Súbor: [Platon] / scripts / shell / firewall / fw-universal.sh (stiahnutie)
Revízia 2.0, Sun Nov 14 15:23:09 2004 UTC (19 years, 5 months ago) by rajo
* Firewall configuration is now in config file.
* Default $INET_IFACE removed - replaced by per-interface configuration
options.
* Fixed bug with unloading modules.
* allow_icmp() function was not called - fixed.
|
#!/bin/sh
#
# This will be universal firewalling script for Linux kernel (iptables) in near future
# Can be started by init or by hand.
#
# Developed by Lubomir Host 'rajo' <rajo AT platon.sk>
# Copyright (c) 2003-2004 Platon SDG, http://platon.sk/
# Licensed under terms of GNU General Public License.
# All rights reserved.
#
# $Platon: scripts/shell/firewall/fw-universal.sh,v 1.1 2003/10/24 15:40:44 rajo Exp $
#
# Changelog:
# 2004-11-14 - created
#
DESC="firewall"
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
DEFAULT_CONFIG="${DEFAULT_CONFIG:=/etc/default/firewall}"
if [ -f "$DEFAULT_CONFIG" ]; then
echo "Reading config file $DEFAULT_CONFIG"
. $DEFAULT_CONFIG
fi
#
# Default configuration values:
#
DEFAULT_POLICY="${DEFAULT_POLICY:=DROP}"
# which modules to load
MODULES="${MODULES:=}"
LOG_LIMIT="${LOG_LIMIT:=-m limit --limit 12/h --limit-burst 10}"
# Paths:
#IPTABLES=":" # for testing only - does nothing
IPTABLES="${IPTABLES:=/sbin/iptables}"
IFCONFIG="${IFCONFIG:=/sbin/ifconfig}"
DEPMOD="${DEPMOD:=/sbin/depmod}"
MODPROBE="${MODPROBE:=/sbin/modprobe}"
RMMOD="${RMMOD:=/sbin/rmmod}"
AWK="${AWK:=/usr/bin/awk}"
# loopback interface
LO_IFACE="${LO_IFACE:=lo}"
LO_IP="IP_$LO_IFACE"
# Which ports will be allowed on INPUT (TCP connections)
ALL_ACCEPT_INPUT_TCP="${ALL_ACCEPT_INPUT_TCP:=}"
# interface eth0
eth0_ACCEPT_INPUT_TCP="${eth0_ACCEPT_INPUT_TCP:=}"
# interface ppp0
ppp0_ACCEPT_INPUT_TCP="${ppp0_ACCEPT_INPUT_TCP:=}"
# Which ports will be allowed on INPUT (UDP connections)
# interface eth0
eth0_ACCEPT_INPUT_UDP="${eth0_ACCEPT_INPUT_UDP:=}"
# interface ppp0
ppp0_ACCEPT_INPUT_UDP="${ppp0_ACCEPT_INPUT_UDP:=}"
# allow some ICMP packets - needed for ping etc.
ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}"
# load necessary modules from $MODULES variable
load_modules()
{ # {{{
echo "# Loading modules"
for mod in $MODULES; do
echo " $MODPROBE $mod"
$MODPROBE $mod
done
} # }}}
# unload necessary modules from $MODULES variable
unload_modules()
{ # {{{
# reverse modules
echo "# Removing modules"
R_MODULES=`echo "$MODULES" | tr ' ' '\012' | tac | tr '\012' ' '`
for mod in $R_MODULES; do
echo " $RMMOD $mod"
$RMMOD $mod
done
} # }}}
# print status of detected interfaces
print_iface_status()
{ # {{{
# Print interfaces:
echo "# iface | IP addr | broadcast | netmask | HW addr"
for iface in $interfaces; do
IP="IP_$iface"; Bcast="Bcast_$iface"; Mask="Mask_$iface"; HWaddr="HWaddr_$iface";
echo "$iface | ${!IP} | ${!Bcast} | ${!Mask} | ${!HWaddr}"
done
} # }}}
# set default policy (variable $DEFAULT_POLICY)
set_default_policy()
{ # {{{
# Set default policy
for chain in INPUT OUTPUT FORWARD; do
$IPTABLES -P $chain $DEFAULT_POLICY
done
} # }}}
antispoof_on()
{ # {{{
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo "1" > ${interface}
done
} # }}}
# clear status of iptable chains
remove_chains()
{ # {{{
$IPTABLES -F # clear all chains
$IPTABLES -X # remove all chains
} # }}}
# all packets on loopback are accpted
set_loopback()
{ # {{{
$IPTABLES -A INPUT -j ACCEPT -i $LO_IFACE
$IPTABLES -A OUTPUT -j ACCEPT -o $LO_IFACE
} # }}}
# DROP packages from nmap(1)
nmap_scan_filter()
{ # {{{
echo -en "Turning on nmap scan filter "
for chain in INPUT FORWARD; do
# Nie je nastaveny ziaden bit
$IPTABLES -A $chain -p TCP --tcp-flags ALL NONE $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain ALL NONE: "
echo -en "."
