diff options
| -rw-r--r-- | core/conf/iptables/iptables.sh | 405 | ||||
| -rw-r--r-- | core/network.html | 18 |
2 files changed, 415 insertions, 8 deletions
diff --git a/core/conf/iptables/iptables.sh b/core/conf/iptables/iptables.sh new file mode 100644 index 0000000..32a6ef5 --- /dev/null +++ b/core/conf/iptables/iptables.sh @@ -0,0 +1,405 @@ +#!/bin/sh + +# +# XXXXXXXXXXXXXXXXX +# XXXX Network XXXX +# XXXXXXXXXXXXXXXXX +# + +# | +# v +# +-------------+ +------------------+ +# |table: filter| <---+ | table: nat | +# |chain: INPUT | | | chain: PREROUTING| +# +-----+-------+ | +--------+---------+ +# | | | +# v | v +# [local process] | **************** +--------------+ +# | +---------+ Routing decision +------> |table: filter | +# v **************** |chain: FORWARD| +# **************** +------+-------+ +# Routing decision | +# **************** | +# | | +# v **************** | +# +-------------+ +------> Routing decision <---------------+ +# |table: nat | | **************** +# |chain: OUTPUT| | + +# +-----+-------+ | | +# | | v +# v | +-------------------+ +# +--------------+ | | table: nat | +# |table: filter | +----+ | chain: POSTROUTING| +# |chain: OUTPUT | +--------+----------+ +# +--------------+ | +# v +# XXXXXXXXXXXXXXXXX +# XXXX Network XXXX +# XXXXXXXXXXXXXXXXX +# +# iptables [-t table] {-A|-C|-D} chain rule-specification +# +# iptables [-t table] {-A|-C|-D} chain rule-specification +# +# iptables [-t table] -I chain [rulenum] rule-specification +# +# iptables [-t table] -R chain rulenum rule-specification +# +# iptables [-t table] -D chain rulenum +# +# iptables [-t table] -S [chain [rulenum]] +# +# iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...] +# +# iptables [-t table] -N chain +# +# iptables [-t table] -X [chain] +# +# iptables [-t table] -P chain target +# +# iptables [-t table] -E old-chain-name new-chain-name +# +# rule-specification = [matches...] [target] +# +# match = -m matchname [per-match-options] +# +# +# Targets +# +# can be a user defined chain +# +# ACCEPT - accepts the packet +# DROP - drop the packet on the floor +# QUEUE - packet will be stent to queue +# RETURN - stop traversing this chain and +# resume ate the next rule in the +# previeus (calling) chain. +# +# if packet reach the end of the chain or +# a target RETURN, default policy for that +# chain is applayed. +# +# Target Extensions +# +# AUDIT +# CHECKSUM +# CLASSIFY +# DNAT +# DSCP +# LOG +# Torn on kernel logging, will print some +# some information on all matching packets. +# Log data can be read with dmesg or syslogd. +# This is a non-terminating target and a rule +# should be created with matching criteria. +# +# --log-level level +# Level of logging (numeric or see sys- +# log.conf(5) +# +# --log-prefix prefix +# Prefix log messages with specified prefix +# up to 29 chars log +# +# --log-uid +# Log the userid of the process with gener- +# ated the packet +# NFLOG +# This target pass the packet to loaded logging +# backend to log the packet. One or more userspace +# processes may subscribe to the group to receive +# the packets. +# +# ULOG +# This target provides userspace logging of maching +# packets. One or more userspace processes may then +# then subscribe to various multicast groups and +# then receive the packets. +# +# +# Commands +# +# -A, --append chain rule-specification +# -C, --check chain rule-specification +# -D, --delete chain rule-specification +# -D, --delete chain rulenum +# -I, --insert chain [rulenum] rule-specification +# -R, --replace chain rulenum rule-specification +# -L, --list [chain] +# -P, --policy chain target +# +# Parameters +# +# -p, --protocol protocol +# tcp, udp, udplite, icmp, esp, ah, sctp, all +# -s, --source address[/mask][,...] +# -d, --destination address[/mask][,...] +# -j, --jump target +# -g, --goto chain +# -i, --in-interface name +# -o, --out-interface name +# -f, --fragment +# -m, --match options module-name +# iptables can use extended packet matching +# modules. +# -c, --set-counters packets bytes + +IPT="/usr/sbin/iptables" +SPAMLIST="blockedip" +SPAMDROPMSG="BLOCKED IP DROP" +# public interface to network/internet +BR_IF="br0" +BR_IP="10.0.0.254" +BR_NET="10.0.0.0/8" +GW="10.0.0.1" + +# private interface for virtual/internal +WIFI_IF="wlp7s0" +WIFI_NET="192.168.1.0/24" +#PRI_IP="192.168.1.33" + +echo "Stopping ipv4 firewall and deny everyone..." + +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -t raw -F +iptables -t raw -X +iptables -t security -F +iptables -t security -X +iptables -N blocker + +iptables -N netconf_in +iptables -N netconf_out +iptables -N server_in +iptables -N server_out +iptables -N client_in +iptables -N client_out + +iptables -N srv_dns_in +iptables -N srv_dns_out +iptables -N cli_dns_in +iptables -N cli_dns_out +iptables -N cli_http_in +iptables -N cli_http_out + +# Set Default Rules +iptables -P INPUT DROP +iptables -P FORWARD DROP +iptables -P OUTPUT DROP + +####### blocker Chain ###### +## Block google dns +$IPT -A blocker -s 8.8.0.0/24 -j LOG --log-level 7 --log-prefix "iptables: blocker google: " +$IPT -A blocker -s 8.8.0.0/24 -j DROP +## Block sync +$IPT -A blocker -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: " +$IPT -A blocker -p tcp ! --syn -m state --state NEW -j DROP +## Block Fragments +$IPT -A blocker -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: " +$IPT -A blocker -f -j DROP +$IPT -A blocker -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP +$IPT -A blocker -p tcp --tcp-flags ALL ALL -j DROP +$IPT -A blocker -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: " +$IPT -A blocker -p tcp --tcp-flags ALL NONE -j DROP # NULL packets +$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: " +$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -j DROP +$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: " +$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS +$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: " +$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans +$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP +## Return to caller +$IPT -A blocker -j RETURN + +######## DNS Server +#echo "server_in chain: Allow input to DNS Server" +$IPT -A srv_dns_in -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A srv_dns_in -p tcp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A srv_dns_in -j RETURN +#echo "srv_dns_out chain: Allow output from DNS server" +$IPT -A srv_dns_out -p udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -A srv_dns_out -p tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +$IPT -A srv_dns_out -j RETURN + +######## DNS Client +echo "cli_dns_out chain: Allow output to DNS server" +$IPT -A cli_dns_out -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A cli_dns_out -j RETURN +echo "cli_dns_in chain: Allow input from DNS Server" +$IPT -A cli_dns_in -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A cli_dns_in -j RETURN + +######## HTTP Client +$IPT -A cli_http_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A cli_http_in -j RETURN +#echo "Allow to HTTP server" +$IPT -A cli_http_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A cli_http_out -j RETURN + +####### server input Chain ###### +#echo "server_in chain: Allow to VNC Server" +#$IPT -A server_in -p tcp --dport 5900:5910 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow to DataBase Server" +$IPT -A server_in -p tcp --dport 5432 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow to SSH server" +$IPT -A server_in -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow input to HTTPS Server" +$IPT -A server_in -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow input to HTTP Server" +$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "server_in chain: Allow output from GIT server" +$IPT -A server_in -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A server_in -j RETURN + +####### server output Chain ###### +echo "server_out chain: Allow output from GIT server" +$IPT -A server_out -p tcp --sport 9418 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from https server" +$IPT -A server_out -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from http server" +$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from SSH server" +$IPT -A server_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "server_out chain: Allow output from Data Base server" +$IPT -A server_out -p tcp --sport 5432 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +#echo "server_out chain: Allow output from VNC server" +#$IPT -A server_out -p tcp --sport 5900:5910 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT + +## Return to caller +$IPT -A server_out -j RETURN + +####### client input Chain ###### +echo "client_in chain: Allow input from IRC server" +$IPT -A client_in -p tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from FTP server" +$IPT -A client_in -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from GIT server" +$IPT -A client_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from POP3S server" +$IPT -A client_in -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from SMTPS server" +$IPT -A client_in -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from HTTPS server" +$IPT -A client_in -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A client_in -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from SSH Server" +$IPT -A client_in -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A client_in -p tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +echo "client_in chain: Allow input from GPG key Server" +$IPT -A client_in -p tcp --sport 11371 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT +$IPT -A client_in -j RETURN + +####### client output Chain ###### +echo "client_out chain: Allow output to IRC server" +$IPT -A client_out -p tcp --dport 6667 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to FTP server" +$IPT -A client_out -p tcp --dport 21 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to GIT server" +$IPT -A client_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to POP3S server" +$IPT -A client_out -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to