overall revesion

2 files changed, 135 insertions, 84 deletions

diff --git a/core/conf/iptables/iptables-lan.sh b/core/conf/iptables/iptables-lan.sh
index fae7345..58d92c3 100644
--- a/core/conf/iptables/iptables-lan.sh
+++ b/core/conf/iptables/iptables-lan.sh
@@ -26,8 +26,7 @@ NIC_NAME="enp8s0 wlp7s0"
 
 # Logging options.
 #------------------------------------------------------------------------------
-LOG="LOG --log-level debug --log-tcp-sequence --log-tcp-options"
-LOG="$LOG --log-ip-options"
+LOG="LOG --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options"
 
 
 # Defaults for rate limiting
@@ -59,9 +58,9 @@ $MODPROBE ip_conntrack_irc
 # Drop everything by default.
 $IPTABLES -P INPUT DROP
 $IPTABLES -P FORWARD DROP
-$IPTABLES -P OUTPUT ACCEPT
+$IPTABLES -P OUTPUT DROP
 
-# Set the nat/mangle/raw tables' chains to ACCEPT
+# Set the nat/mangle/raw tables' chains to DROP
 
 $IPTABLES -t mangle -P PREROUTING ACCEPT
 $IPTABLES -t mangle -P INPUT ACCEPT
@@ -89,53 +88,58 @@ $IPTABLES -t mangle -Z
 
 # Block all IPv6 traffic
 # If the ip6tables command is available, try to block all IPv6 traffic.
-if test -x $IP6TABLES; then
+#if test -x $IP6TABLES; then
 # Set the default policies
 # drop everything
-$IP6TABLES -P INPUT DROP 2>/dev/null
-$IP6TABLES -P FORWARD DROP 2>/dev/null
-$IP6TABLES -P OUTPUT DROP 2>/dev/null
-
-# The mangle table can pass everything
-$IP6TABLES -t mangle -P PREROUTING ACCEPT 2>/dev/null
-$IP6TABLES -t mangle -P INPUT ACCEPT 2>/dev/null
-$IP6TABLES -t mangle -P FORWARD ACCEPT 2>/dev/null
-$IP6TABLES -t mangle -P OUTPUT ACCEPT 2>/dev/null
-$IP6TABLES -t mangle -P POSTROUTING ACCEPT 2>/dev/null
+#$IP6TABLES -P INPUT DROP
+#$IP6TABLES -P FORWARD DROP
+#$IP6TABLES -P OUTPUT DROP
+#
+## The mangle table can pass everything
+#$IP6TABLES -t mangle -P PREROUTING ACCEPT
+#$IP6TABLES -t mangle -P INPUT ACCEPT
+#$IP6TABLES -t mangle -P FORWARD ACCEPT
+#$IP6TABLES -t mangle -P OUTPUT ACCEPT
+#$IP6TABLES -t mangle -P POSTROUTING ACCEPT
 
 # Delete all rules.
-$IP6TABLES -F 2>/dev/null
-$IP6TABLES -t mangle -F 2>/dev/null
-
-# Delete all chains.
-$IP6TABLES -X 2>/dev/null
-$IP6TABLES -t mangle -X 2>/dev/null
-
-# Zero all packets and counters.
-$IP6TABLES -Z 2>/dev/null
-$IP6TABLES -t mangle -Z 2>/dev/null
-fi
+#$IP6TABLES -F 2>/dev/null
+#$IP6TABLES -t mangle -F 2>/dev/null
+#
+## Delete all chains.
+#$IP6TABLES -X 2>/dev/null
+#$IP6TABLES -t mangle -X 2>/dev/null
+#
+## Zero all packets and counters.
+#$IP6TABLES -Z 2>/dev/null
+#$IP6TABLES -t mangle -Z 2>/dev/null
+#fi
 
 # Custom user-defined chains.
 #------------------------------------------------------------------------------
 
 # LOG packets, then ACCEPT.
 $IPTABLES -N ACCEPTLOG
-$IPTABLES -A ACCEPTLOG -j $LOG $RLIMIT --log-prefix "ACCEPT "
+$IPTABLES -A ACCEPTLOG -j $LOG $RLIMIT --log-prefix "iptables: ACCEPT "
 $IPTABLES -A ACCEPTLOG -j ACCEPT
 
