#!/bin/sh

#
# This will be universal firewalling script in near future
# Can be started by init or by hand.
#
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk>
# Copyright (c) 2003 Platon SDG, http://platon.sk/
# Licensed under terms of GNU General Public License.
# All rights reserved.
#
# $Platon: $
#

#
# Config:
#

DESC="firewall"
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

DEFAULT_POLICY="DROP"
# which modules to load
MODULES="ipt_LOG ipt_REJECT ip_conntrack_ftp"

LOG_LIMIT="-m limit --limit 12/h --limit-burst 10"

# Paths:
IPTABLES="/sbin/iptables"
#IPTABLES=":" # for testing only - does nothing
IFCONFIG="/sbin/ifconfig"
DEPMOD="/sbin/depmod"
MODPROBE="/sbin/modprobe"
RMMOD="/sbin/rmmod"

AWK="/usr/bin/awk"

# interface connected to cruel world (internet jungle)
INET_IFACE="eth0"
INET_IP="IP_$INET_IFACE"

# loopback interface
LO_IFACE="lo"
LO_IP="IP_$LO_IFACE"

# Which ports will be allowed on INPUT (TCP connections)
# 21 - ftp, 22 - ssh, 25 - smtp, 53 - DNS server TCP, 80 - www, 110 - POP3
# 143 - IMAP, 443 - HTTPS, 873 - rsync server
# 123 137 138 139 631 - samba
ACCEPT_INPUT_TCP="123 137 138 139 631 22 80"

# Which ports will be allowed on INPUT (UDP connections)
# 53 - DNS server, 517 - talk, 518 - ntalk
ACCEPT_INPUT_UDP="123 137 138 139 631"

# allow some ICMP packets - needed for ping etc.
ACCEPT_ICMP_PACKETS="echo-reply destination-unreachable echo-request time-exceeded"

# load necessary modules from $MODULES variable
load_modules()
{ # {{{
	echo "# Loading modules"
	for mod in $MODULES; do
		echo "	$MODPROBE $mod"
		$MODPROBE $mod
	done
} # }}}

# unload necessary modules from $MODULES variable
unload_modules()
{ # {{{
	# reverse modules
	echo "# Removing modules"
	R_MODULES=`echo "$MODULES" | tr ' ' '\012' | tac | tr '\012' ' '`
	for mod in $R_MODULES; do
		echo "	$RMMOD $mod"
		$RMMOD $mod
	done
} # }}}

# print status of found interfaces
print_iface_status()
{ # {{{
	# Print interfaces:
	echo "# iface	| IP addr	| broadcast	| netmask	| HW addr"
	for iface in $interfaces; do
		IP="IP_$iface"; Bcast="Bcast_$iface"; Mask="Mask_$iface"; HWaddr="HWaddr_$iface";
		echo "$iface	| ${!IP}	| ${!Bcast}	| ${!Mask}	| ${!HWaddr}"
	done
} # }}}

# set default policy (variable $DEFAULT_POLICY)
set_default_policy()
{ # {{{
	# Set default policy
	for chain in INPUT OUTPUT FORWARD; do
		$IPTABLES -P $chain $DEFAULT_POLICY
	done
} # }}}

antispoof_on()
{ # {{{
	for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
		echo "1" > ${interface}
	done
} # }}}

# clear status of iptable chains
remove_chains()
{ # {{{
	$IPTABLES -F # clear all chains
	$IPTABLES -X # remove all chains
} # }}}

# all packets on loopback are accted
set_loopback()
{ # {{{
	$IPTABLES -A INPUT  -j ACCEPT -i $LO_IFACE
	$IPTABLES -A OUTPUT -j ACCEPT -o $LO_IFACE
} # }}}

# DROP packages from nmap(1)
nmap_scan_filter()
{ # {{{

	echo -en "Turning on nmap scan filter "

	for chain in INPUT FORWARD; do
		echo -en "."
		#  Nie je nastaveny ziaden bit
		$IPTABLES -A $chain   -p tcp --tcp-flags ALL NONE  $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain ALL NONE: "
		$IPTABLES -A $chain   -p tcp --tcp-flags ALL NONE -j DROP 

		# dva odporujuuce si flagy su nastavene:
		for flags in   SYN,FIN   SYN,RST   FIN,RST   ; do
			echo -en "."
			$IPTABLES -A $chain   -p tcp --tcp-flags $flags $flags $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain $flags: "
			$IPTABLES -A $chain   -p tcp --tcp-flags $flags $flags -j DROP 
		done

		# je nastavene len $flags bez predpokladaneho ACK
		for flags in   FIN   PSH   URG   ; do
			echo -en "."
			$IPTABLES -A $chain   -p tcp --tcp-flags ACK,$flags $flags $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain ACK,$flags: "
			$IPTABLES -A $chain   -p tcp --tcp-flags ACK,$flags $flags -j DROP 
		done
	done
	
	echo "done."

