#!/bin/bash
#
# File: rc.firewall
# Author: Jacob Pipkin
#         <jacob@hivelocity.net>
#
# Date: Fri Apr 28 04:06:09 EDT 2006
# Pungenday, the 45th day of Discord in the YOLD 3172
# ... and updated some time later
#

### variable initialization

# I like to get the ip from ifconfig as it's distro-agnostic and
# connection-type-agnostic
#
if [[ `ifconfig | grep -A 1 eth | grep inet\ addr:` ]]; then
    EXT_IP=`ifconfig | grep -m 1 Bcast | awk '{ print $2 }' | sed s/addr://`
else
    EXT_IP=""
fi

if [[ `which iptables` ]]; then
    IPTABLES=`which iptables`
else
    echo "iptables userspace utility not found. breaking."
    exit 1
fi

# ethernet device
#
ETH="eth0"

# ssh variables
#
SSHD_PORT="22"
SSHD_LISTEN=$EXT_IP

# spoofed source ips and bad source and destination ip's
#
B0RKED_SRC="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/5 255.255.255.255 0.0.0.0/8 169.254.0.0/16 192.0.2.0/24"
B0RKED_DST="0.0.0.0"

# extra chains
#
EXT_CHAINS="drop-log-flags drop-log-spoof drop-log-b0rken drop-log-icmp"

### sane defaults
#
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/secure_redirects
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/ip_forward


case "$1" in

'start')

echo "bringing up firewall"

### initial setup

# default policies
#
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z

# loopback
#
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT


# established, related connections
#
$IPTABLES -A INPUT -i $ETH -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $ETH -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $ETH -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

# create the extra chains
#
for i in $EXT_CHAINS; do
    $IPTABLES -N $i
done


### initial auto-drop-logs

# broadcast, multicast traffic
#
$IPTABLES -A INPUT -m pkttype --pkt-type broadcast -j DROP
$IPTABLES -A INPUT -m pkttype --pkt-type multicast -j DROP

# stealth scans
#
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE          -j drop-log-flags
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL           -j drop-log-flags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN   -j drop-log-flags
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST   -j drop-log-flags
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST   -j drop-log-flags
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,FIN FIN       -j drop-log-flags
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,PSH PSH       -j drop-log-flags
$IPTABLES -A INPUT -p tcp --tcp-flags ACK,URG URG       -j drop-log-flags

# fragmented icmp traffic
#
$IPTABLES -A INPUT -i $ETH -p icmp -f -j drop-log-icmp

### more initial auto-drop-logs

# spoofs
#
$IPTABLES -A INPUT -i $ETH -s 127.0.0.0/8   -j drop-log-spoof
$IPTABLES -A INPUT -i $ETH -s $EXT_IP       -j drop-log-spoof

# other b0rked source addresses
#
for i in $B0RKED_SRC; do
    $IPTABLES -A INPUT -i $ETH -s $i -j drop-log-b0rken
done

# and b0rked destination addresses
#
for i in $B0RKED_DST; do
    $IPTABLES -A INPUT -i $ETH -d $i -j drop-log-b0rken
done

### other accepted connections

# http
#
$IPTABLES -A INPUT -i $ETH -p tcp --dport 80 -s 0/0 -d $EXT_IP -j ACCEPT
for i in $SSL_ALLOWED; do
    $IPTABLES -A INPUT -i $ETH -p tcp --dport 443 -s $i -d $EXT_IP -j ACCEPT
done

# ftp
#
#$IPTABLES -A INPUT -i $ETH -p tcp --dport 21 -s 0/0 -d $EXT_IP -j ACCEPT

# email
#
# $IPTABLES -A INPUT -i $ETH -p tcp --dport 143 -s 0/0 -d $EXT_IP -j ACCEPT

# ssh
#
$IPTABLES -A INPUT -i $ETH -p tcp --dport $SSHD_PORT -s 0/0 \
    -d $SSHD_LISTEN -j ACCEPT

# icmp type 8
$IPTABLES -A INPUT -i $ETH -p icmp --icmp-type 8 -m limit --limit 1/s -j ACCEPT

# drop-logs
#
$IPTABLES -A drop-log-flags -p tcp -j LOG --log-level info \
    --log-prefix "ipt/bad flags: " --log-ip-options --log-tcp-options \
    -m limit --limit 10/s
$IPTABLES -A drop-log-flags -j DROP

$IPTABLES -A drop-log-icmp -p tcp -j LOG --log-level info \
    --log-prefix "ipt/fragged ICMP: " --log-ip-options -m limit --limit 10/s
$IPTABLES -A drop-log-icmp -j DROP

$IPTABLES -A drop-log-spoof -p tcp -j LOG --log-level info \
    --log-prefix "ipt/spoof: " -m limit --limit 10/s
$IPTABLES -A drop-log-spoof -j DROP

$IPTABLES -A drop-log-b0rken -p tcp -j LOG --log-level info \
    --log-prefix "ipt/b0rken: " -m limit --limit 10/s
$IPTABLES -A drop-log-b0rken -j DROP


### final drop-logs
# $IPTABLES -A INPUT -i $ETH -j LOG --log-level info \
#    --log-prefix "firewall/wtf: " -m limit --limit 1/s


;;


'stop')

echo "dropping firewall"
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z

;;


'restart')

$0 stop
$0 start

;;


'panic')

echo "panic button pressed, connection going away"
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z

;;


*)

echo "USAGE: " $0 " start|stop|restart|panic"
esac