 # LOG packets, then DROP.
 $IPTABLES -N DROPLOG
-$IPTABLES -A DROPLOG -j $LOG $RLIMIT --log-prefix "DROP "
+$IPTABLES -A DROPLOG -j $LOG $RLIMIT --log-prefix "iptables: DROP "
 $IPTABLES -A DROPLOG -j DROP
 
 # LOG packets, then REJECT.
 # TCP packets are rejected with a TCP reset.
 $IPTABLES -N REJECTLOG
-$IPTABLES -A REJECTLOG -j $LOG $RLIMIT --log-prefix "REJECT "
+$IPTABLES -A REJECTLOG -j $LOG $RLIMIT --log-prefix "iptables: REJECT "
 $IPTABLES -A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset
 $IPTABLES -A REJECTLOG -j REJECT
 
+# Allow loopback interface to do anything.
+$IPTABLES -A INPUT -i lo -j ACCEPT
+$IPTABLES -A OUTPUT -o lo -j ACCEPT
+
+
 # Only allows RELATED ICMP types
 # (destination-unreachable, time-exceeded, and parameter-problem).
 # TODO: Rate-limit this traffic?
@@ -185,10 +189,6 @@ $IPTABLES -A FORWARD -p icmp -j DROPLOG
 # Selectively allow certain special types of traffic.
 #------------------------------------------------------------------------------
 
-# Allow loopback interface to do anything.
-$IPTABLES -A INPUT -i lo -j ACCEPT
-$IPTABLES -A OUTPUT -o lo -j ACCEPT
-
 # Allow incoming connections related to existing allowed connections.
 $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
@@ -199,7 +199,7 @@ $IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
 #------------------------------------------------------------------------------
 
 # We don't care about Milkosoft, Drop SMB/CIFS/etc..
-#                     ^ person before me; my label = psychogreedyevilsoft
+#                     ^ greedyevilsoft
 $IPTABLES -A INPUT -p tcp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
 $IPTABLES -A INPUT -p udp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
 
@@ -234,12 +234,13 @@ $IPTABLES -A SYN_FLOOD -m limit --limit 2/s --limit-burst 6 -j RETURN
 
 $IPTABLES -A SYN_FLOOD -j DROP
 
-$IPTABLES -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7
-$IPTABLES -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-
-$IPTABLES -A INPUT -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: "
-$IPTABLES -A INPUT -f -j DROP
+#$IPTABLES -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 30/min --limit-burst 7 -j DROPLOG --log-prefix "iptables: drop sync: " --log-level 7
+#$IPTABLES -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
+$IPTABLES -A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROPLOG
 
+#$IPTABLES -A INPUT -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: "
+#$IPTABLES -A INPUT -f -j DROP
+$IPTABLES -A INPUT -f -j DROPLOG
 
 # TODO: ICQ, MSN, GTalk, Skype, Yahoo, etc...
 
@@ -247,22 +248,67 @@ $IPTABLES -A INPUT -f -j DROP
 #------------------------------------------------------------------------------
 
 # Allow incoming SSH requests.
-$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
+#$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
+
+# Allow incoming https server
+#$IPTABLES -A INPUT -p tcp -m tcp --dport 443 --sport $PHIGH -m state --state NEW,ESTABLISHED -j ACCEPT
+
+
+# Selectively allow certain outbound connections, block the rest.
+#------------------------------------------------------------------------------
+#
+
+# Allow ping
+$IPTABLES -A OUTPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+# Allow to ssh clients
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+# Allow to dns
+$IPTABLES -A OUTPUT -p udp -m udp --sport $PHIGH --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow irc
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to xmmp
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+# Allow to rsync server
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to pop3s server
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to smtps server
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to ntp server
+$IPTABLES -A OUTPUT -p udp -m udp --sport $PHIGH --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to ftp server
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to https server
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+#$IPTABLES -A OUTPUT -p udp -m udp --sport $PHIGH --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+# Allow to http server
+$IPTABLES -A OUTPUT -p tcp -m tcp --sport $PHIGH --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+# Selectively allow certain outbound server connections, block the rest.
+#------------------------------------------------------------------------------
+
+# Allow from https server
+#$IPTABLES -A OUTPUT -p tcp -m tcp --sport 443 --dport $PHIGH -m state --state ESTABLISHED -j ACCEPT
+
+# Allow from dns server
+#$IPTABLES -A OUTPUT -p udp -m udp --sport 53 --dport $PHIGH -m state --state ESTABLISHED -j ACCEPT
 