} # }}}

# drop packets in state INVALID
invalid_packet_filter()
{ # {{{
	
	echo -en "Turning on INVALID packet filter "
	for chain in INPUT OUTPUT FORWARD; do
		echo -en "."
		$IPTABLES -A $chain -m state --state INVALID $LOG_LIMIT  -j LOG --log-prefix "INVALID $chain: "
		$IPTABLES -A $chain -m state --state INVALID -j DROP 
	done

	echo "done."

} # }}}

syn_flood()
{ # {{{
	$IPTABLES -N syn-flood
	$IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
	$IPTABLES -A syn-flood -j DROP

	$IPTABLES -A INPUT -i $INET_IFACE -p tcp --syn -j syn-flood

	# Paket je označený jako NEW, ale nemá nastavený SYN flag - pryč s ním
	$IPTABLES -A INPUT -i $INET_IFACE -p tcp ! --syn -m state --state NEW -j DROP


} # }}}

anti_spoof_filter()
{ # {{{
	
#   http://www.iana.com/assignments/ipv4-address-space

	$IPTABLES -N spoof

	echo "Turning on antispoof filter for interface $INET_IFACE "
	# Ochrana proti Spoogingu zo spetnej slucky
	$IPTABLES -A spoof -i $INET_IFACE -s 127.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:127.0.0.0/8 src" 
	$IPTABLES -A spoof -i $INET_IFACE -s 127.0.0.0/8 -j DROP 
	$IPTABLES -A spoof -i $INET_IFACE -d 127.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:127.0.0.0/8 dest"
	$IPTABLES -A spoof -i $INET_IFACE -d 127.0.0.0/8 -j DROP
	# Ochrana proti Spoofingu Internetu z adries urcenych pre lokalne siete 
	$IPTABLES -A spoof -i $INET_IFACE -s 192.168.0.0/16 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:192.168.0.0/16 src"
	$IPTABLES -A spoof -i $INET_IFACE -s 192.168.0.0/16 -j DROP 		# RFC1918
	$IPTABLES -A spoof -i $INET_IFACE -s 172.16.0.0/12 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:172.16.0.0/12 src"
	$IPTABLES -A spoof -i $INET_IFACE -s 172.16.0.0/12 -j DROP 		# RFC1918
	$IPTABLES -A spoof -i $INET_IFACE -s 10.0.0.0/8  $LOG_LIMIT -j LOG --log-prefix "Reserved IP:10.0.0.0/8 src"
	$IPTABLES -A spoof -i $INET_IFACE -s 10.0.0.0/8 -j DROP  # RFC1918 len pre sietovy interface do Internetu, kedze 10.0.0.0 je adresa LAN
	$IPTABLES -A spoof -i $INET_IFACE -s 96.0.0.0/4 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:96.0.0.0/4 src"
	$IPTABLES -A spoof -i $INET_IFACE -s 96.0.0.0/4 -j DROP  			# IANA
	echo "... done."
} # }}}

mangle_prerouting()
{ # {{{

	echo "Optimizing PREROUTING TOS"
	# TOS flagy slouzi k optimalizaci datovych cest. Pro ssh, ftp a telnet
	# pozadujeme minimalni zpozdeni. Pro ftp-data zase maximalni propostnost
	$IPTABLES -t mangle -A PREROUTING -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A PREROUTING -p tcp --dport ssh -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A PREROUTING -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A PREROUTING -p tcp --dport ftp -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A PREROUTING -p tcp --dport telnet -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A PREROUTING -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput

} # }}}

mangle_output()
{ # {{{

	echo "Optimizing OUTPUT TOS"
	# TOS flagy slouzi k optimalizaci datovych cest. Pro ssh, ftp a telnet
	# pozadujeme minimalni zpozdeni. Pro ftp-data zase maximalni propostnost
	$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport ssh -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport ftp -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --dport telnet -j TOS --set-tos Minimize-Delay
	$IPTABLES -t mangle -A OUTPUT -o $INET_IFACE -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput

} # }}}

# accept TCP packets for ports in $ACCEPT_INPUT_TCP
# accept UDP packets for ports in $ACCEPT_INPUT_UDP
allow_input()
{ # {{{
	if [ ! -z "$ACCEPT_INPUT_TCP" ]; then
		echo -en "Accepting INPUT TCP connections on ports: "
		for port in $ACCEPT_INPUT_TCP; do
			echo -en " $port"
			$IPTABLES -A INPUT -i $INET_IFACE -d ${!INET_IP} -p TCP --dport $port -j ACCEPT
		done
		echo "."
	fi

	if [ ! -z "$ACCEPT_INPUT_UDP" ]; then
		echo -en "Accepting INPUT UDP connections on ports: "
		for port in $ACCEPT_INPUT_UDP; do
			echo -en " $port"
			#$IPTABLES -A INPUT -i $INET_IFACE -d ${!INET_IP} -p UDP --dport $port -j ACCEPT
			$IPTABLES -A INPUT -i $INET_IFACE -p UDP --dport $port -j ACCEPT
		done
		echo "."
	fi

} # }}}

# ACCEPT all packets from our IP address
allow_output()
{ # {{{

	# Povolíme odchozí pakety, které mají naše IP adresy
	echo "Accepting OUTPUT packets from ${!LO_IP} ${!INET_IP}"
	$IPTABLES -A OUTPUT -s ${!LO_IP} -j ACCEPT
	$IPTABLES -A OUTPUT -s ${!INET_IP} -j ACCEPT

