!/bin/bash


LOC="192.168.11.0/24"
INIF="eth1"
INIP="192.168.11.10"
BROADCAST="192.168.11.255"
LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="240.0.0.0/4"
P_PORTS="0:1023"
UP_PORTS="1024:65535"
TR_SRC_PORTS="32769:65535"
TR_DEST_PORTS="33434:33523"




# First we need to clear up any existing firewall rules
# and chain which might have been created

iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t mangle
iptables -F -t nat
iptables -X



# Default policies: Drop any incoming packets
# accept the rest.
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

# Disable response to ping:
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

# Disable response to broadcasts:
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Enable TCP SYN cookies:
/bin/echo "1" > /proc/sys/net/ipv4/tcp_syncookies

# Enable bad error messages protection:
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

# Disable IP forwarding:
/bin/echo "0" > /proc/sys/net/ipv4/ip_forward

for interface in /proc/sys/net/ipv4/conf/*
do
    echo "0" > ${interface}/send_redirects
    echo "0" > ${interface}/accept_redirects
    echo "1" > ${interface}/secure_redirects
    echo "0" > ${interface}/accept_source_route
    echo "0" > ${interface}/bootp_relay
    echo "0" > ${interface}/proxy_arp
    echo "1" > ${interface}/log_martians
    echo "1" > ${interface}/rp_filter
done

# Accept any connections from the local machine
iptables -A INPUT -i lo -j ACCEPT

# Here we define a new chain which is going to handle
# packets we don't want to respond to
# limit the amount of logs to 10/min
iptables -N Firewall
iptables -A Firewall -m limit --limit 10/minute -j LOG --log-prefix "Firewall: "
iptables -A Firewall -j DROP

# log those packets and inform the sender that the packet was rejected
iptables -N Rejectwall
iptables -A Rejectwall -m limit --limit 10/minute -j LOG --log-prefix "Rejectwall: "
iptables -A Rejectwall -j REJECT

# log those packets and inform the sender that the packet was rejected
iptables -N Dropwall
iptables -A Dropwall -m limit --limit 10/minute -j LOG --log-prefix "Dropwall: "
iptables -A Dropwall -j DROP

iptables -N Badflags
iptables -A Badflags -m limit --limit 10/minute -j LOG --log-prefix "Badflags: "
iptables -A Badflags -j DROP



# A list of well known combination of Bad TCP flags
# we redirect those to the Badflags chain
# which is going to handle them (log and drop)
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j Badflags
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j Badflags
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j Badflags
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j Badflags
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j Badflags
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j Badflags
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j Badflags




# Syn flood protection:
#
# Maximize the rate of incoming connections. In order to do this
# we divert tcp packets with the SYN bit set off to a user-defined
# chain. Up to limit-burst connections can arrive in 1/limit
# seconds; in this case 4 connections in one second. After this,
# one of the burst is regained every second and connections are
# allowed again. The default limit is 3/hour. The default limit
# burst is 5.
#
iptables -N syn-flood
iptables -A INPUT -i $INIF -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j LOG --log-prefix "$INIF Input TCP Syn Flood: "
iptables -A syn-flood -j DROP

# New tcp connections must be made with Syn packets:
iptables -A INPUT -i $INIF -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "$INIF Input TCP Syn: "
iptables -A INPUT -i $INIF -p tcp ! --syn -m state --state NEW -j DROP


# Refuse spoofed packets pretending to be from the INIP IP
# address:
#    iptables -A INPUT -i $INIF -s $INIP -j LOG --log-prefix "$INIF Input Spoof: "
#    iptables -A INPUT -i $INIF -s $INIP -j DROP

# Refuse packets claiming to be from a Class A private network:
iptables -A INPUT -i $INIF -s $CLASS_A -j LOG --log-prefix "$INIF Input Class A Private: "
iptables -A INPUT -i $INIF -s $CLASS_A -j DROP

# Refuse packets claiming to be from a Class B private network,
# (INNET is a Class B private network-its commented out):
iptables -A INPUT -i $INIF -s $CLASS_B -j LOG --log-prefix "$INIF Input Class B Private: "
iptables -A INPUT -i $INIF -s $CLASS_B -j DROP

# Refuse packets claiming to be from a Class C private network:
#    iptables -A INPUT -i $INIF -s $CLASS_C -j LOG --log-prefix "$INIF Input Class C Private: "
#    iptables -A INPUT -i $INIF -s $CLASS_C -j DROP


# Refuse Class D multicast addresses. Multicast is illegal as a
# source address:
iptables -A INPUT -i $INIF -s $CLASS_D_MULTICAST -j LOG --log-prefix "$INIF Input Multicast: "
iptables -A INPUT -i $INIF -s $CLASS_D_MULTICAST -j DROP

# Refuse Class E reserved IP addresses:
iptables -A INPUT -i $INIF -s $CLASS_E_RESERVED_NET -j LOG --log-prefix "$INIF Input Class E: "
iptables -A INPUT -i $INIF -s $CLASS_E_RESERVED_NET -j DROP

# Refuse packets claiming to be to the loopback interface:
iptables -A INPUT -i $INIF -d $LOOPBACK -j LOG --log-prefix "$INIF Input Loopback Spoof: "
iptables -A INPUT -i $INIF -d $LOOPBACK -j DROP

# Refuse broadcast address packets:
#    iptables -A INPUT -i $INIF -d $BROADCAST -j LOG --log-prefix "$INIF Input Broadcast: "
#    iptables -A INPUT -i $INIF -d $BROADCAST -j DROP


