#!/bin/sh

modprobe nf_conntrack_ftp
modprobe ip_conntrack_ftp

# maximum number of simultaneous entries per banlist
modprobe ipt_recent ip_list_tot=200;

#
#	This implies -F, -X, -P and all rules (-A)..
#
/sbin/iptables-restore <<-EOF
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:ddos_watch - [0:0]
:limit01 - [0:0]
:permanent - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#
#	Filter invalid connections
#
-A INPUT -m conntrack ! --ctstate NEW -j RETURN

#
#	If banned, drop. Ban time: 1 day = 86400 sec
#

############################ RATE LIMIT #########################

-A INPUT -j permanent
-A INPUT -m recent --name ban01 --rcheck --seconds 86400 -j DROP

-A limit01 -m hashlimit --hashlimit 50/second --hashlimit-burst 50 --hashlimit-mode srcip,dstport --hashlimit-name limit01 -j RETURN
-A limit01 -m recent --name ban01 --set
-A limit01 -j LOG --log-prefix "[Banned: http limit] "
-A limit01 -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A INPUT -d x.x.x.x -p tcp -m tcp -m multiport --dports 80,443 -j limit01

########################### DDOS PROTECTION (SOS) ###################################
#
# If a packet passed limit01 (was below 50/s) and the whole thing is below 5000/s, finally accept it
#
-A ddos_watch -m hashlimit --hashlimit-name ddos_watch --hashlimit 5000/second --hashlimit-mode dstport -j ACCEPT
-A ddos_watch -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A INPUT -d x.x.x.x -p tcp -m tcp -m multiport --dports 80,443 -j ddos_watch

############################ UN-RATE LIMITED PORTS HERE #############################



#####################################################################################

#
#	If someone steps on a closed port, remember his address
#
-A INPUT -m recent --name closed_tap --set

# Ban saved in /proc/net_ipt_recent/ban01

COMMIT
EOF

echo "Stopping old watch-bans instance";
#killproc -p /tmp/watch-bans.pid /usr/bin/perl;
killall watch-bans
echo
echo
echo Starting watch-bans
screen -A -m -d -S watch-bans /etc/init.d/watch-bans
echo
echo
echo