verzia 2.5, 2005/01/02 01:49:01 |
verzia 2.14, 2005/01/16 11:06:46 |
|
|
# Can be started by init or by hand. |
# Can be started by init or by hand. |
# |
# |
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk> |
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk> |
# Copyright (c) 2003-2004 Platon SDG, http://platon.sk/ |
# Copyright (c) 2003-2005 Platon SDG, http://platon.sk/ |
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.4 2004/12/31 01:54:52 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.13 2005/01/16 11:06:10 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2004-11-14 - created |
# 2003-10-24 - created |
# |
# |
|
|
DESC="firewall" |
DESC="firewall" |
Riadok 33 DEFAULT_POLICY="${DEFAULT_POLICY:=DROP}" |
|
Riadok 33 DEFAULT_POLICY="${DEFAULT_POLICY:=DROP}" |
|
# which modules to load |
# which modules to load |
MODULES="${MODULES:=}" |
MODULES="${MODULES:=}" |
|
|
LOG_LIMIT="${LOG_LIMIT:=-m limit --limit 12/h --limit-burst 10}" |
LOG_LIMIT="${LOG_LIMIT:=-m limit --limit 12/h --limit-burst 10 -j LOG --log-level notice --log-prefix}" |
|
|
# Paths: |
# Paths: |
#IPTABLES=":" # for testing only - does nothing |
#IPTABLES=":" # for testing only - does nothing |
IPTABLES="${IPTABLES:=/sbin/iptables}" |
IPTABLES="${IPTABLES:=$DEBUG/sbin/iptables}" |
IFCONFIG="${IFCONFIG:=/sbin/ifconfig}" |
IFCONFIG="${IFCONFIG:=/sbin/ifconfig}" |
DEPMOD="${DEPMOD:=/sbin/depmod}" |
DEPMOD="${DEPMOD:=/sbin/depmod}" |
MODPROBE="${MODPROBE:=/sbin/modprobe}" |
MODPROBE="${MODPROBE:=/sbin/modprobe}" |
Riadok 48 AWK="${AWK:=/usr/bin/awk}" |
|
Riadok 48 AWK="${AWK:=/usr/bin/awk}" |
|
LO_IFACE="${LO_IFACE:=lo}" |
LO_IFACE="${LO_IFACE:=lo}" |
LO_IP="IP_$LO_IFACE" |
LO_IP="IP_$LO_IFACE" |
|
|
# Which ports will be allowed on INPUT (TCP connections) |
|
ALL_ACCEPT_INPUT_TCP="${ALL_ACCEPT_INPUT_TCP:=}" |
|
# interface eth0 |
|
eth0_ACCEPT_INPUT_TCP="${eth0_ACCEPT_INPUT_TCP:=}" |
|
# interface ppp0 |
|
ppp0_ACCEPT_INPUT_TCP="${ppp0_ACCEPT_INPUT_TCP:=}" |
|
|
|
# Which ports will be allowed on INPUT (UDP connections) |
|
# interface eth0 |
|
eth0_ACCEPT_INPUT_UDP="${eth0_ACCEPT_INPUT_UDP:=}" |
|
# interface ppp0 |
|
ppp0_ACCEPT_INPUT_UDP="${ppp0_ACCEPT_INPUT_UDP:=}" |
|
|
|
# allow some ICMP packets - needed for ping etc. |
# allow some ICMP packets - needed for ping etc. |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}" |
|
|
Riadok 116 antispoof_on() |
|
Riadok 103 antispoof_on() |
|
# clear status of iptable chains |
# clear status of iptable chains |
remove_chains() |
remove_chains() |
{ # {{{ |
{ # {{{ |
$IPTABLES -F # clear all chains |
|
$IPTABLES -X # remove all chains |
for table in filter nat mangle; do |
|
$IPTABLES -t $table -F # clear all chains |
|
$IPTABLES -t $table -X # remove all chains |
|
done |
|
|
} # }}} |
} # }}} |
|
|
# all packets on loopback are accpted |
# all packets on loopback are accpted |
Riadok 135 nmap_scan_filter() |
|
Riadok 126 nmap_scan_filter() |
|
|
|
for chain in INPUT FORWARD; do |
for chain in INPUT FORWARD; do |
# Nie je nastaveny ziaden bit |
# Nie je nastaveny ziaden bit |
$IPTABLES -A $chain -p TCP --tcp-flags ALL NONE $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain ALL NONE: " |
$IPTABLES -A $chain -p TCP --tcp-flags ALL NONE $LOG_LIMIT "nmap scan $chain ALL NONE: " |
