANGE" ]; then for src in $NATRANGE; do $IPTABLES -A FORWARD -p tcp -s $src --dport $i --syn -j DROP done fi done fi if [ "$BLOCKUDPPORTS" ]; then for i in $BLOCKUDPPORTS; do echo -en "\E[34mUDP\E[37m/\E[32m$i " $IPTABLES -A OUTPUT -p udp --dport $i -j DROP if [ "$NATRANGE" ]; then for src in $NATRANGE; do $IPTABLES -A FORWARD -p udp -s $src --dport $i -j DROP done fi done fi reset_color fi if [ -s "$BASEDIR/include/ipv4_custom_allowedports" ]; then display_c YELLOW "Loading custom allowed port rules..." . "$BASEDIR/include/ipv4_custom_allowedports" fi if [ "$TCPPORTS" ] || [ "$UDPPORTS" ]; then display_c YELLOW "Adding allowed port: " N if [ "$TCPPORTS" ]; then for i in $TCPPORTS; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT done fi if [ "$UDPPORTS" ]; then for i in $UDPPORTS; do echo -en "\E[34mUDP\E[37m/\E[32m$i " #$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT $IPTABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT $IPTABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT $IPTABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT done fi reset_color fi if [ -s "$BASEDIR/include/ipv4_custom_proto" ]; then display_c YELLOW "Loading custom protocol rules..." . "$BASEDIR/include/ipv4_custom_proto" fi if [ "$ALLOWEDPROTO" ]; then display_c YELLOW "Adding allowed protocols: " N for i in $ALLOWEDPROTO; do echo -n "$i " $IPTABLES -A INPUT -p $i -j ACCEPT $IPTABLES -A OUTPUT -p $i -j ACCEPT done reset_color fi if [ -s "$BASEDIR/include/ipv4_custom_notrack" ]; then display_c YELLOW "Loading custom NOTRACK rules..." . "$BASEDIR/include/ipv4_custom_notrack" fi if [ $CONNTRACK ]; then for i in $DONTTRACK; do $IPTABLES -t raw -I PREROUTING -s $i -j NOTRACK $IPTABLES -t raw -I PREROUTING -d $i -j NOTRACK $IPTABLES -t raw -I OUTPUT -s $i -j NOTRACK $IPTABLES -t raw -I OUTPUT -d $i -j NOTRACK done fi if [ -s "$BASEDIR/include/ipv4_custom_routing" ]; then display_c YELLOW "Loading custom routing rules..." . "$BASEDIR/include/ipv4_custom_routing" fi if [ $ROUTING ]; then display_c YELLOW "Adding route: " N for i in `grep -v "\#" $ROUTING`; do ROUTE=( ${i//:/ } ) FWINT1=${ROUTE[0]} FWINT2=${ROUTE[2]} FWIP1=${ROUTE[1]} FWIP2=${ROUTE[3]} if [ -e "/proc/sys/net/ipv4/conf/$FWINT1/forwarding" ]; then echo 1 > /proc/sys/net/ipv4/conf/$FWINT1/forwarding fi if [ -e "/proc/sys/net/ipv4/conf/$FWINT2/forwarding" ]; then echo 1 > /proc/sys/net/ipv4/conf/$FWINT2/forwarding fi $IPTABLES -A FORWARD -i $FWINT1 -o $FWINT2 \ -s $FWIP1 -d $FWIP2 -j ACCEPT if [ ${ROUTE[4]} == "1" ]; then echo -en "\E[35m$FWINT1\E[37m:$FWIP1<->\E[34m$FWINT2\E[37m:$FWIP2 " $IPTABLES -A FORWARD -o $FWINT1 -i $FWINT2 \ -d $FWIP1 -s $FWIP2 -j ACCEPT else echo -n "$FWINT1:$FWIP1->$FWINT2:$FWIP2 " fi done echo -ne "\n" fi if [ -s "$BASEDIR/include/ipv4_custom_portforward" ]; then display_c YELLOW "Loading custom port forwarding rules..." . "$BASEDIR/include/ipv4_custom_portforward" fi if [ $PORTFW ] && [ $NAT ]; then display_c YELLOW "Adding port forward for: " N for i in `grep -v "\#" $PORTFW`; do PORTADD=( ${i//:/ } ) $IPTABLES -A PREROUTING -t nat -i ${PORTADD[0]} -p ${PORTADD[2]} \ --dport ${PORTADD[1]} -j DNAT --to \ ${PORTADD[3]}:${PORTADD[4]} $IPTABLES -A INPUT -p ${PORTADD[2]} -m state --state NEW \ --dport ${PORTADD[1]} -i ${PORTADD[0]} -j ACCEPT display_c PURPLE "${PORTADD[0]}:${PORTADD[1]}:${PORTADD[2]}->${PORTADD[3]}:${PORTADD[4]} " N