$IPTABLES -A $chain -p TCP --tcp-flags ALL NONE -j DROP
echo -en "."
# dva odporujuuce si flagy su nastavene:
for flags in SYN,FIN SYN,RST FIN,RST ; do
$IPTABLES -A $chain -p TCP --tcp-flags $flags $flags $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain $flags: "
echo -en "."
$IPTABLES -A $chain -p TCP --tcp-flags $flags $flags -j DROP
echo -en "."
done
# je nastavene len $flags bez predpokladaneho ACK
for flags in FIN PSH URG ; do
$IPTABLES -A $chain -p TCP --tcp-flags ACK,$flags $flags $LOG_LIMIT -j LOG --log-prefix "nmap scan $chain ACK,$flags: "
echo -en "."
$IPTABLES -A $chain -p TCP --tcp-flags ACK,$flags $flags -j DROP
echo -en "."
done
done
echo " done."
} # }}}
# drop packets in state INVALID
invalid_packet_filter()
{ # {{{
echo -en "Turning on INVALID packet filter "
for chain in INPUT OUTPUT FORWARD; do
$IPTABLES -A $chain -m state --state INVALID $LOG_LIMIT -j LOG --log-prefix "INVALID $chain: "
echo -en "."
$IPTABLES -A $chain -m state --state INVALID -j DROP
echo -en "."
done
echo " done."
} # }}}
syn_flood()
{ # {{{
$IPTABLES -N syn-flood
$IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood -j DROP
for iface in $INTERFACES; do
$IPTABLES -A INPUT -i $iface -p TCP --syn -j syn-flood
# packet is marked az NEW, but doesn't have SYN flag - drop it
$IPTABLES -A INPUT -i $iface -p TCP ! --syn -m state --state NEW -j DROP
done
} # }}}
anti_spoof_filter()
{ # {{{
# http://www.iana.com/assignments/ipv4-address-space
INET_IFACE=$1
$IPTABLES -N spoof
echo "Turning on antispoof filter for interface $INET_IFACE "
# Ochrana proti Spoogingu zo spatnej slucky
$IPTABLES -A spoof -i $INET_IFACE -s 127.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:127.0.0.0/8 src"
$IPTABLES -A spoof -i $INET_IFACE -s 127.0.0.0/8 -j DROP
$IPTABLES -A spoof -i $INET_IFACE -d 127.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:127.0.0.0/8 dest"
$IPTABLES -A spoof -i $INET_IFACE -d 127.0.0.0/8 -j DROP
# Ochrana proti Spoofingu Internetu z adries urcenych pre lokalne siete
$IPTABLES -A spoof -i $INET_IFACE -s 192.168.0.0/16 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:192.168.0.0/16 src"
$IPTABLES -A spoof -i $INET_IFACE -s 192.168.0.0/16 -j DROP # RFC1918
$IPTABLES -A spoof -i $INET_IFACE -s 172.16.0.0/12 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:172.16.0.0/12 src"
$IPTABLES -A spoof -i $INET_IFACE -s 172.16.0.0/12 -j DROP # RFC1918
$IPTABLES -A spoof -i $INET_IFACE -s 10.0.0.0/8 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:10.0.0.0/8 src"
$IPTABLES -A spoof -i $INET_IFACE -s 10.0.0.0/8 -j DROP # RFC1918 len pre sietovy interface do Internetu, kedze 10.0.0.0 je adresa LAN
$IPTABLES -A spoof -i $INET_IFACE -s 96.0.0.0/4 $LOG_LIMIT -j LOG --log-prefix "Reserved IP:96.0.0.0/4 src"
$IPTABLES -A spoof -i $INET_IFACE -s 96.0.0.0/4 -j DROP # IANA
echo " done."
} # }}}
mangle_prerouting()
{ # {{{
echo -en "Optimizing PREROUTING TOS: "
# TOS flagy slouzi k optimalizaci datovych cest. Pro ssh, ftp a telnet
# pozadujeme minimalni zpozdeni. Pro ftp-data zase maximalni propostnost
$IPTABLES -t mangle -A PREROUTING -p TCP --sport ssh -j TOS --set-tos Minimize-Delay
echo -en "."
