#!/bin/bash # # This is a iptables firewall script. # On Debian or Ubuntu, run "update-rc.d firewall defaults" to install this on startup. # Written by Alexey Maximov # # # chkconfig: 2345 08 92 # description: This configures iptables. # ### BEGIN INIT INFO # Provides: firewall # Required-Start: $network $local_fs $remote_fs # Required-Stop: $network $local_fs $remote_fs # Default-Start: 2 3 4 5 # Default-Stop: S 0 1 6 # Short-Description: This loads iptables with firewall rules. # Description: This loads iptables with firewall rules. Placed this in /etc/init.d. # This isn't technically a daemon control script. # This just puts a familiar interface around iptables. ### END INIT INFO modprobe ip_tables modprobe ip_conntrack PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin export PATH test -x /sbin/iptables || exit 1 INT_IF="eth0" INT_IP_1="192.168.0.4" INT_BR_1="255.255.255.0" INT_NET_1="192.168.0.0/24" EXT_IF="eth1" EXT_IP_1="xxx.xx.7.69" EXT_BR_1="xxx.xx.7.127" EXT_NET_1="xxx.xx.7.64/26" LOOPBACK="127.0.0.0/8" CLASS_A="10.0.0.0/8" CLASS_B="172.16.0.0/12" CLASS_C="192.168.0.0/16" CLASS_D_MULTICAST="224.0.0.0/4" CLASS_E_RESERVED_NET="240.0.0.0/4" P_PORTS="0:1023" UP_PORTS="1024:65535" TR_SRC_PORTS="32769:65535" TR_DEST_PORTS="33434:33523" case $1 in start|restart|force-reload) echo "Starting firewall" ############################################################################### # First we need to clear up any existing firewall rules # and chain which might have been created iptables -F iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -F -t mangle iptables -F -t nat iptables -X iptables -Z # Default policies: Accept any incoming packets iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT # Disable response to ping: echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all # Disable response to broadcasts: echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts # Enable TCP SYN cookies: echo "1" > /proc/sys/net/ipv4/tcp_syncookies # Enable bad error messages protection: echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses # Disable IP forwarding: echo "0" > /proc/sys/net/ipv4/ip_forward echo "1" > /proc/sys/net/ipv4/tcp_rfc1337 echo "0" > /proc/sys/net/ipv4/ip_no_pmtu_disc echo "1" > /proc/sys/net/ipv4/tcp_sack echo "1" > /proc/sys/net/ipv4/tcp_fack echo "1" > /proc/sys/net/ipv4/tcp_window_scaling echo "1" > /proc/sys/net/ipv4/tcp_timestamps echo "0" > /proc/sys/net/ipv4/tcp_ecn echo "1" > /proc/sys/net/ipv4/route/flush echo "1440000" > /proc/sys/net/ipv4/tcp_max_tw_buckets echo "15" > /proc/sys/net/ipv4/tcp_fin_timeout echo "1800" > /proc/sys/net/ipv4/tcp_keepalive_time echo "1280" > /proc/sys/net/ipv4/tcp_max_syn_backlog echo "4096 87380 16777216" > /proc/sys/net/ipv4/tcp_rmem echo "4096 65536 16777216" > /proc/sys/net/ipv4/tcp_wmem echo "16777216" > /proc/sys/net/core/rmem_max echo "16777216" > /proc/sys/net/core/rmem_default echo "16777216" > /proc/sys/net/core/wmem_max echo "16777216" > /proc/sys/net/core/wmem_default for interface in /proc/sys/net/ipv4/conf/* do echo "0" > ${interface}/send_redirects echo "0" > ${interface}/accept_redirects echo "1" > ${interface}/secure_redirects echo "0" > ${interface}/accept_source_route echo "0" > ${interface}/bootp_relay echo "0" > ${interface}/proxy_arp echo "1" > ${interface}/log_martians echo "1" > ${interface}/rp_filter done ########################################################################### # Accept any connections from the local machine iptables -A INPUT -i lo -j ACCEPT # A list of well known combination of Bad TCP flags iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP iptables -A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP # Enable this for high load ports with high connect ration (like WEB) #iptables -A INPUT -p tcp --syn --dport 80 -j ACCEPT # Syn flood protection: iptables -N syn-flood iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A syn-flood -j LOG --log-prefix "DROP:TCP_Syn_Flood: " iptables -A syn-flood -j DROP iptables -A INPUT -i ${EXT_IF} -p tcp --syn -j syn-flood iptables -A INPUT -i ${INT_IF} -p tcp --syn -j syn-flood # New tcp connections must be made with Syn packets: iptables -A INPUT -i ${EXT_IF} -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "DROP:TCP_No_Syn: " iptables -A INPUT -i ${EXT_IF} -p tcp ! --syn -m state --state NEW -j DROP iptables -A INPUT -i ${INT_IF} -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "DROP:TCP_No_Syn: " iptables -A INPUT -i ${INT_IF} -p tcp ! --syn -m state --state NEW -j DROP # Refuse spoofed packets pretending to be from the EXT_IP_1 address: iptables -A INPUT -i ${EXT_IF} -s $EXT_IP_1 -j LOG --log-prefix "DROP:Spoof: " iptables -A INPUT -i ${EXT_IF} -s $EXT_IP_1 -j DROP iptables -A INPUT -i ${INT_IF} -s $INT_IP_1 -j LOG --log-prefix "DROP:Spoof: " iptables -A INPUT -i ${INT_IF} -s $INT_IP_1 -j DROP # Refuse packets claiming to be from a Class A private network: iptables -A INPUT -i ${EXT_IF} -s $CLASS_A -j LOG --log-prefix "DROP:Class_A: " iptables -A INPUT -i ${EXT_IF} -s $CLASS_A -j DROP iptables -A INPUT -i ${INT_IF} -s $CLASS_A -j LOG --log-prefix "DROP:Class_A: " iptables -A INPUT -i ${INT_IF} -s $CLASS_A -j DROP # Refuse packets claiming to be from a Class B private network, # (INNET is a Class B private network-its commented out): iptables -A INPUT -i ${EXT_IF} -s $CLASS_B -j LOG --log-prefix "DROP:Class_B: " iptables -A INPUT -i ${EXT_IF} -s $CLASS_B -j DROP iptables -A INPUT -i ${INT_IF} -s $CLASS_B -j LOG --log-prefix "DROP:Class_B: " iptables -A INPUT -i ${INT_IF} -s $CLASS_B -j DROP # Refuse packets claiming to be from a Class C private network: iptables -A INPUT -i ${EXT_IF} -s $CLASS_C -j LOG --log-prefix "DROP:Class_C: " iptables -A INPUT -i ${EXT_IF} -s $CLASS_C -j DROP # iptables -A INPUT -i ${INT_IF} -s $CLASS_C -j LOG --log-prefix "DROP:Class_C: " # iptables -A INPUT -i ${INT_IF} -s $CLASS_C -j DROP # Refuse Class D multicast addresses. Multicast is illegal as a # source address: iptables -A INPUT -i ${EXT_IF} -s $CLASS_D_MULTICAST -j LOG --log-prefix "DROP:Multicast: " iptables -A INPUT -i ${EXT_IF} -s $CLASS_D_MULTICAST -j DROP iptables -A INPUT -i ${INT_IF} -s $CLASS_D_MULTICAST -j LOG --log-prefix "DROP:Multicast: " iptables -A INPUT -i ${INT_IF} -s $CLASS_D_MULTICAST -j DROP # Refuse Class E reserved IP addresses: iptables -A INPUT -i ${EXT_IF} -s $CLASS_E_RESERVED_NET -j LOG --log-prefix "DROP:Class_E: " iptables -A INPUT -i ${EXT_IF} -s $CLASS_E_RESERVED_NET -j DROP iptables -A INPUT -i ${INT_IF} -s $CLASS_E_RESERVED_NET -j LOG --log-prefix "DROP:Class_E: " iptables -A INPUT -i ${INT_IF} -s $CLASS_E_RESERVED_NET -j DROP # Refuse packets claiming to be to the loopback interface: iptables -A INPUT -i ${EXT_IF} -d $LOOPBACK -j LOG --log-prefix "DROP:Loopback_Spoof: " iptables -A INPUT -i ${EXT_IF} -d $LOOPBACK -j DROP iptables -A INPUT -i ${INT_IF} -d $LOOPBACK -j LOG --log-prefix "DROP:Loopback_Spoof: " iptables -A INPUT -i ${INT_IF} -d $LOOPBACK -j DROP # Refuse common broadcast address packets: #iptables -A INPUT -s 255.255.255.255 -j LOG --log-prefix "DROP:${EXT_IF}:Broadcast: " iptables -A INPUT -s 255.255.255.255 -j DROP #iptables -A INPUT -d 255.255.255.255 -j LOG --log-prefix "DROP:${EXT_IF}:Broadcast: " iptables -A INPUT -d 255.255.255.255 -j DROP # Refuse our broadcast address packets: iptables -A INPUT -i ${EXT_IF} -d $EXT_BR_1 -j LOG --log-prefix "DROP:Broadcast: " iptables -A INPUT -i ${EXT_IF} -d $EXT_BR_1 -j DROP iptables -A INPUT -i ${INT_IF} -d $INT_BR_1 -j LOG --log-prefix "DROP:Broadcast: " iptables -A INPUT -i ${INT_IF} -d $INT_BR_1 -j DROP # Limit ICMP iptables -A INPUT -p icmp --fragment -j DROP iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT iptables -A INPUT -p icmp --icmp-type source-quench -j ACCEPT iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT iptables -A INPUT -p icmp -j DROP # Reject ident iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset # Drop netbios iptables -A INPUT -p udp --sport 137 --dport 137 -j DROP # Accept ssh connections iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 22 -j DROP iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 22 -j DROP # Accept smtp connections iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 25 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT iptables -A INPUT -i ${EXT_IF} -p tcp -m state --syn --state NEW --dport 25 -j DROP iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 25 -m limit --limit 6/minute --limit-burst 1 -j ACCEPT iptables -A INPUT -i ${INT_IF} -p tcp -m state --syn --state NEW --dport 25 -j DROP # Drop nfs from the Internet iptables -A INPUT -i ${EXT_IF} -p tcp --dport 111 -j REJECT --reject-with tcp-reset iptables -A INPUT -i ${EXT_IF} -p tcp --dport 2049 -j REJECT --reject-with tcp-reset # Drop baclula from the Internet iptables -A INPUT -i ${EXT_IF} -p tcp --dport 9101 -j REJECT --reject-with tcp-reset iptables -A INPUT -i ${EXT_IF} -p tcp --dport 9103 -j REJECT --reject-with tcp-reset # Drop samba from the Internet iptables -A INPUT -i ${EXT_IF} -p tcp --dport 137:139 -j REJECT --reject-with tcp-reset iptables -A INPUT -i ${EXT_IF} -p udp --dport 137:139 -j DROP iptables -A INPUT -i ${EXT_IF} -p tcp --dport 445 -j REJECT --reject-with tcp-reset iptables -A INPUT -i ${EXT_IF} -p udp --dport 445 -j DROP # Drop squid from the Internet iptables -A INPUT -i ${EXT_IF} -p tcp --dport 3128 -j REJECT --reject-with tcp-reset ############################################################################### ;; stop) ############################################################################### echo "Stoping firewall" iptables -F iptables -X iptables -Z iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ############################################################################### ;; esac