iptables revision

2 files changed, 415 insertions, 8 deletions

diff --git a/core/conf/iptables/iptables.sh b/core/conf/iptables/iptables.sh
new file mode 100644
index 0000000..32a6ef5
--- /dev/null
+++ b/core/conf/iptables/iptables.sh
@@ -0,0 +1,405 @@
+#!/bin/sh
+
+#
+#                                XXXXXXXXXXXXXXXXX
+#                                XXXX Network XXXX
+#                                XXXXXXXXXXXXXXXXX
+#                                        +
+#                                        |
+#                                        v
+#  +-------------+              +------------------+
+#  |table: filter| <---+        | table: nat       |
+#  |chain: INPUT |     |        | chain: PREROUTING|
+#  +-----+-------+     |        +--------+---------+
+#        |             |                 |
+#        v             |                 v
+#  [local process]     |           ****************          +--------------+
+#        |             +---------+ Routing decision +------> |table: filter |
+#        v                         ****************          |chain: FORWARD|
+# ****************                                           +------+-------+
+# Routing decision                                                  |
+# ****************                                                  |
+#        |                                                          |
+#        v                        ****************                  |
+# +-------------+       +------>  Routing decision  <---------------+
+# |table: nat   |       |         ****************
+# |chain: OUTPUT|       |               +
+# +-----+-------+       |               |
+#       |               |               v
+#       v               |      +-------------------+
+# +--------------+      |      | table: nat        |
+# |table: filter | +----+      | chain: POSTROUTING|
+# |chain: OUTPUT |             +--------+----------+
+# +--------------+                      |
+#                                       v
+#                               XXXXXXXXXXXXXXXXX
+#                               XXXX Network XXXX
+#                               XXXXXXXXXXXXXXXXX
+#
+# iptables [-t table] {-A|-C|-D} chain rule-specification
+#
+# iptables [-t table] {-A|-C|-D} chain  rule-specification
+#
+# iptables  [-t table] -I chain [rulenum] rule-specification
+#
+# iptables [-t table] -R chain rulenum  rule-specification
+#
+# iptables [-t table] -D chain rulenum
+#
+# iptables [-t table] -S [chain [rulenum]]
+#
+# iptables  [-t  table]  {-F|-L|-Z} [chain [rulenum]] [options...]
+#
+# iptables [-t table] -N chain
+#
+# iptables [-t table] -X [chain]
+#
+# iptables [-t table] -P chain target
+#
+# iptables [-t table]  -E  old-chain-name  new-chain-name
+#
+# rule-specification = [matches...] [target]
+#
+# match = -m matchname [per-match-options]
+#
+#
+# Targets
+#
+# can be a user defined chain
+#
+# ACCEPT - accepts the packet
+# DROP   - drop the packet on the floor
+# QUEUE  - packet will be stent to queue
+# RETURN - stop traversing this chain and
+#          resume ate the next rule in the
+#          previeus (calling) chain.
+#
+# if packet reach the end of the chain or
+# a target RETURN, default policy for that
+# chain is applayed.
+#
+# Target Extensions
+#
+# AUDIT
+# CHECKSUM
+# CLASSIFY
+# DNAT
+# DSCP
+# LOG
+#     Torn on kernel logging, will print some
+#     some information on all matching packets.
+#     Log data can be read with dmesg or syslogd.
+#     This is a non-terminating target and a rule
+#     should be created with matching criteria.
+#
+#     --log-level level
+#           Level of logging (numeric or see sys-
+#           log.conf(5)
+#
+#     --log-prefix prefix
+#           Prefix log messages with specified prefix
+#           up to 29 chars log
+#
+#     --log-uid
+#           Log the userid of the process with gener-
+#           ated the packet
+# NFLOG
+#     This target pass the packet to loaded logging
+#     backend to log the packet. One or more userspace
+#     processes may subscribe to the group to receive
+#     the packets.