$IPTABLES -t mangle -A PREROUTING -p TCP --dport ssh -j TOS --set-tos Minimize-Delay
echo -en "."
$IPTABLES -t mangle -A PREROUTING -p TCP --sport ftp -j TOS --set-tos Minimize-Delay
echo -en "."
$IPTABLES -t mangle -A PREROUTING -p TCP --dport ftp -j TOS --set-tos Minimize-Delay
echo -en "."
$IPTABLES -t mangle -A PREROUTING -p TCP --dport telnet -j TOS --set-tos Minimize-Delay
echo -en "."
$IPTABLES -t mangle -A PREROUTING -p TCP --sport ftp-data -j TOS --set-tos Maximize-Throughput
echo -en "."
echo " done."
} # }}}
mangle_output()
{ # {{{
echo -en "Optimizing OUTPUT TOS:"
# TOS flagy slouzi k optimalizaci datovych cest. Pro ssh, ftp a telnet
# pozadujeme minimalni zpozdeni. Pro ftp-data zase maximalni propostnost
for iface in $INTERFACES; do
echo -en " $iface";
$IPTABLES -t mangle -A OUTPUT -o $iface -p TCP --sport ssh -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $iface -p TCP --dport ssh -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $iface -p TCP --sport ftp -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $iface -p TCP --dport ftp -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $iface -p TCP --dport telnet -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $iface -p TCP --sport ftp-data -j TOS --set-tos Maximize-Throughput
done
echo " done."
} # }}}
allow_input()
{ # {{{
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then
echo -en "Accepting ALL INPUT TCP connections on ports:"
for port in $ALL_ACCEPT_INPUT_TCP; do
for iface in $INTERFACES; do
ip="IP_$iface";
echo -en " $port($iface)"
$IPTABLES -A INPUT -i $iface -d ${!ip} -p TCP --dport $port -j ACCEPT
done
done
echo " done."
fi
for iface in $INTERFACES; do
ip="IP_$iface";
accept_input_tcp="${iface}_ACCEPT_INPUT_TCP"
ACCEPT_INPUT_TCP="${!accept_input_tcp}"
accept_input_udp="${iface}_ACCEPT_INPUT_UDP"
ACCEPT_INPUT_UDP="${!accept_input_udp}"
if [ ! -z "$ACCEPT_INPUT_TCP" ]; then
echo -en "$iface: Accepting INPUT TCP connections on ports: "
for port in $ACCEPT_INPUT_TCP; do
echo -en " $port"
$IPTABLES -A INPUT -i $iface -d ${!ip} -p TCP --dport $port -j ACCEPT
done
echo " done."
fi
if [ ! -z "$ACCEPT_INPUT_UDP" ]; then
echo -en "$iface: Accepting INPUT UDP connections on ports: "
for port in $ACCEPT_INPUT_UDP; do
echo -en " $port"
#$IPTABLES -A INPUT -i $iface -d ${!INET_IP} -p UDP --dport $port -j ACCEPT
#$IPTABLES -A INPUT -i $iface --source 192.168.1.0/16 -p UDP --dport $port -j ACCEPT
$IPTABLES -A INPUT -i $iface -p UDP --dport $port -j ACCEPT
done
echo " done."
fi
done
} # }}}
# ACCEPT all packets from our IP address
allow_output()
{ # {{{
# Povolíme odchozí pakety, které mají naše IP adresy
echo -en "Accepting OUTPUT packets from"
for iface in $INTERFACES; do
ip="IP_$iface";
echo -en " ${!ip}($iface)"
$IPTABLES -A OUTPUT -o $iface -s ${!ip} -j ACCEPT
done;
echo " done.";
} # }}}
allow_icmp()
{ # {{{
echo -en "Accepting ICMP packets:"
# Službu AUTH není dobré filtrovat pomocí DROP, protože to může
# vést k prodlevám při navazování některých spojení. Proto jej
# sice zamítneme, ale vygenerujeme korektní ICMP chybovou zprávu
$IPTABLES -A INPUT -p TCP --dport 113 -j REJECT --reject-with tcp-reset #AUTH server
# accept only allowed ICMP packets
for type in echo-reply destination-unreachable echo-request time-exceeded; do
echo -en " $type"
for iface in $INTERFACES; do
ip="IP_$iface";
$IPTABLES -A INPUT -i $iface -d ${!ip} -p ICMP --icmp-type $type -j ACCEPT
done
done
echo " done."
