#!/bin/sh
#
# iptables rules for central de vendas em informatica ltda.
#

iptables=`which iptables`
modprobe=`which modprobe`

#
# some network definitions.
#
central_ext = "eth0"
central_ext_ip = "201.12.35.51"
central_int = "eth1"
central_int_net = "192.168.1.0/24"

odin_int = "192.168.1.134"
odin_ext = "201.12.35.52"

saint_int = "192.168.1.53"
saint_ext = "201.12.35.54"
saint_net = "200.230.207.0/24"

sicredi_ext_ip = "201.77.95.20"
sicredi_net = "172.16.0.0/12"

#
# Some proc definitions.
#

# Drop connections from non-routable IPs.
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do 
	echo 1 > $i
done

# Don't accept source routed packets.
for interface in /proc/sys/net/ipv4/conf/*/accept_source_route; do
	 echo 0 > $interface
done

# Enable syn-flood protection.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Log martians.
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

# Ignore ICMP redirect messages.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

# Enable IP forwarding.
echo 1 > /proc/sys/net/ipv4/ip_forward

# Reduce some timeouts.
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time

# Fix some issues with DNS.
echo 60 > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout

# Set local port range.
echo "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range

#
# Flush iptables.
#

# Attempt to flush all rules in filter table.
$iptables -F
$iptables -X
  
# Flush built-in rules.
$iptables -F INPUT
$iptables -F OUTPUT
$iptables -F FORWARD
$iptables -t nat -F 2>/dev/null
$iptables -t nat -X 2>/dev/null
$iptables -t mangle -F 2>/dev/null
$iptables -t mangle -X 2>/dev/null

# Set default policy.
$iptables -P INPUT DROP
$iptables -P FORWARD DROP
$iptables -P OUTPUT ACCEPT

$iptables -t nat -P POSTROUTING ACCEPT 2>/dev/null
$iptables -t nat -P PREROUTING ACCEPT 2>/dev/null

$iptables -t mangle -P OUTPUT ACCEPT 2>/dev/null
$iptables -t mangle -P PREROUTING ACCEPT 2>/dev/null

# Reset iptables counters.
$iptables -Z
$iptables -t nat -Z 2>/dev/null
$iptables -t mangle -Z 2>/dev/null

#
# Chain VALID - Check for invalid flags.
#

# Create the chain.
$iptables -N VALID

# Limit/Log first.

# (NMAP) FIN/URG/PSH.
$iptables -A VALID -p tcp --tcp-flags ALL FIN,URG,PSH \
-m limit --limit 3/m --limit-burst 5 -j LOG --log-level $LOGLEVEL --log-prefix "Stealth XMAS scan: "

# SYN/RST/ACK/FIN/URG.
$iptables -A VALID -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \
-m limit --limit 3/m --limit-burst 5 -j LOG --log-level $LOGLEVEL --log-prefix "Stealth XMAS-PSH scan: "

# ALL/ALL.
$iptables -A VALID -p tcp --tcp-flags ALL ALL \
-m limit --limit 3/m --limit-burst 5 -j LOG --log-level $LOGLEVEL --log-prefix "Stealth XMAS-ALL scan: "

# NMAP FIN Stealth.
$iptables -A VALID -p tcp --tcp-flags ALL FIN \
-m limit --limit 3/m --limit-burst 5 -j LOG --log-level $LOGLEVEL --log-prefix "Stealth FIN scan: "

# SYN/RST.
$iptables -A VALID -p tcp --tcp-flags SYN,RST SYN,RST \
-m limit --limit 3/m --limit-burst 5 -j LOG --log-level $LOGLEVEL --log-prefix "Stealth SYN/RST scan: "

# SYN/FIN (probably).
$iptables -A VALID -p tcp --tcp-flags SYN,FIN SYN,FIN \
-m limit --limit 3/m --limit-burst 5 -j LOG --log-level $LOGLEVEL --log-prefix "Stealth SYN/FIN scan(?): "

# Null scan.
$iptables -A VALID -p tcp --tcp-flags ALL NONE \
-m limit --limit 3/m --limit-burst 5 -j LOG --log-level $LOGLEVEL --log-prefix "Stealth Null scan: "

# Bad flags.
$iptables -A VALID -p tcp --tcp-option 64 \
-m limit --limit 3/m --limit-burst 1 -j LOG --log-level $LOGLEVEL --log-prefix "Bad TCP flag(64): "
$iptables -A VALID -p tcp --tcp-option 128 \
-m limit --limit 3/m --limit-burst 1 -j LOG --log-level $LOGLEVEL --log-prefix "Bad TCP flag(128): "

# Drop them.

# NMAP FIN/URG/PSH.
$iptables -A VALID -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

# SYN/RST/ACK/FIN/URG.
$iptables -A VALID -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

# ALL/ALL Scan.
$iptables -A VALID -p tcp --tcp-flags ALL ALL -j DROP

# NMAP FIN Stealth.
$iptables -A VALID -p tcp --tcp-flags ALL FIN -j DROP

# SYN/RST.
$iptables -A VALID -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# SYN/FIN -- Scan(probably).
$iptables -A VALID -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# NMAP Null Scan.
$iptables -A VALID -p tcp --tcp-flags ALL NONE -j DROP

# Bad flags.
$iptables -A VALID -p tcp --tcp-option 64 -j DROP
$iptables -A VALID -p tcp --tcp-option 128 -j DROP