echo -en "." |
echo -en "." |
$IPTABLES -A $chain -p TCP --tcp-flags ALL NONE -j DROP |
$IPTABLES -A $chain -p TCP --tcp-flags ALL NONE -j DROP |
echo -en "." |
echo -en "." |
|
|
# dva odporujuuce si flagy su nastavene: |
# dva odporujuuce si flagy su nastavene: |
for flags in SYN,FIN SYN,RST FIN,RST ; do |
for flags in SYN,FIN SYN,RST FIN,RST ; do |
$IPTABLES -A $chain -p TCP --tcp-flags $flags $flags $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain $flags: " |
$IPTABLES -A $chain -p TCP --tcp-flags $flags $flags $LOG_LIMIT "nmap scan $chain $flags: " |
echo -en "." |
echo -en "." |
$IPTABLES -A $chain -p TCP --tcp-flags $flags $flags -j DROP |
$IPTABLES -A $chain -p TCP --tcp-flags $flags $flags -j DROP |
echo -en "." |
echo -en "." |
Riadok 150 nmap_scan_filter() |
|
Riadok 141 nmap_scan_filter() |
|
|
|
# je nastavene len $flags bez predpokladaneho ACK |
# je nastavene len $flags bez predpokladaneho ACK |
for flags in FIN PSH URG ; do |
for flags in FIN PSH URG ; do |
$IPTABLES -A $chain -p TCP --tcp-flags ACK,$flags $flags $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain ACK,$flags: " |
$IPTABLES -A $chain -p TCP --tcp-flags ACK,$flags $flags $LOG_LIMIT "nmap scan $chain ACK,$flags: " |
echo -en "." |
echo -en "." |
$IPTABLES -A $chain -p TCP --tcp-flags ACK,$flags $flags -j DROP |
$IPTABLES -A $chain -p TCP --tcp-flags ACK,$flags $flags -j DROP |
echo -en "." |
echo -en "." |
Riadok 167 invalid_packet_filter() |
|
Riadok 158 invalid_packet_filter() |
|
|
|
echo -en "Turning on INVALID packet filter " |
echo -en "Turning on INVALID packet filter " |
for chain in INPUT OUTPUT FORWARD; do |
for chain in INPUT OUTPUT FORWARD; do |
$IPTABLES -A $chain -m state --state INVALID $LOG_LIMIT -j LOG --log-prefix "INVALID $chain: " |
$IPTABLES -A $chain -m state --state INVALID $LOG_LIMIT "INVALID $chain: " |
echo -en "." |
echo -en "." |
$IPTABLES -A $chain -m state --state INVALID -j DROP |
$IPTABLES -A $chain -m state --state INVALID -j DROP |
echo -en "." |
echo -en "." |
Riadok 204 anti_spoof_filter() |
|
Riadok 195 anti_spoof_filter() |
|
$IPTABLES -N spoof |
$IPTABLES -N spoof |
|
|
# Ochrana proti Spoogingu zo spatnej slucky |
# Ochrana proti Spoogingu zo spatnej slucky |
$IPTABLES -A spoof -s 127.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "RESERVED:127.0.0.0/8 src" |
$IPTABLES -A spoof -s 127.0.0.0/8 $LOG_LIMIT "RESERVED:127.0.0.0/8 src" |
$IPTABLES -A spoof -s 127.0.0.0/8 -j DROP |
$IPTABLES -A spoof -s 127.0.0.0/8 -j DROP |
$IPTABLES -A spoof -d 127.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "RESERVED:127.0.0.0/8 dest" |
$IPTABLES -A spoof -d 127.0.0.0/8 $LOG_LIMIT "RESERVED:127.0.0.0/8 dest" |
$IPTABLES -A spoof -d 127.0.0.0/8 -j DROP |
$IPTABLES -A spoof -d 127.0.0.0/8 -j DROP |
# Ochrana proti Spoofingu Internetu z adries urcenych pre lokalne siete |
# Ochrana proti Spoofingu Internetu z adries urcenych pre lokalne siete |
$IPTABLES -A spoof -s 192.168.0.0/16 $LOG_LIMIT -j LOG --log-prefix "RESERVED:192.168.0.0/16 src" |
$IPTABLES -A spoof -s 192.168.0.0/16 $LOG_LIMIT "RESERVED:192.168.0.0/16 src" |
$IPTABLES -A spoof -s 192.168.0.0/16 -j DROP # RFC1918 |
$IPTABLES -A spoof -s 192.168.0.0/16 -j DROP # RFC1918 |