 # Explicitly log and reject everything else.
 #------------------------------------------------------------------------------
 # Use REJECT instead of REJECTLOG if you don't need/want logging.
-$IPTABLES -A INPUT -j REJECTLOG
-$IPTABLES -A OUTPUT -j REJECTLOG
+$IPTABLES -A INPUT -j DROPLOG
+$IPTABLES -A OUTPUT -j DROPLOG
 $IPTABLES -A FORWARD -j REJECTLOG
 
 # Counter hits
 
-for i in $NIC_NAME
-do
-	iptables -I INPUT -p tcp -m multiport --dports 22 -i $i -m state --state NEW -m recent --set
-	iptables -I INPUT -p tcp -m multiport --dports 22 -i $i -m state --state NEW -m recent --update --seconds 50 --hitcount 3 -j DROP
-done
+#for i in $NIC_NAME
+#do
+#	iptables -I INPUT -p tcp -m multiport --dports 22 -i $i -m state --state NEW -m recent --set
+#	iptables -I INPUT -p tcp -m multiport --dports 22 -i $i -m state --state NEW -m recent --update --seconds 50 --hitcount 3 -j DROP
+#done
 
 #------------------------------------------------------------------------------
 # Testing the firewall.
@@ -273,5 +319,4 @@ done
 