done reset_color fi if [ $LANDHCPSERVER ]; then #$IPTABLES -A INPUT -i $INTIF -s 0.0.0.0 -j ACCEPT $IPTABLES -I INPUT -i $INTIF -p udp --dport 67:68 --sport \ 67:68 -j ACCEPT fi if [ -s "$BASEDIR/include/ipv4_custom_nat" ]; then display_c YELLOW "Loading custom nat rules..." . "$BASEDIR/include/ipv4_custom_nat" fi if [ $NAT ]; then if [ "$NAT_RANGE" ]; then display_c YELLOW "Adding NAT rule: " N for i in $NAT_RANGE; do NAT_RULE=( ${i//:/ } ) case ${NAT_RULE[0]} in SNAT) $IPTABLES -A POSTROUTING -t nat -s ${NAT_RULE[2]} -j SNAT \ -o ${NAT_RULE[3]} --to-source ${NAT_RULE[4]} display_c PURPLE "SNAT:${NAT_RULE[1]}:${NAT_RULE[2]}->${NAT_RULE[3]}:${NAT_RULE[4]} " N $IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o ${NAT_RULE[3]} -j ACCEPT $IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed -o ${NAT_RULE[3]} -j ACCEPT ;; MASQ) $IPTABLES -A POSTROUTING -t nat -s ${NAT_RULE[2]} -j MASQUERADE -o ${NAT_RULE[3]} display_c PURPLE "MASQ:${NAT_RULE[2]}->${NAT_RULE[3]} " N $IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o ${NAT_RULE[3]} -j ACCEPT $IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed -o ${NAT_RULE[3]} -j ACCEPT ;; *) display_c RED "Invalid NAT rule in NAT_RANGE" ;; esac done reset_color fi #================= # This section is going away in 1.0 if [ "$NATRANGE" ]; then for i in $NATRANGE; do $IPTABLES -A POSTROUTING -t nat -s $i -o $NATEXTIF -j SNAT --to-source $NATEXTIP done #This is necessary to make sure that PMTU works $IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o $NATEXTIF \ -j ACCEPT $IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \ -o $NATEXTIF -j ACCEPT #================= fi fi $IPTABLES --policy INPUT ACCEPT $IPTABLES --policy OUTPUT ACCEPT $IPTABLES --policy FORWARD DROP if [ -s "$BASEDIR/include/ipv4_custom_blockincoming" ]; then display_c YELLOW "Loading custom incoming blocked rules..." . "$BASEDIR/include/ipv4_custom_blockincoming" fi if [ $BLOCKINCOMING ]; then $IPTABLES -A INPUT -p tcp --syn -j DROP $IPTABLES -A INPUT -p udp -j DROP fi #================[IPv6]================ if [ $IPV6 ]; then $IP6TABLES --flush &>/dev/null $IP6TABLES -F OUTPUT &>/dev/null $IP6TABLES -F PREROUTING &>/dev/null $IP6TABLES -F POSTROUTING &>/dev/null if [ -s "$BASEDIR/include/ipv6_custom_flush" ]; then display_c YELLOW "Loading custom IPv6 flush rules..." . "$BASEDIR/include/ipv6_custom_flush" fi display_c YELLOW "Adding trusted IPv6: " N $IP6TABLES -A INPUT -i lo -j ACCEPT $IP6TABLES -A OUTPUT -o lo -j ACCEPT if [ -s "$BASEDIR/include/ipv6_custom_trust" ]; then display_c YELLOW "Loading custom IPv6 trust rules..." . "$BASEDIR/include/ipv6_custom_trust" fi for i in $IPV6TRUSTED; do echo -n "$i " $IP6TABLES -A INPUT -s $i -j ACCEPT $IP6TABLES -A OUTPUT -d $i -j ACCEPT done reset_color if [ -s "$BASEDIR/include/ipv6_custom_mssclamp" ]; then display_c YELLOW "Loading custom IPv6 MSS Clamp rules..." . "$BASEDIR/include/ipv6_custom_mssclamp" fi if [ "$CLAMPMSSIPV6" ]; then display_c YELLOW "Clamping IPV6 MSS to PMTU..." for i in $CLAMPMSSIPV6; do $IP6TABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ -j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \ --mss 1280:1536 $IP6TABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN \ -j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \ --mss 1280:1536 # This is necessary to make sure that PMTU works $IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded \ -o $i -j ACCEPT $IP6TABLES -A INPUT -p icmpv6 --icmpv6-type time-exceeded \ -i $i -j ACCEPT $IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big \ -o $i -j ACCEPT $IP6TABLES -A INPUT -p icmpv6 --icmpv6-type packet-too-big \ -i $i -j ACCEPT done fi if [ -s "$BASEDIR/include/ipv6_custom_blockoutports" ]; then display_c YELLOW "Loading custom IPv6 blocked outbound port rules..." . "$BASEDIR/include/ipv6_custom_blockoutports" fi if [ "$BLOCKIPV6TCPPORTS" ] || [ "$BLOCKIPV6UDPPORTS" ]; then display_c YELLOW "Blocking outbound port: " N if [ "$BLOCKIPV6TCPPORTS" ]; then for i in $BLOCKIPV6TCPPORTS; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IP6TABLES -A OUTPUT -p tcp --dport $i --syn -j DROP done fi if [ "$BLOCKIPV6UDPPORTS" ]; then for i in $BLOCKIPV6UDPPORTS; do echo -en "\E[34mUDP\E[37m/\E[32m$i " $IP6TABLES -A OUTPUT -p udp --dport $i -j DROP done fi reset_color fi if [ -s "$BASEDIR/include/ipv6_custom_allowedports" ]; then display_c YELLOW "Loading custom IPv6 allowed port rules..." . "$BASEDIR/include/ipv6_custom_allowedports" fi if [ "$IPV6TCP" ] || [ "$IPV6UDP" ]; then display_c YELLOW "Adding allowed IPv6 port: " N if [ "$IPV6TCP" ]; then for i in $IPV6TCP; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IP6TABLES -A INPUT -p tcp --dport $i -j ACCEPT done fi if [ "$IPV6UDP" ]; then for i in $IPV6UDP; do echo -en "\E[34mUDP\E[37m/\E[32m$i " $IP6TABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT $IP6TABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT $IP6TABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT done fi reset_color fi fi if [ -s "$BASEDIR/include/ipv6_custom_conntrack" ]; then display_c YELLOW "Loading custom IPv6 conntrack rules..." . "$BASEDIR/include/ipv6_custom_conntrack" fi if [ $IPV6ROUTEDCLIENTBLOCK ]; then $IP6TABLES -A INPUT -m state --state NEW -j ACCEPT $IP6TABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IP6TABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT $IP6TABLES -A FORWARD -m state --state NEW -j ACCEPT $IP6TABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IP6TABLES -A OUTPUT -m state --state NEW -j ACCEPT $IP6TABLES -A INPUT -m state --state INVALID -j DROP $IP6TABLES -A OUTPUT -m state --state INVALID -j DROP $IP6TABLES -A FORWARD -m state --state INVALID -j DROP $IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p tcp --syn -j DROP $IP6TABLES -A INPUT -i $IPV6INT -p tcp --syn -j DROP $IP6TABLES -A INPUT -i $IPV6INT -p udp ! --dport 32768:65535 -j DROP $IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p udp ! --dport 32768:65535 -j DROP fi if [ -s "$BASEDIR/include/ipv6_custom_routing" ]; then display_c YELLOW "Loading custom IPv6 routing rules..." . "$BASEDIR/include/ipv6_custom_routing" fi if [ "$IPV6FORWARDRANGE" ]; then for i in $IPV6FORWARDRANGE; do $IP6TABLES -A FORWARD -s $i -j ACCEPT $IP6TABLES -A FORWARD -d $i -j ACCEPT done fi if [ -s "$BASEDIR/include/ipv6_custom_blockincoming" ]; then display_c YELLOW "Loading custom IPv6 incoming blocked port rules..." . "$BASEDIR/include/ipv6_custom_blockincoming" fi if [ $IPV6BLOCKINCOMING ]; then $IP6TABLES -A INPUT -p tcp --syn -j DROP $IP6TABLES -A INPUT -p udp -j DROP fi if [ $TWEAKS ]; then for i in `grep -v "\#" $TWEAKS`; do PROCOPT=( ${i//=/ } ) echo ${PROCOPT[1]} > /proc/sys/net/${PROCOPT[0]} &>/dev/null done fi $BASEDIR/postrun