# Accept certain icmp message, drop the others
# and log them through the Firewall chain
# 0 => echo reply
iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT
# 3 => Destination Unreachable
iptables -A INPUT -p icmp --icmp-type 3 -j ACCEPT
# 11 => Time Exceeded
iptables -A INPUT -p icmp --icmp-type 11 -j ACCEPT
# 8 => Echo
# avoid ping flood
iptables -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
iptables -A INPUT -p icmp -j Firewall




# Refuse IANA reserved address ranges:
#
# From http://www.iana.org/assignments/ipv4-address-space, (R) =
# IANA Reserved, (M) = IANA Multicast, (legal as source, only)
#
iptables -A INPUT -s 0.0.0.0/7 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 0.0.0.0/7 -j DROP
iptables -A OUTPUT -d 0.0.0.0/7 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 0.0.0.0/7 -j REJECT
iptables -A INPUT -s 2.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 2.0.0.0/8 -j DROP
iptables -A OUTPUT -d 2.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 2.0.0.0/8 -j REJECT
iptables -A INPUT -s 5.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 5.0.0.0/8 -j DROP
iptables -A OUTPUT -d 5.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 5.0.0.0/8 -j REJECT
iptables -A INPUT -s 7.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 7.0.0.0/8 -j DROP
iptables -A OUTPUT -d 7.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 7.0.0.0/8 -j REJECT
iptables -A INPUT -s 23.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 23.0.0.0/8 -j DROP
iptables -A OUTPUT -d 23.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 23.0.0.0/8 -j REJECT
iptables -A INPUT -s 27.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 27.0.0.0/8 -j DROP
iptables -A OUTPUT -d 27.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 27.0.0.0/8 -j REJECT
iptables -A INPUT -s 31.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 31.0.0.0/8 -j DROP
iptables -A OUTPUT -d 31.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 31.0.0.0/8 -j REJECT
iptables -A INPUT -s 36.0.0.0/7 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 36.0.0.0/7 -j DROP
iptables -A OUTPUT -d 36.0.0.0/7 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 36.0.0.0/7 -j REJECT
iptables -A INPUT -s 39.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 39.0.0.0/8 -j DROP
iptables -A OUTPUT -d 39.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 39.0.0.0/8 -j REJECT
iptables -A INPUT -s 42.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 42.0.0.0/8 -j DROP
iptables -A OUTPUT -d 42.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 42.0.0.0/8 -j REJECT
iptables -A INPUT -s 96.0.0.0/4 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 96.0.0.0/4 -j DROP
iptables -A OUTPUT -d 96.0.0.0/4 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 96.0.0.0/4 -j REJECT
iptables -A INPUT -s 112.0.0.0/6 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 112.0.0.0/6 -j DROP
iptables -A OUTPUT -d 112.0.0.0/6 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 112.0.0.0/6 -j REJECT
iptables -A INPUT -s 120.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 120.0.0.0/8 -j DROP
iptables -A OUTPUT -d 120.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 120.0.0.0/8 -j REJECT
iptables -A INPUT -s 173.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 173.0.0.0/8 -j DROP
iptables -A OUTPUT -d 173.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 173.0.0.0/8 -j REJECT
iptables -A INPUT -s 174.0.0.0/7 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 174.0.0.0/7 -j DROP
iptables -A OUTPUT -d 174.0.0.0/7 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 174.0.0.0/7 -j REJECT
iptables -A INPUT -s 176.0.0.0/5 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 176.0.0.0/5 -j DROP
iptables -A OUTPUT -d 176.0.0.0/5 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 176.0.0.0/5 -j REJECT
iptables -A INPUT -s 184.0.0.0/6 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 184.0.0.0/6 -j DROP
iptables -A OUTPUT -d 184.0.0.0/6 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 184.0.0.0/6 -j REJECT
iptables -A INPUT -s 197.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 197.0.0.0/8 -j DROP
iptables -A OUTPUT -d 197.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 197.0.0.0/8 -j REJECT
iptables -A INPUT -s 223.0.0.0/8 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 223.0.0.0/8 -j DROP
iptables -A OUTPUT -d 223.0.0.0/8 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 223.0.0.0/8 -j REJECT
#iptables -A INPUT -s 224.0.0.0/4 -j LOG --log-prefix "$INIF Input IANA Reserved: "
#iptables -A INPUT -s 224.0.0.0/4 -j DROP
#iptables -A OUTPUT -d 224.0.0.0/4 -j LOG --log-prefix "$INIF Output IANA Reserved: "
#iptables -A OUTPUT -d 224.0.0.0/4 -j REJECT
iptables -A INPUT -s 240.0.0.0/4 -j LOG --log-prefix "$INIF Input IANA Reserved: "
iptables -A INPUT -s 240.0.0.0/4 -j DROP
iptables -A OUTPUT -d 240.0.0.0/4 -j LOG --log-prefix "$INIF Output IANA Reserved: "
iptables -A OUTPUT -d 240.0.0.0/4 -j REJECT


# Accept ssh connections from the Internet
#iptables -A INPUT -i $WAN -p tcp --dport 22 -j ACCEPT
# or only accept from a certain ip
#iptables -A INPUT -i $WAN -s 125.124.123.122 -p tcp --dport 22 -j ACCEPT

# Accept related and established connections
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Drop netbios from the outside, no log, just drop
iptables -A INPUT -p udp --sport 137 --dport 137 -j DROP

#iptables -A INPUT -s $LOC -j ACCEPT

# Finally, anything which was not allowed yet
# is going to go through our Rejectwall rule
iptables -A INPUT -j Dropwall