#/bin/bash # v0.9 # By Brielle Bruns # URL: http://www.sosdg.org/freestuff/firewall # License: GPLv3 echo -e "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=" echo -e "SOSDG/Firewall v0.9" echo -e "Brielle Bruns " echo -e "http://www.sosdg.org/freestuff/firewall" echo -e "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n" BASEDIR=/etc/firewall-sosdg TWEAKS=$BASEDIR/tweaks #BASEDIR=`pwd` . $BASEDIR/options $IPTABLES --flush &>/dev/null $IPTABLES -F OUTPUT &>/dev/null $IPTABLES -F PREROUTING &>/dev/null $IPTABLES -F POSTROUTING &>/dev/null $IPTABLES -F -t mangle &>/dev/null if [ $NAT ]; then $IPTABLES -F -t nat &>/dev/null fi $IPTABLES -F -t raw &>/dev/null $BASEDIR/prerun $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT if [ "$TRUSTEDIP" ]; then echo -ne "\E[33mAdding trusted IP:\E[37m " for i in $TRUSTEDIP; do echo -n "$i " $IPTABLES -A INPUT -s $i -j ACCEPT $IPTABLES -A OUTPUT -d $i -j ACCEPT done echo -ne "\n" fi if [ $BLOCKEDIP ]; then echo -en "\E[33mAdding blocked IPs:\E[37m " for i in `grep -v "\#" $BLOCKEDIP`; do echo -n "$i " $IPTABLES -A INPUT -s $i -j DROP $IPTABLES -A OUTPUT -d $i -j DROP done echo -ne "\n" fi if [ "$STRIPECN" ]; then echo -en "\E[33mStripping ECN off of TCP packets to \E[37m" for i in $STRIPECN; do echo -en "$i " $IPTABLES -A PREROUTING -t mangle -p tcp -d $i -j ECN \ --ecn-tcp-remove done echo -ne "\n" fi if [ "$CLAMPMSS" ]; then echo -e "\E[33mClamping MSS to PMTU...\E[37m" for i in $CLAMPMSS; do $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \ --clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536 $IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \ --clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536 # This is necessary to make sure that PMTU works $IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded \ -o $i -j ACCEPT $IPTABLES -A INPUT -p icmp --icmp-type time-exceeded \ -i $i -j ACCEPT $IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \ -o $i -j ACCEPT $IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed \ -i $i -j ACCEPT done echo -en "\n" fi $IPTABLES -A INPUT -j DROP -p udp --dport domain -m u32 --u32 \ "0>>22&0x3C@12>>16=1&&0>>22&0x3C@20>>24=0&&0>>22&0x3C@21=0x00020001" if [ $CONNTRACK ]; then $IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A INPUT -m state --state INVALID -j DROP $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A OUTPUT -m state --state NEW -j ACCEPT fi if [ "$BLOCKTCPPORTS" ] || [ "$BLOCKUDPPORTS" ]; then echo -en "\E[33mBlocking outbound port:\E[37m " if [ "$BLOCKTCPPORTS" ]; then for i in $BLOCKTCPPORTS; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IPTABLES -A OUTPUT -p tcp --dport $i --syn -j DROP if [ "$NATRANGE" ]; then for i in $NATRANGE; do $IPTABLES -A FORWARD -p tcp -s $i --dport $i --syn -j DROP done fi done fi if [ "$BLOCKUDPPORTS" ]; then for i in $BLOCKUDPPORTS; do echo -en "\E[34mUDP\E[37m/\E[32m$i " $IPTABLES -A OUTPUT -p udp --dport $i -j DROP if [ "$NATRANGE" ]; then for i in $NATRANGE; do $IPTABLES -A FORWARD -p udp -s $i --dport $i -j DROP done fi done fi echo -en "\n" fi if [ "$TCPPORTS" ] || [ "$UDPPORTS" ]; then echo -en "\E[33mAdding allowed port:\E[37m " if [ "$TCPPORTS" ]; then for i in $TCPPORTS; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT done fi if [ "$UDPPORTS" ]; then for i in $UDPPORTS; do echo -en "\E[34mUDP\E[37m/\E[32m$i " #$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT $IPTABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT $IPTABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT $IPTABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT done fi echo -en "\n\E[37m" fi if [ "$ALLOWEDPROTO" ]; then echo -en "\E[33mAdding allowed protocols:\E[37m " for i in $ALLOWEDPROTO; do echo -n "$i " $IPTABLES -A INPUT -p $i -j ACCEPT $IPTABLES -A OUTPUT -p $i -j ACCEPT done echo -en "\n\E[37m" fi if [ $CONNTRACK ]; then for i in $DONTTRACK; do $IPTABLES -t raw -I PREROUTING -s $i -j NOTRACK $IPTABLES -t raw -I PREROUTING -d $i -j NOTRACK $IPTABLES -t raw -I OUTPUT -s $i -j NOTRACK $IPTABLES -t raw -I OUTPUT -d $i -j NOTRACK done fi if [ $ROUTING ]; then echo -en "\E[33mAdding route:\E[37m " for i in `grep -v "\#" $ROUTING`; do ROUTE=( ${i//:/ } ) FWINT1=${ROUTE[0]} FWINT2=${ROUTE[2]} FWIP1=${ROUTE[1]} FWIP2=${ROUTE[3]} if [ -e "/proc/sys/net/ipv4/conf/$FWINT1/forwarding" ]; then echo 1 > /proc/sys/net/ipv4/conf/$FWINT1/forwarding fi if [ -e "/proc/sys/net/ipv4/conf/$FWINT2/forwarding" ]; then echo 1 > /proc/sys/net/ipv4/conf/$FWINT2/forwarding fi $IPTABLES -A FORWARD -i $FWINT1 -o $FWINT2 \ -s $FWIP1 -d $FWIP2 -j ACCEPT if [ ${ROUTE[4]} == "1" ]; then echo -en "\E[35m$FWINT1\E[37m:$FWIP1<->\E[34m$FWINT2\E[37m:$FWIP2 " $IPTABLES -A FORWARD -o $FWINT1 -i $FWINT2 \ -d $FWIP1 -s $FWIP2 -j ACCEPT else echo -n "$FWINT1:$FWIP1->$FWINT2:$FWIP2 " fi done echo -ne "\n" fi if [ $PORTFW ] && [ $NAT ]; then echo -en "\E[33mAdding port forward for:\E[37m " for i in `grep -v "\#" $PORTFW`; do PORTADD=( ${i//:/ } ) $IPTABLES -A PREROUTING -t nat -i $NATEXTIF -p ${PORTADD[1]} \ --dport ${PORTADD[0]} -j DNAT --to \ ${PORTADD[2]}:${PORTADD[3]} $IPTABLES -A INPUT -p ${PORTADD[1]} -m state --state NEW \ --dport ${PORTADD[0]} -i $NATEXTIF -j ACCEPT echo -en "\E[32m${PORTADD[0]}\E[37m/\E[35m${PORTADD[1]}\E[37m->${PORTADD[2]}:${PORTADD[3]} " done echo -ne "\n" fi if [ $LANDHCPSERVER ]; then $IPTABLES -A INPUT -i $INTIF -s 0.0.0.0 -j ACCEPT fi if [ $NAT ]; then for i in $NATRANGE; do $IPTABLES -A POSTROUTING -t nat -s $i -o $NATEXTIF -j SNAT --to-source $NATEXTIP done # This is necessary to make sure that PMTU works $IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o $NATEXTIF \ -j ACCEPT $IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \ -o $NATEXTIF -j ACCEPT fi $IPTABLES --policy INPUT ACCEPT $IPTABLES --policy OUTPUT ACCEPT $IPTABLES --policy FORWARD DROP if [ $BLOCKINCOMING ]; then $IPTABLES -A INPUT -p tcp --syn -j DROP $IPTABLES -A INPUT -p udp -j DROP fi #================[IPv6]================ if [ $IPV6 ]; then $IP6TABLES --flush &>/dev/null $IP6TABLES -F OUTPUT &>/dev/null $IP6TABLES -F PREROUTING &>/dev/null $IP6TABLES -F POSTROUTING &>/dev/null echo -ne "\E[33mAdding trusted IPv6:\E[37m " $IP6TABLES -A INPUT -i lo -j ACCEPT $IP6TABLES -A OUTPUT -o lo -j ACCEPT for i in $IPV6TRUSTED; do echo -n "$i " $IP6TABLES -A INPUT -s $i -j ACCEPT $IP6TABLES -A OUTPUT -d $i -j ACCEPT done echo -ne "\n\E[37m" if [ "$CLAMPMSSIPV6" ]; then echo -e "\E[33mClamping IPV6 MSS to PMTU...