$IPTABLES -A spoof -s 172.16.0.0/12 $LOG_LIMIT -j LOG --log-prefix "RESERVED:172.16.0.0/12 src" |
$IPTABLES -A spoof -s 172.16.0.0/12 $LOG_LIMIT "RESERVED:172.16.0.0/12 src" |
$IPTABLES -A spoof -s 172.16.0.0/12 -j DROP # RFC1918 |
$IPTABLES -A spoof -s 172.16.0.0/12 -j DROP # RFC1918 |
$IPTABLES -A spoof -s 10.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "RESERVED:10.0.0.0/8 src" |
$IPTABLES -A spoof -s 10.0.0.0/8 $LOG_LIMIT "RESERVED:10.0.0.0/8 src" |
$IPTABLES -A spoof -s 10.0.0.0/8 -j DROP # RFC1918 len pre sietovy interface do Internetu, kedze 10.0.0.0 je adresa LAN |
$IPTABLES -A spoof -s 10.0.0.0/8 -j DROP # RFC1918 len pre sietovy interface do Internetu, kedze 10.0.0.0 je adresa LAN |
$IPTABLES -A spoof -s 96.0.0.0/4 $LOG_LIMIT -j LOG --log-prefix "RESERVED:96.0.0.0/4 src" |
$IPTABLES -A spoof -s 96.0.0.0/4 $LOG_LIMIT "RESERVED:96.0.0.0/4 src" |
$IPTABLES -A spoof -s 96.0.0.0/4 -j DROP # IANA |
$IPTABLES -A spoof -s 96.0.0.0/4 -j DROP # IANA |
|
|
for iface in $ANTISPOOF_IFACE; do |
for iface in $ANTISPOOF_IFACE; do |
Riadok 272 mangle_output() |
|
Riadok 263 mangle_output() |
|
masquerade() |
masquerade() |
{ # {{{ |
{ # {{{ |
if [ ! -z "$NAT_LAN_IFACE" ]; then |
if [ ! -z "$NAT_LAN_IFACE" ]; then |
echo -en "Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE" |
echo -en "NAT: Masquerading local subnet: $NAT_SUBNET_IFACE --> $NAT_LAN_IFACE" |
|
|
ip="IP_$NAT_SUBNET_IFACE"; |
ip="IP_$NAT_SUBNET_IFACE"; |
netmask="Mask_$NAT_SUBNET_IFACE" |
netmask="Mask_$NAT_SUBNET_IFACE" |
|
|
--dport $remote_port -j REDIRECT --to-port $local_port |
--dport $remote_port -j REDIRECT --to-port $local_port |
done |
done |
|
|
$IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE |
#$IPTABLES -t nat -A POSTROUTING -s $localnet -o $NAT_LAN_IFACE -j MASQUERADE |
|
$IPTABLES -t nat -A POSTROUTING -o $NAT_LAN_IFACE -j MASQUERADE |
|
|
|
echo " done." |
|
|
# don't forward Miscrosoft protocols - NOT RFC compliant packets |
# don't forward Miscrosoft protocols - NOT RFC compliant packets |
if [ ! -z "$NAT_FORWARD_MICROSOFT" ]; then |
if [ ! -z "$NAT_FORWARD_MICROSOFT" ]; then |
|
|
fi |
fi |
|
|
if [ ! -z "$NAT_FORWARD_TCP_PORTS" ]; then |
if [ ! -z "$NAT_FORWARD_TCP_PORTS" ]; then |
echo -en "Accepting FORWARD TCP ports:" |
echo -en "\tAccepting FORWARD TCP ports:" |
for port in $NAT_FORWARD_TCP_PORTS; do |
for port in $NAT_FORWARD_TCP_PORTS; do |
echo -en " $port" |
echo -en " $port" |
$IPTABLES -A FORWARD -p TCP --dport $port -m state --state NEW -j ACCEPT |
$IPTABLES -A FORWARD -p TCP --dport $port -m state --state NEW -j ACCEPT |
|
|
fi |
fi |
|
|
if [ ! -z "$NAT_FORWARD_UDP_PORTS" ]; then |
if [ ! -z "$NAT_FORWARD_UDP_PORTS" ]; then |
echo -en "Accepting FORWARD UDP ports:" |
echo -en "\tAccepting FORWARD UDP ports:" |
for port in $NAT_FORWARD_UDP_PORTS; do |
for port in $NAT_FORWARD_UDP_PORTS; do |
echo -en " $port" |
echo -en " $port" |
$IPTABLES -A FORWARD -p UDP --dport $port -m state --state NEW -j ACCEPT |
$IPTABLES -A FORWARD -p UDP --dport $port -m state --state NEW -j ACCEPT |
|
|
echo " done." |
echo " done." |
fi |
fi |
|
|
|
echo -en "\tAccepting ICMP packets:" |
|
for type in $ACCEPT_ICMP_PACKETS; do |
|
echo -en " $type" |
|
$IPTABLES -A FORWARD -p ICMP --icmp-type $type -j ACCEPT |