} # }}}

allow_icmp()
{ # {{{

	echo -en "Accepting ICMP packets:"
	# Službu AUTH není dobré filtrovat pomocí DROP, protože to může
	# vést k prodlevám při navazování některých spojení. Proto jej
	# sice zamítneme, ale vygenerujeme korektní ICMP chybovou zprávu
	$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server

	# accept only allowed ICMP packets
	for type in $ACCEPT_ICMP_PACKETS; do
		echo -en " $type"
		$IPTABLES -A INPUT -i $INET_IFACE -p ICMP --icmp-type $type -j ACCEPT
	done
	echo "	done."

} # }}}

log_input_drop()
{ # {{{

	prefix="input drop: "
	echo "Input drop is logged with prefix '$prefix'"
	$IPTABLES -A INPUT $LOG_LIMIT -j LOG --log-prefix "$prefix"

} # }}}

log_output_drop()
{ # {{{

	prefix="output drop: "
	echo "Output drop is logged with prefix '$prefix'"
	# Ostatní pakety logujeme (neměly by být žádné takové)
	$IPTABLES -A OUTPUT $LOG_LIMIT -j LOG --log-prefix "$prefix"

} # }}}

accept_related()
{ # {{{
	
	echo "Accepting ESTABLISHED, RELATED packets for IP ${!INET_IP}"
	$IPTABLES -A INPUT -d ${!INET_IP} -m state --state ESTABLISHED,RELATED -j ACCEPT

} # }}}

accept_loopback()
{ # {{{
	
	# Loopback není radno omezovat
	echo "Accepting loopback"
	$IPTABLES -A INPUT -i $LO_IFACE -j ACCEPT

} # }}}

# Parse output from ifconfig: - tested on Linux and FreeBSD
# -- creates shell variables like IP_eth0="192.168.1.123"
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh
parse_ifconfig()
{ # {{{
	# Parse output from ifconfig:
	eval `$IFCONFIG | \
		$AWK 'BEGIN { interfaces=""; }
			/^[a-zA-Z0-9]+[ \t]+/ { # Linux
				iface=$1;
				interfaces = sprintf("%s %s", interfaces, iface);
				printf "\nIFACE_%s=\"%s\";	export IFACE_%s;\n", iface, iface, iface;
				printf "HWaddr_%s=\"%s\";	export HWaddr_%s;\n", iface, $5, iface;
			}
			/^[ \t]+inet addr:/ { # Linux
				split($0, fields, "[ \t:]+");
				printf "IP_%s=\"%s\";	export IP_%s;\n", iface, fields[4], iface;
				printf "Bcast_%s=\"%s\";	export Bcast_%s;\n", iface, fields[6], iface;
				printf "Mask_%s=\"%s\";	export Mask_%s;\n", iface, fields[8],  iface;
			}
			/^[a-zA-Z0-9]+:/ { # FreeBSD
				iface = $1;
				sub(":", "", iface);
				interfaces = sprintf("%s %s", interfaces, iface);
				printf "\nIFACE_%s=\"%s\";	export IFACE_%s;\n", iface, iface, iface;
			}
			/^[ \t]+inet [0-9]+/ { # FreeBSD
				printf "IP_%s=\"%s\";	export IP_%s;\n", iface, $2, iface;
				printf "Bcast_%s=\"%s\";	export Bcast_%s;\n", iface, $6, iface;
				printf "Mask_%s=\"%s\";	export Mask_%s;\n", iface, $4,  iface;
			}
			/^[ \t]+ether/ { # FreeBSD
				printf "HWaddr_%s=\"%s\";	export HWaddr_%s;\n", iface, $2, iface;
			}
			END { printf "\ninterfaces=\"%s\"; 	export interfaces;\n", interfaces; }
	'`

	# Now we have defined variables like this:
	# IFACE_eth0 HWaddr_eth0 IP_eth0 Bcast_eth0 Mask_eth0
	# IFACE_lo   HWaddr_lo   IP_lo   Bcast_lo   Mask_lo
	# interfaces

} # }}}


parse_ifconfig

case "$1" in
	start)
		echo -n "Starting $DESC: "
		# Inicialize modules
		$DEPMOD -a
		load_modules

		#
		# (un)commnet next lines as needed
		#
		set_default_policy
		set_loopback
		nmap_scan_filter
		invalid_packet_filter
		#anti_spoof_filter
		syn_flood
		mangle_prerouting
		mangle_output
		allow_input
		allow_output
		accept_related
		accept_loopback
		log_input_drop
		log_output_drop
		;;
		
	stop)
		echo -n "Stopping $DESC: "
		unload_modules
		remove_chains
		set_default_policy
		;;

	status)
		print_iface_status; echo
		$IPTABLES -L -nv
		;;

	*)
		echo "Usage: $0 {start|stop|stop}" >&2
		exit 1
		;;
esac

exit 0

# vim600: fdm=marker fdl=0 fdc=3