Firewall-SOSDG/rc.firewall

#/bin/bash
# v0.7
# By Brielle Bruns <bruns@2mbit.com>
# URL: http://www.sosdg.org/freestuff/firewall
# License: GPLv3

BASEDIR=/etc/firewall-sosdg
TWEAKS=$BASEDIR/tweaks
#BASEDIR=`pwd`

. $BASEDIR/options

$IPTABLES --flush &>/dev/null
$IPTABLES -F OUTPUT &>/dev/null
$IPTABLES -F PREROUTING &>/dev/null
$IPTABLES -F POSTROUTING &>/dev/null
if [ $NAT ]; then
	$IPTABLES -F -t nat &>/dev/null
fi
$IPTABLES -F -t raw &>/dev/null

$BASEDIR/prerun

$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

echo -n "Adding trusted IP: "

for i in $TRUSTEDIP; do
	echo -n "$i "
	$IPTABLES -A INPUT -s $i -j ACCEPT
	$IPTABLES -A OUTPUT -d $i -j ACCEPT
done
echo -ne "\n"


if [ $BLOCKEDIP ]; then
	echo -n "Adding blocked IPs: "
	for i in `grep -v "\#" $BLOCKEDIP`; do
		echo -n "$i "
		$IPTABLES -A INPUT -s $i -j DROP
		$IPTABLES -A OUTPUT -d $i -j DROP
	done
echo -ne "\n"
fi

if [ "$STRIPECN" ]; then
	for i in $STRIPECN; do
		echo "Stripping ECN off of TCP packets to $i"
		$IPTABLES -A PREROUTING -t mangle -p tcp -d $i -j ECN \
			--ecn-tcp-remove
	done
echo -ne "\n"
fi


if [ "$CLAMPMSS" ]; then
	echo "Clamping MSS to PMTU..."
	for i in $CLAMPMSS; do
		$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
			--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
		$IPTABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
			--clamp-mss-to-pmtu -o $i -m tcpmss --mss 1400:1536
		# This is necessary to make sure that PMTU works
		$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded \
			-o $i -j ACCEPT
		$IPTABLES -A INPUT -p icmp --icmp-type time-exceeded \
			-i $i -j ACCEPT
		$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
			-o $i -j ACCEPT
		$IPTABLES -A INPUT -p icmp --icmp-type fragmentation-needed \
			-i $i -j ACCEPT
	done
fi
echo -en "\n"

$IPTABLES -A INPUT -j DROP -p udp --dport domain -m u32 --u32 \
"0>>22&0x3C@12>>16=1&&0>>22&0x3C@20>>24=0&&0>>22&0x3C@21=0x00020001"

if [ $CONNTRACK ]; then
	$IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT
	$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
	$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
	$IPTABLES -A INPUT -m state --state INVALID -j DROP
	$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
	$IPTABLES -A OUTPUT -m state --state NEW -j ACCEPT
fi

echo -n "Adding allowed port: "

for i in $TCPPORTS; do
	echo -n "TCP/$i "
	$IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT
done

for i in $UDPPORTS; do
	echo -n "UDP/$i "
	#$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT
	$IPTABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
        $IPTABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
        $IPTABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
done
echo -en "\n"

echo -n "Adding allowed protocols: "

for i in $ALLOWEDPROTO; do
	echo -n "$i "
	$IPTABLES -A INPUT -p $i -j ACCEPT
	$IPTABLES -A OUTPUT -p $i -j ACCEPT
done
echo -en "\n"


if [ $CONNTRACK ]; then
	for i in $DONTTRACK; do
		$IPTABLES -t raw -I PREROUTING -s $i -j NOTRACK
		$IPTABLES -t raw -I PREROUTING -d $i -j NOTRACK
		$IPTABLES -t raw -I OUTPUT -s $i -j NOTRACK
		$IPTABLES -t raw -I OUTPUT -d $i -j NOTRACK
	done
fi

echo -n "Adding route: "

if [ $ROUTING ]; then
	for i in `grep -v "\#" $ROUTING`; do
		ROUTE=( ${i//:/ } )
		FWINT1=${ROUTE[0]}
		FWINT2=${ROUTE[2]}
		FWIP1=${ROUTE[1]}
		FWIP2=${ROUTE[3]}
		echo 1 > /proc/sys/net/ipv4/conf/$FWINT1/forwarding
		echo 1 > /proc/sys/net/ipv4/conf/$FWINT2/forwarding
		$IPTABLES -A FORWARD -i $FWINT1 -o $FWINT2 \
			-s $FWIP1 -d $FWIP2 -j ACCEPT
		if [ ${ROUTE[4]} == "1" ]; then
			echo -n "$FWINT1:$FWIP1<->$FWINT2:$FWIP2 "
 			$IPTABLES -A FORWARD -o $FWINT1 -i $FWINT2 \
				-d $FWIP1 -s $FWIP2 -j ACCEPT
		else
			echo -n "$FWINT1:$FWIP1->$FWINT2:$FWIP2 "
	fi
	done
fi

echo -ne "\n"