+#
+# ULOG
+#     This target provides userspace logging of maching
+#     packets. One or more userspace processes may then
+#     then subscribe to various multicast groups and
+#     then receive the packets.
+#
+#
+# Commands
+#
+# -A, --append chain rule-specification
+# -C, --check chain rule-specification
+# -D, --delete chain rule-specification
+# -D, --delete chain rulenum
+# -I, --insert chain [rulenum] rule-specification
+# -R, --replace chain rulenum rule-specification
+# -L, --list [chain]
+# -P, --policy chain target
+#
+# Parameters
+#
+# -p, --protocol protocol
+#       tcp, udp, udplite, icmp, esp, ah, sctp, all
+# -s, --source address[/mask][,...]
+# -d, --destination address[/mask][,...]
+# -j, --jump target
+# -g, --goto chain
+# -i, --in-interface name
+# -o, --out-interface name
+# -f, --fragment
+# -m, --match options module-name
+#       iptables can use extended packet matching
+#       modules.
+# -c, --set-counters packets bytes
+
+IPT="/usr/sbin/iptables"
+SPAMLIST="blockedip"
+SPAMDROPMSG="BLOCKED IP DROP"
+# public interface to network/internet
+BR_IF="br0"
+BR_IP="10.0.0.254"
+BR_NET="10.0.0.0/8"
+GW="10.0.0.1"
+
+# private interface for virtual/internal
+WIFI_IF="wlp7s0"
+WIFI_NET="192.168.1.0/24"
+#PRI_IP="192.168.1.33"
+
+echo "Stopping ipv4 firewall and deny everyone..."
+
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+iptables -t raw -F
+iptables -t raw -X
+iptables -t security -F
+iptables -t security -X
+iptables -N blocker
+
+iptables -N netconf_in
+iptables -N netconf_out
+iptables -N server_in
+iptables -N server_out
+iptables -N client_in
+iptables -N client_out
+
+iptables -N srv_dns_in
+iptables -N srv_dns_out
+iptables -N cli_dns_in
+iptables -N cli_dns_out
+iptables -N cli_http_in
+iptables -N cli_http_out
+
+# Set Default Rules
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT DROP
+
+####### blocker Chain  ######
+## Block google dns
+$IPT -A blocker -s 8.8.0.0/24 -j LOG --log-level 7 --log-prefix "iptables: blocker google: "
+$IPT -A blocker -s 8.8.0.0/24 -j DROP
+## Block sync
+$IPT -A blocker -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
+$IPT -A blocker -p tcp ! --syn -m state --state NEW -j DROP
+## Block Fragments
+$IPT -A blocker -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
+$IPT -A blocker -f -j DROP
+$IPT -A blocker -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
+$IPT -A blocker -p tcp --tcp-flags ALL ALL -j DROP
+$IPT -A blocker -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
+$IPT -A blocker -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
+$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
+$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
+$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
+$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
+$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
+$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
+## Return to caller
+$IPT -A blocker -j RETURN
+
+######## DNS Server
+#echo "server_in chain: Allow input to DNS Server"
+$IPT -A srv_dns_in -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A srv_dns_in -p tcp --dport 53 --sport 1024:65535  -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A srv_dns_in -j RETURN
+#echo "srv_dns_out chain: Allow output from DNS server"
+$IPT -A srv_dns_out -p udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+$IPT -A srv_dns_out -p tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+$IPT -A srv_dns_out -j RETURN
+
+######## DNS Client
+echo "cli_dns_out chain: Allow output to DNS server"
+$IPT -A cli_dns_out -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A cli_dns_out -j RETURN
+echo "cli_dns_in chain: Allow input from DNS Server"
+$IPT -A cli_dns_in -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A cli_dns_in -j RETURN
+
+######## HTTP Client
+$IPT -A cli_http_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A cli_http_in -j RETURN
+#echo "Allow to HTTP server"
+$IPT -A cli_http_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A cli_http_out -j RETURN
+
+####### server input Chain  ######
+#echo "server_in chain: Allow to VNC Server"
+#$IPT -A server_in -p tcp --dport 5900:5910 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow to DataBase Server"
