#!/bin/bash

#--------------------------------

# IPTABLES configuration script

# by dedicated and YD 

# based on Gentoo iptables script

#--------------------------------

# Version 2.1.3-alone Beta (non-router version)

#--------------------------------

# Copyright (c) 2005 Andrey Galkin

# You may use and redistribute this script under the terms of GNU General Public License version 2 or above.

#--------------------------------

# ChangeLog:

# 2.1

# ADDED: LOCAL_TCP_PORTS & LOCAL_UDP_PORTS

# 2.1.2

# FIXED: tcp protocol in LOCAL_TCP_PORTS

# 2.1.3

# ADDED: Counter-Strike exploit fix

#--------------------------------



#---------------------

# script config

#---------------------

IPT="/sbin/iptables" #for using

#IPT="echo /sbin/iptables" # uncomment for debugging

ID="/usr/bin/id"

SG="/usr/bin/sg"

OF="eth+"

ICMPFREQ="4/sec"



ADMIN_IP="80.233.210.4" #space-separated list of admin ip addresses or nothing to allow any ip



UDP_GAME_PORTS="27000:27060" #space-separated list of game ports (or START_RANGE_PORT:STOP_RAGE_PORT)

TCP_EXTRA_PORTS="8000 8001" #same as above for additional tcp ports with maximum 2 connections per IP



USER_NET_ACCESS="" #space-separated list of users who allowed to make output connections

GROUP_NET_ACCESS="" #space-separated list of groups who allowed to make output connections



LOCAL_UDP_PORTS="" #space-separeted list of udp ports for local connections

LOCAL_TCP_PORTS="" #space-separeted list of tcp ports for local connections





#---------------------

# auto-config

#---------------------

${IPT} -t filter -A INPUT -m connlimit ! --connlimit-above 1 -j ACCEPT > /dev/null 2>&1

if [ $? -eq 0 ];

then

	alias ipt-connlimit="echo -n \"-m connlimit ! --connlimit-above $1\""

else

	echo "!!! No connlimit support, disabling !!!"

	alias ipt-connlimit="echo > /dev/null"

fi



alias getuid="${ID} -u $1"



#---------------------

# Flushing all tables

#---------------------

echo "Flashing Tables..."



${IPT} -t filter -F

${IPT} -t filter -X

${IPT} -t nat -F

${IPT} -t nat -X



#---------------------

# Setting default actions

#---------------------

echo "Setting default built-in chain rules..."

${IPT} -t filter -P FORWARD DROP

${IPT} -t filter -P INPUT   DROP

${IPT} -t filter -P OUTPUT  DROP



#---------------------

# WORLD allowed input

#---------------------

echo "Adding \"world-input\" chain..."

${IPT} -t filter -N world-input

${IPT} -t filter -F world-input



#---------------------

# EXPLOIT FIX

#---------------------

echo "Adding \"Counter-Strike exploit fix\" chain..."

${IPT} -t filter -N exploit-fix

${IPT} -t filter -F exploit-fix

${IPT} -A exploit-fix -m string --algo kmp --string "\\prot\\4\\unique\\0\\raw\\valve" -j DROP

${IPT} -A exploit-fix -m string --algo kmp --string "(..)" -j DROP

#${IPT} -A exploit-fix -j ACCPET





#UDP game ports

for PORT in $UDP_GAME_PORTS;

do

	${IPT} -t filter -A world-input -p udp --dport ${PORT} -j exploit-fix

done



#FTP

${IPT} -t filter -A world-input -p tcp --dport ftp `ipt-connlimit 2` -j ACCEPT



#SSH

if [[ -z $ADMIN_IP ]];

then

	echo "! Anyone can connect to the sshd !"

	${IPT} -t filter -A world-input -p tcp --dport ssh -j ACCEPT

else

	for IP in $ADMIN_IP;

	do

		${IPT} -t filter -A world-input -p tcp -s ${IP} --dport ssh -j ACCEPT

	done

fi



#WWW

${IPT} -t filter -A world-input -p tcp --dport http `ipt-connlimit 4` -j ACCEPT



#MAIL

#${IPT} -t filter -A world-input -p tcp --dport pop3 `ipt-connlimit 2` -j ACCEPT

${IPT} -t filter -A world-input -p tcp --dport imap `ipt-connlimit 2` -j ACCEPT

${IPT} -t filter -A world-input -p tcp --dport smtp `ipt-connlimit 2` -j ACCEPT



#DNS

${IPT} -t filter -A world-input -p udp --dport domain -j ACCEPT

${IPT} -t filter -A world-input -p tcp --dport domain `ipt-connlimit 2` -j ACCEPT



#extra tcp ports

for PORT in $TCP_EXTRA_PORTS;

do

	${IPT} -t filter -A world-input -p tcp --dport ${PORT} `ipt-connlimit 2` -j ACCEPT

done



#---------------------

# LOCAL allowed input

#---------------------

echo "Adding \"local-input\" chain..."