if [ $PORTFW ] && [ $NAT ]; then
	for i in `grep -v "\#" $PORTFW`; do
		PORTADD=( ${i//:/ } )
		echo "Adding port forward for ext port ${PORTADD[0]}/${PORTADD[1]} to ${PORTADD[2]}:${PORTADD[3]}"
		$IPTABLES -A PREROUTING -t nat -i $NATEXTIF -p ${PORTADD[1]} \
			--dport ${PORTADD[0]} -j DNAT --to \
			${PORTADD[2]}:${PORTADD[3]}
		$IPTABLES -A INPUT -p ${PORTADD[1]} -m state --state NEW \
			--dport ${PORTADD[0]} -i $NATEXTIF -j ACCEPT

	done
fi

if [ $LANDHCPSERVER ]; then
	$IPTABLES -A INPUT -i $INTIF -s 0.0.0.0 -j ACCEPT
fi





if [ $NAT ]; then
	for i in $NATRANGE; do
		$IPTABLES -A POSTROUTING -t nat -s $i -o $NATEXTIF -j SNAT --to-source $NATEXTIP
	done
	# This is necessary to make sure that PMTU works
	$IPTABLES -A OUTPUT -p icmp --icmp-type time-exceeded -o $NATEXTIF \
			-j ACCEPT
	$IPTABLES -A OUTPUT -p icmp --icmp-type fragmentation-needed \
			-o $NATEXTIF -j ACCEPT
fi

$IPTABLES --policy INPUT ACCEPT
$IPTABLES --policy OUTPUT ACCEPT
$IPTABLES --policy FORWARD DROP

if [ $BLOCKINCOMING ]; then
		$IPTABLES -A INPUT -p tcp --syn -j DROP
		$IPTABLES -A INPUT -p udp -j DROP
fi


#================[IPv6]================
if [ $IPV6 ]; then
	$IP6TABLES --flush &>/dev/null
	$IP6TABLES -F OUTPUT &>/dev/null
	$IP6TABLES -F PREROUTING &>/dev/null
	$IP6TABLES -F POSTROUTING &>/dev/null

	echo -n "Adding trusted IPv6: "

	$IP6TABLES -A INPUT -i lo -j ACCEPT
	$IP6TABLES -A OUTPUT -o lo -j ACCEPT

	for i in $IPV6TRUSTED; do
		echo -n "$i "
		$IP6TABLES -A INPUT -s $i -j ACCEPT
		$IP6TABLES -A OUTPUT -d $i -j ACCEPT
	done
	echo -ne "\n"


	if [ "$CLAMPMSSIPV6" ]; then
		echo "Clamping IPV6 MSS to PMTU..."
		for i in $CLAMPMSSIPV6; do
			$IP6TABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
			-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
			--mss 1280:1536
			$IP6TABLES -A OUTPUT -p tcp --tcp-flags SYN,RST SYN \
			-j TCPMSS --clamp-mss-to-pmtu -o $i -m tcpmss \
			--mss 1280:1536
			# This is necessary to make sure that PMTU works
			$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded \
			-o $i -j ACCEPT
			$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type time-exceeded \
			-i $i -j ACCEPT
			$IP6TABLES -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big \
			-o $i -j ACCEPT
			$IP6TABLES -A INPUT -p icmpv6 --icmpv6-type packet-too-big \
			-i $i -j ACCEPT
		done
	fi
	echo -n "Adding allowed IPv6 port: "

	for i in $IPV6TCP; do
		echo -n "TCP/$i "
		$IP6TABLES -A INPUT -p tcp --dport $i -j ACCEPT
	done

	for i in $IPV6UDP; do
		echo -n "UDP/$i "
		$IP6TABLES -A OUTPUT -p udp --sport 1:65535 --dport $i -j ACCEPT
	        $IP6TABLES -A INPUT -p udp --dport $i --sport 1:65535 -j ACCEPT
        	$IP6TABLES -A INPUT -p udp --sport $i --dport 1:65535 -j ACCEPT
	done
	echo -en "\n"

	if [ $IPV6ROUTEDCLIENTBLOCK ]; then
		$IP6TABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
		$IP6TABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
	        $IP6TABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
        	$IP6TABLES -A OUTPUT -m state --state NEW -j ACCEPT
		$IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p tcp --syn -j DROP
		$IP6TABLES -A INPUT -i $IPV6INT -p tcp --syn -j DROP
		$IP6TABLES -A INPUT -i $IPV6INT -p udp ! --dport 32768:65535 -j DROP
		$IP6TABLES -A FORWARD -i $IPV6INT -o $IPV6LAN -p udp ! --dport 32768:65535 -j DROP
	fi
	


	if [ $IPV6FORWARDRANGE ]; then
		for i in $IPV6FORWARDRANGE; do
			$IP6TABLES -A FORWARD -s $i -j ACCEPT
			$IP6TABLES -A FORWARD -d $i -j ACCEPT
		done
	fi
	
	if [ $IPV6BLOCKINCOMING ]; then
		$IP6TABLES -A INPUT -p tcp --syn -j DROP
		$IP6TABLES -A INPUT -p udp -j DROP
	fi
fi

if [ $TWEAKS ]; then
	for i in `grep -v "\#" $TWEAKS`; do
		PROCOPT=( ${i//=/ } )
		echo ${PROCOPT[1]} > /proc/sys/net/${PROCOPT[0]} &>/dev/null
	done
fi

$BASEDIR/postrun