} # }}}
log_input_drop()
{ # {{{
prefix="input drop: "
echo "Input drop is logged with prefix '$prefix'"
$IPTABLES -A INPUT $LOG_LIMIT -j LOG --log-prefix "$prefix"
} # }}}
log_output_drop()
{ # {{{
prefix="output drop: "
echo "Output drop is logged with prefix '$prefix'"
# Ostatní pakety logujeme (neměly by být žádné takové)
$IPTABLES -A OUTPUT $LOG_LIMIT -j LOG --log-prefix "$prefix"
} # }}}
accept_related()
{ # {{{
echo -en "Accepting ESTABLISHED, RELATED packets for IP:"
for iface in $INTERFACES; do
ip="IP_$iface";
echo -en " ${!ip}($iface)"
$IPTABLES -A INPUT -i $iface -d ${!ip} -m state --state ESTABLISHED,RELATED -j ACCEPT
done
echo " done."
} # }}}
accept_loopback()
{ # {{{
# Loopback není radno omezovat
echo -en "Accepting loopback:"
$IPTABLES -A INPUT -i $LO_IFACE -j ACCEPT
echo " done."
} # }}}
# Parse output from ifconfig: - tested on Linux and FreeBSD
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh
parse_ifconfig()
{ # {{{
# Parse output from ifconfig:
eval `$IFCONFIG | \
$AWK 'BEGIN { interfaces=""; }
/^[a-zA-Z0-9]+[ \t]+/ { # Linux
iface=$1;
interfaces = sprintf("%s %s", interfaces, iface);
printf "\nIFACE_%s=\"%s\"; export IFACE_%s;\n", iface, iface, iface;
printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", iface, $5, iface;
}
/^[ \t]+inet addr:/ { # Linux
split($0, fields, "[ \t:]+");
printf "IP_%s=\"%s\"; export IP_%s;\n", iface, fields[4], iface;
printf "Bcast_%s=\"%s\"; export Bcast_%s;\n", iface, fields[6], iface;
printf "Mask_%s=\"%s\"; export Mask_%s;\n", iface, fields[8], iface;
}
/^[a-zA-Z0-9]+:/ { # FreeBSD
iface = $1;
sub(":", "", iface);
interfaces = sprintf("%s %s", interfaces, iface);
printf "\nIFACE_%s=\"%s\"; export IFACE_%s;\n", iface, iface, iface;
}
/^[ \t]+inet [0-9]+/ { # FreeBSD
printf "IP_%s=\"%s\"; export IP_%s;\n", iface, $2, iface;
printf "Bcast_%s=\"%s\"; export Bcast_%s;\n", iface, $6, iface;
printf "Mask_%s=\"%s\"; export Mask_%s;\n", iface, $4, iface;
}
/^[ \t]+ether/ { # FreeBSD
printf "HWaddr_%s=\"%s\"; export HWaddr_%s;\n", iface, $2, iface;
}
END { printf "\ninterfaces=\"%s\"; export interfaces;\n", interfaces; }
'`
# Now we have defined variables like this:
# IFACE_eth0 HWaddr_eth0 IP_eth0 Bcast_eth0 Mask_eth0
# IFACE_lo HWaddr_lo IP_lo Bcast_lo Mask_lo
# interfaces
} # }}}
parse_ifconfig
print_iface_status
# $interfaces - all interfaces
# $INTERFACES - all interfaces withouth loopback
INTERFACES=""
for iface in $interfaces; do
if [ "o$iface" = "olo" ]; then continue; fi
INTERFACES="$INTERFACES $iface";
done
case "$1" in
start)
echo -n "Starting $DESC: "
# Inicialize modules
$DEPMOD -a
load_modules
remove_chains
#
# (un)commnet next lines as needed
#
set_default_policy
set_loopback
nmap_scan_filter
invalid_packet_filter
#anti_spoof_filter eth0
syn_flood
mangle_prerouting
mangle_output
allow_input
allow_output
allow_icmp
accept_related
accept_loopback
log_input_drop
log_output_drop
;;
stop)
echo -n "Stopping $DESC: "
remove_chains
set_default_policy
unload_modules
;;
status)
print_iface_status; echo
$IPTABLES -L -nv
;;
*)
echo "Usage: $0 {start|stop|stop}" >&2
exit 1
;;
esac
exit 0
# vim600: fdm=marker fdl=0 fdc=3
Platon Group <platon@platon.sk> http://platon.sk/
|