${IPT} -t filter -N local-input

${IPT} -t filter -F local-input



if [[ -n $LOCAL_UDP_PORTS ]];

then

	for PORT in $LOCAL_UDP_PORTS;

	do

		${IPT} -t filter -A local-input -p udp --dport ${PORT} -j ACCEPT

	done

fi



if [[ -n $LOCAL_TCP_PORTS ]];

then

	for PORT in $LOCAL_TCP_PORTS;

	do

		${IPT} -t filter -A local-input -p tcp --dport ${PORT} -j ACCEPT

	done

fi



#---------------------

# WORLD allowed output

#---------------------

echo "Adding \"world-output\" chain..."

${IPT} -t filter -N world-output

${IPT} -t filter -F world-output



${IPT} -t filter -A world-output -p udp --dport domain -j ACCEPT

${IPT} -t filter -A world-output -p tcp --dport domain -j ACCEPT



#---------------------

# USER NET ACCESS

#---------------------

echo "Adding \"user-net-access\" chain..."

${IPT} -t filter -N user-net-access

${IPT} -t filter -F user-net-access



if [[ -z $USER_NET_ACCESS ]];

then

	echo "! Every user can make output connections !"

	${IPT} -t filter -A user-net-access -j ACCEPT

else

	for U in $USER_NET_ACCESS;

	do

		${IPT} -t filter -A user-net-access -m owner --uid-owner `getuid ${U}` -j ACCEPT

	done

fi



for G in $GROUP_NET_ACCESS;

do

	${IPT} -t filter -A user-net-access -m owner --gid-owner `${SG} - $G -c "${ID} -g"` -j ACCEPT

done



#---------------------

# ICMP ALLOWED

#---------------------

echo "Adding \"icmp-allowed\" chain..."

${IPT} -t filter -N icmp_allowed

${IPT} -t filter -F icmp_allowed



${IPT} -t filter -A icmp_allowed -p icmp --icmp-type echo-reply -m limit --limit ${ICMPFREQ} -j ACCEPT

${IPT} -t filter -A icmp_allowed -p icmp --icmp-type echo-request -m limit --limit ${ICMPFREQ} -j ACCEPT

${IPT} -t filter -A icmp_allowed -p icmp --icmp-type time-exceeded -m limit --limit ${ICMPFREQ} -j ACCEPT

${IPT} -t filter -A icmp_allowed -p icmp --icmp-type destination-unreachable -m limit --limit ${ICMPFREQ} -j ACCEPT

${IPT} -t filter -A icmp_allowed -p icmp -j DROP



#---------------------

# Flags checking (from gentoo iptables guide)

#---------------------

echo "Adding \"check-tcp-flags\" chain..."

${IPT} -t filter -N check-tcp-flags

${IPT} -t filter -F check-tcp-flags

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \

      --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL ALL -m limit --limit \

      5/minute -j LOG --log-level 1 --log-prefix "XMAS:"

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL ALL -j DROP

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG \

     -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL NONE -m limit \

     --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags ALL NONE -j DROP

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit \

     --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \

      --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"

${IPT} -t filter -A check-tcp-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP



#---------------------

# INPUT CHAIN

#---------------------

echo "Adding \"INPUT\" chain..."

${IPT} -t filter -A INPUT -m state --state INVALID -j DROP

${IPT} -t filter -A INPUT -p tcp -j check-tcp-flags

${IPT} -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

${IPT} -t filter -A INPUT -i lo -j local-input

${IPT} -t filter -A INPUT -j icmp_allowed

${IPT} -t filter -A INPUT -i ${OF} -j world-input



#---------------------

# OUTPUT CHAIN

#---------------------

echo "Adding \"OUTPUT\" chain..."

${IPT} -t filter -A OUTPUT -m state --state INVALID -j DROP

${IPT} -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

${IPT} -t filter -A OUTPUT -j user-net-access

${IPT} -t filter -A OUTPUT -o lo -d 127.0.0.0/8 -j ACCEPT

${IPT} -t filter -A OUTPUT -o ${OF} -j world-output





#--------------------

# after config

#--------------------

unalias ipt-connlimit

unalias getuid