SMTPS server" +$IPT -A client_out -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to HTTPS server" +$IPT -A client_out -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to SSH server" +$IPT -A client_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +echo "client_out chain: Allow output to GPG key Server" +$IPT -A client_out -p tcp --dport 11371 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT +$IPT -A client_out -j RETURN + +####### netconf input Chain ###### +echo "netconf_in chain: Allow DHCP protocol" +$IPT -A netconf_in -p udp --sport 68 --dport 67 -j ACCEPT +echo "netconf_in chain: Allow RIP protocol for ${BR_NET}" +$IPT -A netconf_in -p udp --sport 520 --dport 520 -j ACCEPT +#echo "netconf chain: Allow ICMP from ${BR_NET}" +#$IPT -A netconf_in -p icmp -s ${BR_NET} -j ACCEPT +echo "netconf_in chain: Allow ICMP from all" +$IPT -A netconf_in -p icmp -j ACCEPT + +## Return to caller +$IPT -A netconf_in -j RETURN + + +####### netconf output Chain ###### +echo "netconf_out chain: Allow output from DHCP server" +$IPT -A netconf_out -p udp --sport 67 --dport 68 -j ACCEPT +echo "netconf_out chain: Allow RIP protocol for ${BR_NET}" +$IPT -A netconf_out -p udp --sport 520 --dport 520 -j ACCEPT +#echo "netconf chain: Allow ICMP output to ${BR_NET}" +#$IPT -A netconf_out -p icmp -d ${BR_NET} -j ACCEPT +echo "netconf chain: Allow ICMP output to all" +$IPT -A netconf_out -p icmp -j ACCEPT + +## Return to caller +$IPT -A netconf_out -j RETURN + +############################################################ +# +# Start adding rules tables +# + +echo "Starting ipv4 firewall tables..." + +# Unlimited on loopback +$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT +$IPT -A INPUT -i lo -s ${BR_IP} -d ${BR_IP} -j ACCEPT +$IPT -A OUTPUT -o lo -s ${BR_IP} -d ${BR_IP} -j ACCEPT + +#modprobe ip_conntrack +#modprobe ip_conntrack_ftp +echo 1 > /proc/sys/net/ipv4/ip_forward + +####### Forward Chain ###### +$IPT -A FORWARD -j blocker +$IPT -A FORWARD -i ${BR_IF} -o ${BR_IF} -s ${BR_NET} -d ${BR_NET} -j ACCEPT +$IPT -A FORWARD -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j ACCEPT +#$IPT -A FORWARD -i ${BR_IF} -o ${WIFI_IF} -j ACCEPT +#$IPT -A FORWARD -i ${WIFI_IF} -o ${BR_IF} -j ACCEPT + +####### Input Chain ###### +$IPT -A INPUT -j blocker +$IPT -A INPUT -i ${BR_IF} -j netconf_in +$IPT -A INPUT -i ${BR_IF} -d ${BR_IP} -j srv_dns_in +$IPT -A INPUT -i ${BR_IF} -s ${BR_NET} -d ${BR_IP} -j server_in +#$IPT -A INPUT -i ${WIFI_IF} -d ${WIFI_NET} -j client_in +#$IPT -A INPUT -i ${WIFI_IF} -d ${WIFI_NET} -j cli_dns_in +#$IPT -A INPUT -i ${BR_IF} -d ${BR_IP} -j client_in +# +##$IPT -A INPUT -i ${WIFI_IF} -j server_in +#$IPT -A INPUT -i ${WIFI_IF} -j netconf_in + +####### Output Chain ###### +$IPT -A OUTPUT -j blocker +$IPT -A OUTPUT -o ${BR_IF} -j netconf_out +$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j srv_dns_out +$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j server_out +$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -d ${BR_NET} -j client_out +#$IPT -A OUTPUT -o ${WIFI_IF} -s ${WIFI_NET} -j client_out +#$IPT -A OUTPUT -o ${WIFI_IF} -s ${WIFI_NET} -j cli_dns_out + +#$IPT -A OUTPUT -o ${BR_IF} -s ${BR_IP} -j client_out + +#$IPT -A OUTPUT -o ${WIFI_IF} -j server_out +#$IPT -A OUTPUT -o ${WIFI_IF} -j netconf_out + +####### PostRouting Chain ###### +$IPT -t nat -A POSTROUTING -o ${WIFI_IF} -j MASQUERADE +#$IPT -t nat -A POSTROUTING -o ${BR_IF} -j MASQUERADE + +## log everything else and drop +$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " +$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " +$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " +$IPT -t nat -A POSTROUTING -j LOG --log-level 7 --log-prefix "iptables: POSTROUTING: " +$IPT -t nat -A PREROUTING -j LOG --log-level 7 --log-prefix "iptables: PREROUTING: " +exit 0 diff --git a/core/network.html b/core/network.html index 92f0e1e..57f877a 100644 --- a/core/network.html +++ b/core/network.html @@ -116,14 +116,16 @@ <p>For more information about iptables read <a href="https://wiki.archlinux.org/index.php/Iptables">arch wiki</a>. - You can use - <a href="conf/iptables/rules.v4">/etc/iptables/rules.v4</a> - or - <a href="conf/iptables/iptables-lan.sh">/etc/iptables/iptables-lan.sh</a> - as a template, replace interfaces by correct ones. - This configuration file is used at boot time by iptables-restore command, - if you use a script or change the rules of running system you can - use iptables-save command to save configuration to a file.</p> + Iptables can be setup at startup with + <a href="conf/rc.d/iptables">/etc/rc.d/iptables</a> script, change + <a href="conf/iptables/iptables.sh">/etc/iptables/iptables.sh</a> + with your needs and run to apply, after iptables-save can be used + to create /etc/iptables/rules.v4 file that is used by init script.</p> + + <p>Init script "start" option loads set of rules from file + /etc/iptables/rules.v4, "open" option allows everything to outside + and blocks everything from outside, "stop" will block and log + everything.</p> <pre> # mkdir /etc/iptables |