+$IPT -A server_in -p tcp --dport 5432 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow to SSH server"
+$IPT -A server_in -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow input to HTTPS Server"
+$IPT -A server_in -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow input to HTTP Server"
+$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow output from GIT server"
+$IPT -A server_in -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A server_in -j RETURN
+
+####### server output Chain  ######
+echo "server_out chain: Allow output from GIT server"
+$IPT -A server_out -p tcp --sport 9418 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from https server"
+$IPT -A server_out -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from http server"
+$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from SSH server"
+$IPT -A server_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from Data Base server"
+$IPT -A server_out -p tcp --sport 5432 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+#echo "server_out chain: Allow output from VNC server"
+#$IPT -A server_out -p tcp --sport 5900:5910 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A server_out -j RETURN
+
+####### client input Chain  ######
+echo "client_in chain: Allow input from IRC server"
+$IPT -A client_in -p tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from FTP server"
+$IPT -A client_in -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from GIT server"
+$IPT -A client_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from POP3S server"
+$IPT -A client_in -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from SMTPS server"
+$IPT -A client_in -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from HTTPS server"
+$IPT -A client_in -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A client_in -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from SSH Server"
+$IPT -A client_in -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A client_in -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from GPG key Server"
+$IPT -A client_in -p tcp --sport 11371 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A client_in -j RETURN
+
+####### client output Chain  ######
+echo "client_out chain: Allow output to IRC  server"
+$IPT -A client_out -p tcp --dport 6667 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to FTP server"
+$IPT -A client_out -p tcp --dport 21 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to GIT server"
+$IPT -A client_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to POP3S server"
+$IPT -A client_out -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to SMTPS server"
+$IPT -A client_out -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to HTTPS server"
+$IPT -A client_out -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to SSH server"
+$IPT -A client_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to GPG key Server"
+$IPT -A client_out -p tcp --dport 11371 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A client_out -j RETURN
+
+####### netconf input Chain  ######
+echo "netconf_in chain: Allow DHCP protocol"
+$IPT -A netconf_in -p udp --sport 68 --dport 67 -j ACCEPT
+echo "netconf_in chain: Allow RIP protocol for ${BR_NET}"
+$IPT -A netconf_in -p udp --sport 520 --dport 520 -j ACCEPT
+#echo "netconf chain: Allow ICMP from ${BR_NET}"
+#$IPT -A netconf_in -p icmp -s ${BR_NET} -j ACCEPT
+echo "netconf_in chain: Allow ICMP from all"
+$IPT -A netconf_in -p icmp -j ACCEPT
+
+## Return to caller
+$IPT -A netconf_in -j RETURN
+
+
+####### netconf output Chain  ######
+echo "netconf_out chain: Allow output from DHCP server"
+$IPT -A netconf_out -p udp --sport 67 --dport 68 -j ACCEPT
+echo "netconf_out chain: Allow RIP protocol for ${BR_NET}"
+$IPT -A netconf_out -p udp --sport 520 --dport 520 -j ACCEPT
+#echo "netconf chain: Allow ICMP output to ${BR_NET}"
+#$IPT -A netconf_out -p icmp -d ${BR_NET} -j ACCEPT
+echo "netconf chain: Allow ICMP output to all"
+$IPT -A netconf_out -p icmp -j ACCEPT
+
+## Return to caller
+$IPT -A netconf_out -j RETURN
+
+############################################################
+#
+# Start adding rules tables
+#
+
+echo "Starting ipv4 firewall tables..."