\E[37m" for i in $CLAMPMSSIPV6; do $IP6TABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN \ -j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \ --mss 1280:1536 $IP6TABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN \ -j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \ --mss 1280:1536 # This is necessary to make sure that PMTU works $IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded \ -o $i -j ACCEPT $IP6TABLES -A INPUT -p icmpv6 --icmpv6-type time-exceeded \ -i $i -j ACCEPT $IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big \ -o $i -j ACCEPT $IP6TABLES -A INPUT -p icmpv6 --icmpv6-type packet-too-big \ -i $i -j ACCEPT done fi if [ "$BLOCKIPV6TCPPORTS" ] || [ "$BLOCKIPV6UDPPORTS" ]; then echo -en "\E[33mBlocking outbound port:\E[37m " if [ "$BLOCKIPV6TCPPORTS" ]; then for i in $BLOCKIPV6TCPPORTS; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IP6TABLES -A OUTPUT -p tcp --dport $i --syn -j DROP done fi if [ "$BLOCKIPV6UDPPORTS" ]; then for i in $BLOCKIPV6UDPPORTS; do echo -en "\E[34mUDP\E[37m/\E[32m$i " $IP6TABLES -A OUTPUT -p udp --dport $i -j DROP done fi echo -en "\n\E[37m" fi if [ "$IPV6TCP" ] || [ "$IPV6UDP" ]; then echo -en "\E[33mAdding allowed IPv6 port:\E[37m " if [ "$IPV6TCP" ]; then for i in $IPV6TCP; do echo -en "\E[35mTCP\E[37m/\E[32m$i " $IP6TABLES -A INPUT -p tcp --dport $i -j ACCEPT done fi if [ "$IPV6UDP" ]; then for i in $IPV6UDP; do echo -en "\E[34mUDP\E[37m/\E[32m$i " $IP6TABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT $IP6TABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT $IP6TABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT done fi echo -en "\n\E[37m" fi fi if [ $IPV6ROUTEDCLIENTBLOCK ]; then $IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IP6TABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IP6TABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT $IP6TABLES -A OUTPUT -m state --state NEW -j ACCEPT $IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p tcp --syn -j DROP $IP6TABLES -A INPUT -i $IPV6INT -p tcp --syn -j DROP $IP6TABLES -A INPUT -i $IPV6INT -p udp ! --dport 32768:65535 -j DROP $IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p udp ! --dport 32768:65535 -j DROP fi if [ $IPV6FORWARDRANGE ]; then for i in $IPV6FORWARDRANGE; do $IP6TABLES -A FORWARD -s $i -j ACCEPT $IP6TABLES -A FORWARD -d $i -j ACCEPT done fi if [ $IPV6BLOCKINCOMING ]; then $IP6TABLES -A INPUT -p tcp --syn -j DROP $IP6TABLES -A INPUT -p udp -j DROP fi if [ $TWEAKS ]; then for i in `grep -v "\#" $TWEAKS`; do PROCOPT=( ${i//=/ } ) echo ${PROCOPT[1]} > /proc/sys/net/${PROCOPT[0]} &>/dev/null done fi $BASEDIR/postrun