 # Exit gracefully.
 #------------------------------------------------------------------------------
-
-    exit 0
+exit 0
diff --git a/core/conf/iptables/rules.v4 b/core/conf/iptables/rules.v4
index 5a2ffe8..568455a 100644
--- a/core/conf/iptables/rules.v4
+++ b/core/conf/iptables/rules.v4
@@ -1,25 +1,25 @@
-# Generated by iptables-save v1.6.1 on Tue Feb 21 13:55:04 2017
+# Generated by iptables-save v1.6.1 on Sat Feb 25 18:34:17 2017
 *security
-:INPUT ACCEPT [3624:2121853]
+:INPUT ACCEPT [4559:2307887]
 :FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [3590:999020]
+:OUTPUT ACCEPT [4459:962215]
 COMMIT
-# Completed on Tue Feb 21 13:55:04 2017
-# Generated by iptables-save v1.6.1 on Tue Feb 21 13:55:04 2017
+# Completed on Sat Feb 25 18:34:17 2017
+# Generated by iptables-save v1.6.1 on Sat Feb 25 18:34:17 2017
 *raw
-:PREROUTING ACCEPT [5432:2268406]
-:OUTPUT ACCEPT [3623:1011362]
+:PREROUTING ACCEPT [18446:3412851]
+:OUTPUT ACCEPT [4467:962535]
 COMMIT
-# Completed on Tue Feb 21 13:55:04 2017
-# Generated by iptables-save v1.6.1 on Tue Feb 21 13:55:04 2017
+# Completed on Sat Feb 25 18:34:17 2017
+# Generated by iptables-save v1.6.1 on Sat Feb 25 18:34:17 2017
 *nat
-:PREROUTING ACCEPT [1808:146553]
-:INPUT ACCEPT [0:0]
-:OUTPUT ACCEPT [322:28410]
-:POSTROUTING ACCEPT [289:16068]
+:PREROUTING ACCEPT [13936:1107904]
+:INPUT ACCEPT [49:2940]
+:OUTPUT ACCEPT [504:40037]
+:POSTROUTING ACCEPT [504:40037]
 COMMIT
-# Completed on Tue Feb 21 13:55:04 2017
-# Generated by iptables-save v1.6.1 on Tue Feb 21 13:55:04 2017
+# Completed on Sat Feb 25 18:34:17 2017
+# Generated by iptables-save v1.6.1 on Sat Feb 25 18:34:17 2017
 *mangle
 :PREROUTING ACCEPT [0:0]
 :INPUT ACCEPT [0:0]
@@ -27,21 +27,18 @@ COMMIT
 :OUTPUT ACCEPT [0:0]
 :POSTROUTING ACCEPT [0:0]
 COMMIT
-# Completed on Tue Feb 21 13:55:04 2017
-# Generated by iptables-save v1.6.1 on Tue Feb 21 13:55:04 2017
+# Completed on Sat Feb 25 18:34:17 2017
+# Generated by iptables-save v1.6.1 on Sat Feb 25 18:34:17 2017
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
-:OUTPUT ACCEPT [0:0]
+:OUTPUT DROP [0:0]
 :ACCEPTLOG - [0:0]
 :DROPLOG - [0:0]
 :REJECTLOG - [0:0]
 :RELATED_ICMP - [0:0]
 :SYN_FLOOD - [0:0]
--A INPUT -i wlp7s0 -p tcp -m multiport --dports 22 -m state --state NEW -m recent --update --seconds 50 --hitcount 3 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP
--A INPUT -i wlp7s0 -p tcp -m multiport --dports 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
--A INPUT -i enp8s0 -p tcp -m multiport --dports 22 -m state --state NEW -m recent --update --seconds 50 --hitcount 3 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP
--A INPUT -i enp8s0 -p tcp -m multiport --dports 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
+-A INPUT -i lo -j ACCEPT
 -A INPUT -p icmp -m limit --limit 1/sec --limit-burst 2 -j ACCEPT
 -A INPUT -p icmp -m limit --limit 1/sec --limit-burst 2 -j LOG --log-prefix "PING-DROP:"
 -A INPUT -p icmp -j DROP
@@ -50,7 +47,6 @@ COMMIT
 -A INPUT -p icmp -m state --state RELATED -m limit --limit 3/sec --limit-burst 8 -j RELATED_ICMP
 -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 3/sec --limit-burst 8 -j ACCEPT
 -A INPUT -p icmp -j DROPLOG
--A INPUT -i lo -j ACCEPT
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -p tcp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
 -A INPUT -p udp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
@@ -68,31 +64,41 @@ COMMIT
 -A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROPLOG
 -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROPLOG
 -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j SYN_FLOOD
--A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7
--A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
--A INPUT -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: "
--A INPUT -f -j DROP
--A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
--A INPUT -j REJECTLOG
+-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROPLOG
+-A INPUT -f -j DROPLOG
+-A INPUT -j DROPLOG
 -A FORWARD -p icmp -f -j DROPLOG
 -A FORWARD -p icmp -j DROPLOG
 -A FORWARD -m state --state INVALID -j DROP
 -A FORWARD -j REJECTLOG
+-A OUTPUT -o lo -j ACCEPT
 -A OUTPUT -p icmp -j ACCEPT
 -A OUTPUT -p icmp -f -j DROPLOG
 -A OUTPUT -p icmp -m state --state ESTABLISHED -m limit --limit 3/sec --limit-burst 8 -j ACCEPT
 -A OUTPUT -p icmp -m state --state RELATED -m limit --limit 3/sec --limit-burst 8 -j RELATED_ICMP
 -A OUTPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 3/sec --limit-burst 8 -j ACCEPT
 -A OUTPUT -p icmp -j DROPLOG
--A OUTPUT -o lo -j ACCEPT
 -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
 -A OUTPUT -m state --state INVALID -j DROP
--A OUTPUT -j REJECTLOG
--A ACCEPTLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "ACCEPT " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
+-A OUTPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+-A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 5222 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -j DROPLOG
+-A ACCEPTLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "iptables: ACCEPT " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
 -A ACCEPTLOG -j ACCEPT
--A DROPLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "DROP " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
+-A DROPLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "iptables: DROP " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
 -A DROPLOG -j DROP
--A REJECTLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "REJECT " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
+-A REJECTLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "iptables: REJECT " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
 -A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset
 -A REJECTLOG -j REJECT --reject-with icmp-port-unreachable
 -A RELATED_ICMP -p icmp -m icmp --icmp-type 3 -j ACCEPT
@@ -102,4 +108,4 @@ COMMIT
 -A SYN_FLOOD -m limit --limit 2/sec --limit-burst 6 -j RETURN
 -A SYN_FLOOD -j DROP
 COMMIT
-# Completed on Tue Feb 21 13:55:04 2017
+# Completed on Sat Feb 25 18:34:17 2017