+
+# Unlimited on loopback
+$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
+$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
+$IPT -A INPUT -i lo -s ${BR_IP} -d ${BR_IP} -j ACCEPT
+$IPT -A OUTPUT -o lo -s ${BR_IP} -d ${BR_IP} -j ACCEPT
+
+#modprobe ip_conntrack
+#modprobe ip_conntrack_ftp
+echo 1 > /proc/sys/net/ipv4/ip_forward
+
+####### Forward Chain  ######
+$IPT -A FORWARD -j blocker
+$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -d ${BR_NET} -j ACCEPT
+$IPT -A FORWARD -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j ACCEPT
+#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j ACCEPT
+#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j ACCEPT
+
+####### Input Chain ######
+$IPT -A INPUT -j blocker
+$IPT -A INPUT -i ${BR_IF} -j netconf_in
+$IPT -A INPUT -i ${BR_IF} -d ${BR_IP} -j srv_dns_in
+$IPT -A INPUT -i ${BR_IF} -s ${BR_NET} -d ${BR_IP} -j server_in
+#$IPT -A INPUT -i ${WIFI_IF} -d ${WIFI_NET} -j client_in
+#$IPT -A INPUT -i ${WIFI_IF} -d ${WIFI_NET} -j cli_dns_in
+#$IPT -A INPUT -i ${BR_IF} -d ${BR_IP} -j client_in
+#
+##$IPT -A INPUT -i ${WIFI_IF} -j server_in
+#$IPT -A INPUT -i ${WIFI_IF} -j netconf_in
+
+####### Output Chain ######
+$IPT -A OUTPUT -j blocker
+$IPT -A OUTPUT -o ${BR_IF}  -j netconf_out
+$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j srv_dns_out
+$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j server_out
+$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j client_out
+#$IPT -A OUTPUT -o ${WIFI_IF} -s ${WIFI_NET} -j client_out
+#$IPT -A OUTPUT -o ${WIFI_IF} -s ${WIFI_NET} -j cli_dns_out
+
+#$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -j client_out
+
+#$IPT -A OUTPUT -o ${WIFI_IF} -j server_out
+#$IPT -A OUTPUT -o ${WIFI_IF} -j netconf_out
+
+####### PostRouting Chain ######
+$IPT -t nat -A POSTROUTING -o ${WIFI_IF} -j MASQUERADE
+#$IPT -t nat -A POSTROUTING -o ${BR_IF} -j MASQUERADE
+
+## log everything else and drop
+$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
+$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
+$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
+$IPT -t nat -A POSTROUTING -j LOG --log-level 7 --log-prefix "iptables: POSTROUTING: "
+$IPT -t nat -A PREROUTING -j LOG --log-level 7 --log-prefix "iptables: PREROUTING: "
+exit 0
diff --git a/core/network.html b/core/network.html
index 92f0e1e..57f877a 100644
--- a/core/network.html
+++ b/core/network.html
@@ -116,14 +116,16 @@
 
         <p>For more information about iptables read
         <a href="https://wiki.archlinux.org/index.php/Iptables">arch wiki</a>.
-        You can use
-        <a href="conf/iptables/rules.v4">/etc/iptables/rules.v4</a>
-        or
-        <a href="conf/iptables/iptables-lan.sh">/etc/iptables/iptables-lan.sh</a>
-        as a template, replace interfaces by correct ones.
-        This configuration file is used at boot time by iptables-restore command,
-        if you use a script or change the rules of running system you can
-        use iptables-save command to save configuration to a file.</p>
+        Iptables can be setup at startup with
+        <a href="conf/rc.d/iptables">/etc/rc.d/iptables</a> script, change
+        <a href="conf/iptables/iptables.sh">/etc/iptables/iptables.sh</a>
+        with your needs and run to apply, after iptables-save can be used
+        to create /etc/iptables/rules.v4 file that is used by init script.</p>
+
+        <p>Init script "start" option loads set of rules from file
+        /etc/iptables/rules.v4, "open" option allows everything to outside
+        and blocks everything from outside, "stop" will block and log
+        everything.</p>
 
         <pre>
         # mkdir /etc/iptables