#!/bin/sh # # XXXXXXXXXXXXXXXXX # XXXX Network XXXX # XXXXXXXXXXXXXXXXX # + # | # v # +-------------+ +------------------+ # |table: filter| <---+ | table: nat | # |chain: INPUT | | | chain: PREROUTING| # +-----+-------+ | +--------+---------+ # | | | # v | v # [local process] | **************** +--------------+ # | +---------+ Routing decision +------> |table: filter | # v **************** |chain: FORWARD| # **************** +------+-------+ # Routing decision | # **************** | # | | # v **************** | # +-------------+ +------> Routing decision <---------------+ # |table: nat | | **************** # |chain: OUTPUT| | + # +-----+-------+ | | # | | v # v | +-------------------+ # +--------------+ | | table: nat | # |table: filter | +----+ | chain: POSTROUTING| # |chain: OUTPUT | +--------+----------+ # +--------------+ | # v # XXXXXXXXXXXXXXXXX # XXXX Network XXXX # XXXXXXXXXXXXXXXXX # # iptables [-t table] {-A|-C|-D} chain rule-specification # # iptables [-t table] {-A|-C|-D} chain rule-specification # # iptables [-t table] -I chain [rulenum] rule-specification # # iptables [-t table] -R chain rulenum rule-specification # # iptables [-t table] -D chain rulenum # # iptables [-t table] -S [chain [rulenum]] # # iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...] # # iptables [-t table] -N chain # # iptables [-t table] -X [chain] # # iptables [-t table] -P chain target # # iptables [-t table] -E old-chain-name new-chain-name # # rule-specification = [matches...] [target] # # match = -m matchname [per-match-options] # # # Targets # # can be a user defined chain # # ACCEPT - accepts the packet # DROP - drop the packet on the floor # QUEUE - packet will be stent to queue # RETURN - stop traversing this chain and # resume ate the next rule in the # previeus (calling) chain. # # if packet reach the end of the chain or # a target RETURN, default policy for that # chain is applayed. # # Target Extensions # # AUDIT # CHECKSUM # CLASSIFY # DNAT # DSCP # LOG # Torn on kernel logging, will print some # some information on all matching packets. # Log data can be read with dmesg or syslogd. # This is a non-terminating target and a rule # should be created with matching criteria. # # --log-level level # Level of logging (numeric or see sys- # log.conf(5) # # --log-prefix prefix # Prefix log messages with specified prefix # up to 29 chars log # # --log-uid # Log the userid of the process with gener- # ated the packet # NFLOG # This target pass the packet to loaded logging # backend to log the packet. One or more userspace # processes may subscribe to the group to receive # the packets. # # ULOG # This target provides userspace logging of maching # packets. One or more userspace processes may then # then subscribe to various multicast groups and # then receive the packets. # # # Commands # # -A, --append chain rule-specification # -C, --check chain rule-specification # -D, --delete chain rule-specification # -D, --delete chain rulenum # -I, --insert chain [rulenum] rule-specification # -R, --replace chain rulenum rule-specification # -L, --list [chain] # -P, --policy chain target # # Parameters # # -p, --protocol protocol # tcp, udp, udplite, icmp, esp, ah, sctp, all # -s, --source address[/mask][,...] # -d, --destination address[/mask][,...] # -j, --jump target # -g, --goto chain # -i, --in-interface name # -o, --out-interface name # -f, --fragment # -m, --match options module-name # iptables can use extended packet matching # modules. # -c, --set-counters packets bytes IPT="/usr/sbin/iptables" SPAMLIST="blockedip" SPAMDROPMSG="BLOCKED IP DROP" PUB_IF="wlp7s0" #PRIV_IF="wlp3s0" BRIDGE="br0" BNET=10.0.0.0 BMSK=24 DHCP_IP="192.168.1.254" PUB_IP=$(ip addr show dev ${PUB_IF} | grep 'state UP' -A2 | tail -n1 | awk '{print $2}' | cut -f1 -d'/') modprobe ip_conntrack modprobe ip_conntrack_ftp echo "Stopping ipv4 firewall and deny everyone..." iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X iptables -t raw -F iptables -t raw -X iptables -t security -F iptables -t security -X echo "Starting ipv4 firewall filter table..." # Set Default Rules iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Unlimited on local $IPT -A INPUT -i lo -j ACCEPT $IPT -A OUTPUT -o lo -j ACCEPT $IPT -A INPUT -i $BRIDGE -j ACCEPT $IPT -A OUTPUT -o $BRIDGE -j ACCEPT # Block sync $IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: " $IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP # Block Fragments $IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: " $IPT -A INPUT -f -j DROP # Block bad stuff $IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP $IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP $IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: " $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: " $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: " $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS $IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: " $IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans $IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP ##### Add your virtual rules below ###### #echo 1 > /proc/sys/net/ipv4/ip_forward #$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} ##$IPT -t nat -A POSTROUTING -s 10.0.2.0/24 -o ${PUB_IF} -j MASQUERADE #$IPT -A FORWARD -i ${TAP_IF} -o ${PUB_IF} -j ACCEPT #$IPT -A FORWARD -i ${PUB_IF} -o ${TAP_IF} -j ACCEPT # #$IPT -A INPUT -i ${TAP_IF} -j ACCEPT #$IPT -A OUTPUT -o ${TAP_IF} -j ACCEPT ##### Add your AP rules below ###### #echo 1 > /proc/sys/net/ipv4/ip_forward #$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP} #$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT #$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT #$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT #$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT ##### Server rules below ###### #echo "Allow ICMP" #$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 0 -s 192.168.0.0/16 -j ACCEPT #$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 0 -d 192.168.0.0/16 -j ACCEPT #$IPT -A INPUT -i ${PUB_IF} -p icmp --icmp-type 8 -s 192.168.0.0/16 -j ACCEPT #$IPT -A OUTPUT -o ${PUB_IF} -p icmp --icmp-type 8 -d 192.168.0.0/16 -j ACCEPT #echo "Allow DNS Server" #$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT #$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -d 192.168.0.0/16 -j ACCEPT #echo "Allow HTTP and HTTPS server" #$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT #$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT #$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT #$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT #echo "Allow ssh server" #$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT #$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT #$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT ##### Add your rules below ###### echo "Allow DNS Client" $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW -j LOG --log-level 7 --log-prefix "iptables: DNS TCP: " $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW -j ACCEPT -j LOG --log-level 7 --log-prefix "iptables: DNS UDP: " $IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT echo "Allow Whois Client" $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 43 -m state --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 43 -m state --state NEW,ESTABLISHED -j ACCEPT echo "Allow HTTP Client" $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT echo "Allow Rsync Client" $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT echo "Allow POP3S Client" $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT echo "Allow SMTPS Client" $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 -m state --state ESTABLISHED -j ACCEPT echo "Allow NTP Client" $IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p udp --sport 123 -m state --state ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT echo "Allow IRC Client" $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW -j ACCEPT echo "Allow Active FTP Client" $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT echo "Allow Git" $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9418 -m state --state NEW -j ACCEPT echo "Allow ssh client" $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT #echo "Allow Passive Connections" $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT # echo "Allow FairCoin" # $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 46392 -m state --state NEW,ESTABLISHED -j ACCEPT # $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 46392 -m state --state ESTABLISHED -j ACCEPT # # echo "Allow Dashcoin" # $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 29080 -m state --state NEW,ESTABLISHED -j ACCEPT # $IPT -A INPUT -i ${PUB_IF} -p tcp --sport 29080 -m state --state ESTABLISHED -j ACCEPT # # echo "Allow warzone2100" # $IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2100 -s 192.168.0.0/16 -j ACCEPT # $IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 2100 -j ACCEPT # $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 2100 -j ACCEPT # $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 9990 -j ACCEPT # echo "Allow wesnoth" $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 15000 -m state --state NEW -j ACCEPT $IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 14998 -m state --state NEW -j ACCEPT ##### END your rules ############ # Less log of known traffic # RIP protocol $IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s 192.168.0.0/16 -j DROP # DHCP $IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_IP -j ACCEPT $IPT -A INPUT -i ${PUB_IF} -p udp --sport 68 --dport 67 -s $DHCP_IP -j ACCEPT # log everything else and drop $IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: " $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: " $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: " exit 0