#!/bin/sh

# Settings
SYN_FLOOD_PROTECTION=1
ICMP_IGNORE_BROADCAST=1
ICMP_REDIRECTS=0
ICMP_IGNORE_BAD_MSGS=1
LOG_MARTIANS=0
TCP_TIMESTAMPS=0
ACCEPT_SOURCE_ROUTE=0
ICMP_PING=1

LOG_SCANS=0
XMAS_SCAN=1
XMAS_PSH_SCAN=1
NMAP_XMAS_SCAN=1
NULL_SCAN=1
SYN_RST_SCAN=1
SYN_FIN_SCAN=1

# Generic Protection
print_status() {
  if [ $1 == 1 ]; then
    echo "Enabled"
  else
    echo "Disabled"
  fi
}
print_statusex() {
  printf "$1"
  if [ $2 == 1 ]; then
    echo "Enabled"
  else
    echo "Disabled"
  fi
}

echo "  Setting up..."
printf "    SYN-Flood protection               "
if [ -f /proc/sys/net/ipv4/tcp_syncookies ]; then
  echo $SYN_FLOOD_PROTECTION > /proc/sys/net/ipv4/tcp_syncookies
  print_status $SYN_FLOOD_PROTECTION
else
  echo "Default"
fi
printf "    Ignore ICMP broadcasts             "
if [ -f /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ] && [ $ICMP_IGNORE_BROADCAST == 1 ]; then
  echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  print_status $ICMP_IGNORE_BROADCAST
else
  echo "Default"
fi
printf "    Log Martians                       "
if [ -f /proc/sys/net/ipv4/conf/all/log_martians ]; then
  echo $LOG_MARTIANS > /proc/sys/net/ipv4/conf/all/log_martians
  print_status $LOG_MARTIANS
else
  echo "Default"
fi
printf "    TCP Timestamps                     "
if [ -f /proc/sys/net/ipv4/tcp_timestamps ]; then
  echo $TCP_TIMESTAMPS > /proc/sys/net/ipv4/tcp_timestamps
  print_status $TCP_TIMESTAMPS
else
  echo "Default"
fi
printf "    ICMP redirects                     "
if [ -f /proc/sys/net/ipv4/conf/all/accept_redirects ]; then
  echo $ICMP_REDIRECTS > /proc/sys/net/ipv4/conf/all/accept_redirects
  print_status $ICMP_REDIRECTS
else
  echo "Default"
fi
printf "    Accept source route                "
if [ -f /proc/sys/net/ipv4/conf/all/accept_source_route ]; then
  echo $ACCEPT_SOURCE_ROUTE > /proc/sys/net/ipv4/conf/all/accept_source_route
  print_status $ACCEPT_SOURCE_ROUTE
else
  echo "Default"
fi
printf "    Ignore bad ICMP msgs               "
if [ -f /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]; then
  echo $ICMP_IGNORE_BAD_MSGS > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
  print_status $ICMP_IGNORE_BAD_MSGS
else
  echo "Default"
fi

modprobe nf_conntrack_ftp
modprobe ip_conntrack_ftp

# maximum number of simultaneous entries per banlist
modprobe ipt_recent ip_list_tot=200;

#
#	This implies -F, -X, -P and all rules (-A)..
#
/sbin/iptables-restore <<-EOF
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:closed_tap - [0:0]
:limit01 - [0:0]
:permanent - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#
#	Filter invalid connections
#
-A INPUT -m conntrack ! --ctstate NEW -j RETURN

#
#	If banned, drop. Ban time: 1 day = 86400 sec
#

############################ PERMINANT NON-CONDITIONAL BANS #########################

# Andy & Beast
-A permanent -s 82.47.27.102 -j DROP
# Test Daemon
#-A permanent -s 62.3.204.130 -j DROP

-A INPUT -j permanent
-A INPUT -m recent --name ban01 --rcheck --seconds 86400 -j DROP

############################ 5 MIN BAN STEPPING ON CLOSED PORT ######################

-A INPUT -p tcp -m multiport --dport 21,25,88,110,161,162,2222,15534 -m recent --name closed_tap --rcheck --seconds 300 -j DROP

########################### DDOS PROTECTION (SOS) ###################################

#-A ddos_watch -m hashlimit --hashlimit-name ddos_watch --hashlimit 50/second --hashlimit-mode dstport -j RETURN
#-A ddos_watch -p tcp -m tcp -j REJECT --reject-with tcp-reset
#-A INPUT -d 217.146.89.130 -p tcp -m tcp -m multiport --dports 80,443 -j ddos_watch
#-A INPUT -d 217.146.89.131 -p tcp -m tcp -m multiport --dports 80,443 -j ddos_watch
#-A INPUT -d 217.146.89.132 -p tcp -m tcp -m multiport --dports 80,443 -j ddos_watch

############################ UN-RATE LIMITED PORTS ##################################

-A INPUT -d 217.146.89.130 -p tcp -m tcp -m multiport --dports 110,161,162,2222 -j ACCEPT
-A INPUT -d 217.146.89.130 -p udp -m udp -m multiport --dports 161,162 -j ACCEPT
-A INPUT -d 217.146.89.131 -p tcp -m tcp -m multiport --dports 110,2222 -j ACCEPT
-A INPUT -d 217.146.89.132 -p tcp -m tcp -m multiport --dports 110 -j ACCEPT

-A INPUT -d 217.146.89.230 -p tcp -m tcp -m multiport --dports 15534,27055,51234 -j ACCEPT
-A INPUT -d 217.146.89.230 -p udp -m udp -m multiport --dports 27000:27057 -j ACCEPT

-A INPUT -d 217.146.89.240 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -d 217.146.89.240 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -d 217.146.89.241 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -d 217.146.89.241 -p udp -m udp --dport 53 -j ACCEPT

############################ RATE LIMITED PORTS ####################################

-A limit01 -m hashlimit --hashlimit 10/minute --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name limit01 -j ACCEPT
-A limit01 -m recent --name ban01 --set
-A limit01 -j LOG --log-prefix "[Banned: limit reached] "
-A limit01 -j DROP

-A INPUT -d 217.146.89.130 -p tcp -m tcp -m multiport --dports 21,25,80,88,443 -j limit01
-A INPUT -d 217.146.89.131 -p tcp -m tcp -m multiport --dports 21,25,80,88,443 -j limit01
-A INPUT -d 217.146.89.132 -p tcp -m tcp -m multiport --dports 21,25,80,443 -j limit01
-A INPUT -d 217.146.89.230 -p udp -m udp --dport 8767 -j limit01

####################################################################################

#
#	If someone steps on a closed port, remember his address
#
-A INPUT -m recent --name closed_tap --set

# Ban saved in /proc/net_ipt_recent/ban01

COMMIT
EOF

echo "Stopping old watch-bans instance";
#killproc -p /tmp/watch-bans.pid /usr/bin/perl;
killall watch-bans
echo
echo
echo Starting watch-bans
screen -A -m -d -S watch-bans /etc/init.d/watch-bans
echo
echo
echo