|
done |
|
#$IPTABLES -A FORWARD -p ICMP -j LOG --log-prefix "FWD ICMP: " |
|
echo " done." |
|
|
# Keep state of connections from private subnets |
# Keep state of connections from private subnets |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A OUTPUT -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
#$IPTABLES -A FORWARD -m state --state NEW -o $NAT_LAN_IFACE -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT |
|
|
echo " done." |
|
|
|
fi |
fi |
} # }}} |
} # }}} |
|
|
|
|
echo -en " $iface" |
echo -en " $iface" |
$IPTABLES -A INPUT -i $iface -j ACCEPT |
$IPTABLES -A INPUT -i $iface -j ACCEPT |
$IPTABLES -A FORWARD -i $iface -j ACCEPT |
$IPTABLES -A FORWARD -i $iface -j ACCEPT |
|
$IPTABLES -A OUTPUT -o $iface -j ACCEPT |
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
|
done |
done |
echo " done." |
echo " done." |
fi |
fi |
|
if [ ! -z "$ALL_ACCEPT_INPUT_UDP" ]; then |
|
echo -en "Accepting ALL INPUT UDP connections on ports:" |
|
for port in $ALL_ACCEPT_INPUT_UDP; do |
|
for iface in $INTERFACES; do |
|
ip="IP_$iface"; |
|
echo -en " $port($iface)" |
|
$IPTABLES -A INPUT -i $iface -p UDP --dport $port -j ACCEPT |
|
done |
|
done |
|
echo " done." |
|
fi |
|
|
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
ip="IP_$iface"; |
|
|
$IPTABLES -A INPUT -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server |
$IPTABLES -A INPUT -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server |
|
|
# accept only allowed ICMP packets |
# accept only allowed ICMP packets |
for type in echo-reply destination-unreachable echo-request time-exceeded; do |
for type in $ACCEPT_ICMP_PACKETS; do |
echo -en " $type" |
echo -en " $type" |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
ip="IP_$iface"; |
ip="IP_$iface"; |
$IPTABLES -A INPUT -i $iface -d ${!ip} -p ICMP --icmp-type $type -j ACCEPT |
$IPTABLES -A INPUT -i $iface -d ${!ip} -p ICMP --icmp-type $type -j ACCEPT |
done |
done |
done |
done |
|
#$IPTABLES -A INPUT -p ICMP -j LOG --log-prefix "IN ICMP: " |
|
#$IPTABLES -A OUTPUT -p ICMP -j LOG --log-prefix "OUT ICMP: " |
echo " done." |
echo " done." |
|
|
} # }}} |
} # }}} |
Riadok 475 log_input_drop() |
|
Riadok 489 log_input_drop() |
|
|
|
prefix="input drop: " |
prefix="input drop: " |
echo "Input drop is logged with prefix '$prefix'" |
echo "Input drop is logged with prefix '$prefix'" |
$IPTABLES -A INPUT $LOG_LIMIT -j LOG --log-prefix "$prefix" |
$IPTABLES -A INPUT $LOG_LIMIT "$prefix" |
|
|
} # }}} |
} # }}} |
|
|
Riadok 484 log_output_drop() |
|
Riadok 498 log_output_drop() |
|
|
|
prefix="output drop: " |
prefix="output drop: " |
echo "Output drop is logged with prefix '$prefix'" |
echo "Output drop is logged with prefix '$prefix'" |
$IPTABLES -A OUTPUT $LOG_LIMIT -j LOG --log-prefix "$prefix" |
$IPTABLES -A OUTPUT $LOG_LIMIT "$prefix" |
|
|
} # }}} |
} # }}} |
|
|
Riadok 493 log_forward_drop() |
|
Riadok 507 log_forward_drop() |
|
|
|
prefix="forward drop: " |
prefix="forward drop: " |
echo "Forward drop is logged with prefix '$prefix'" |
echo "Forward drop is logged with prefix '$prefix'" |
$IPTABLES -A FORWARD $LOG_LIMIT -j LOG --log-prefix "$prefix" |
$IPTABLES -A FORWARD $LOG_LIMIT "$prefix" |
|
|
} # }}} |
} # }}} |
|
|