GentooForum.de

Quellcode

#!/bin/bash

echo "1" > /proc/sys/net/ipv4/ip_forward #forwarding initialisieren

ifcfg() {
	/bin/sed -n -e 's|.* inet \([^ ]\+\)/\([^ ]\+\) brd \([^ ]\+\) .* global \([^ ]\+\).*|'"${2}"'|p' \
   	-e 's|.* inet \([^ ]\+\)\(\) peer \([^ ]\+\) .* global \([^ ]\+\).*|'"${2}"'|p' <(LC_ALL="C" /sbin/ip addr show ${1})
}

ifaddr() {
	ifcfg "${1}" '\1'
}

ifnet() {
	ifcfg "${1}" '\1/\2'
}


#####################
##### Variablen #####

EXT_IF="ppp0" # Schnittstelle zum Internet
INT_IF="eth1.1" # Schnittstelle, an dem das Netzwerk hängt.
DMZ_IF="eth1.2"
SERVICES_UDP="ftp 5060" #freigegebene UDP-Ports (asterisk)
SERVICES_TCP="ftp http 822 https 987 5060" #freigegebene TCP-Ports (ftp ssh http, https, rdp)
# port ssh nach 822 verschoben! - nicht meckern, staunen!

#####################################
##### Vorhandene Regeln löschen #####
echo "Firewall: zurücksetzen"
iptables -F #löscht alle Regeln
iptables -t nat -F
iptables -t mangle -F
iptables -X #löscht eigene Ketten
iptables -t nat -X
iptables -t mangle -X

#######################
##### Grundregeln #####
echo "Firewall: Grundregeln alles löschen"
iptables -P OUTPUT  DROP
iptables -P INPUT   DROP
iptables -P FORWARD DROP

# Reject packets from RFC1918 class networks (i.e., spoofed)
# apply this for all external interfaces
iptables -N rfc1918
iptables -F rfc1918
iptables -A rfc1918 -s 10.0.0.0/8   	-j DROP
iptables -A rfc1918 -s 169.254.0.0/16   -j DROP
iptables -A rfc1918 -s 172.16.0.0/12	-j DROP
iptables -A rfc1918 -s 127.0.0.0/8  	-j DROP
iptables -A rfc1918 -s 224.0.0.0/4  	-j DROP
iptables -A rfc1918 -d 224.0.0.0/4  	-j DROP
iptables -A rfc1918 -s 240.0.0.0/5  	-j DROP
iptables -A rfc1918 -d 240.0.0.0/5  	-j DROP
iptables -A rfc1918 -s 0.0.0.0/8    	-j DROP
iptables -A rfc1918 -d 0.0.0.0/8    	-j DROP
iptables -A rfc1918 -d 239.255.255.0/24 -j DROP
iptables -A rfc1918 -d 255.255.255.255  -j DROP

# Catchdetect-portscanners protection
iptables -N handle-portscan
iptables -F handle-portscan
iptables -A handle-portscan -m limit --limit 5/minute -j LOG --log-level alert --log-tcp-options --log-prefix "[PORTSCAN] "
iptables -A handle-portscan -j DROP
iptables -N detect-portscan
iptables -F detect-portscan
iptables -A detect-portscan -j handle-portscan -p tcp --tcp-flags ALL FIN,URG,PSH     	# "NMAP-XMAS"
iptables -A detect-portscan -j handle-portscan -p tcp --tcp-flags ALL ALL             	# "XMAS"
iptables -A detect-portscan -j handle-portscan -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG # "XMAS-PSH"
iptables -A detect-portscan -j handle-portscan -p tcp --tcp-flags ALL NONE            	# "NULL_SCAN"
iptables -A detect-portscan -j handle-portscan -p tcp --tcp-flags SYN,RST SYN,RST     	# "SYN/RST"
iptables -A detect-portscan -j handle-portscan -p tcp --tcp-flags SYN,FIN SYN,FIN     	# "SYN/FIN"

# Allow most ICMP packets to be received (so people can check our
# presence), but restrict the flow to avoid ping flood attacks
iptables -N icmp-input
iptables -F icmp-input
iptables -A icmp-input -j ACCEPT -p icmp --icmp-type echo-reply
iptables -A icmp-input -j ACCEPT -p icmp --icmp-type source-quench
iptables -A icmp-input -j ACCEPT -p icmp --icmp-type time-exceeded
iptables -A icmp-input -j ACCEPT -p icmp --icmp-type destination-unreachable
iptables -A icmp-input -j ACCEPT -p icmp --icmp-type echo-request -m limit --limit 1/second
iptables -A icmp-input -j DROP
iptables -N icmp-output
iptables -F icmp-output
iptables -A icmp-output -j DROP -p icmp --icmp-type timestamp-reply
iptables -A icmp-output -j DROP -p icmp --icmp-type address-mask-reply
iptables -A icmp-output -j ACCEPT
iptables -N icmp-forward
iptables -F icmp-forward
iptables -A icmp-forward -j ACCEPT -p icmp --icmp-type echo-reply
iptables -A icmp-forward -j ACCEPT -p icmp --icmp-type time-exceeded
iptables -A icmp-forward -j ACCEPT -p icmp --icmp-type destination-unreachable
iptables -A icmp-forward -j ACCEPT -p icmp --icmp-type echo-request -m limit --limit 1/second
iptables -A icmp-forward -j DROP


################################
##### freigegebene Dienste #####

iptables -N services
iptables -F services
#iptables -A services -p tcp -j service_sec
echo "Firewall: TCP Dienst $SERVICES_TCP"
iptables -A services -p tcp -m multiport --dports "${SERVICES_TCP// /,}" -j ACCEPT
echo "Firewall: UDP Dienst $SERVICES_UDP"
iptables -A services -p udp -m multiport --dports "${SERVICES_UDP// /,}" -j ACCEPT
#################
##### INPUT #####
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A INPUT -j DROP   -m state --state INVALID

## local
echo "Firewall: eigene Anfragen"
iptables -A INPUT -i lo -j ACCEPT

# let DHCP requests through : pppoe-connect
iptables -A INPUT -j ACCEPT -p udp ! -i ${EXT_IF} --dport 67:68 --sport 67:68

## aus dem Internet (ppp0)
echo "Firewall: Neue Anfragen aus dem Netz"
# restrict icmp traffic
iptables -A INPUT -j icmp-input -p icmp

#sicherheit
iptables -A INPUT -i $EXT_IF -j rfc1918
iptables -A INPUT -i $EXT_IF -j detect-portscan
iptables -A INPUT -i $EXT_IF -j services #Dienste freigeben

#iptables -A INPUT -p ALL -i $EXT_IF -m state --state ESTABLISHED,RELATED -j ACCEPT

## aus dem Ethernet (ethX)
echo "Firewall: lokale Anfragen"
iptables -A INPUT -i $INT_IF -j ACCEPT
iptables -A INPUT -i $DMZ_IF -j ACCEPT

# alles andere wech
iptables -A INPUT ! -i ${EXT_IF} -m limit --limit 1/min -j LOG --log-prefix "[INPUT] "
iptables -A INPUT -j REJECT -p udp --reject-with icmp-port-unreachable
iptables -A INPUT -j REJECT -p tcp --reject-with tcp-reset
iptables -P INPUT DROP

##################
##### OUTPUT #####
echo "Firewall: alles weiterleiten"
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A OUTPUT -j DROP   -m state --state INVALID

# restrict icmp traffic
iptables -A OUTPUT -j icmp-output -p icmp
iptables -P OUTPUT ACCEPT

###################
##### FORWARD #####

iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j DROP   -m state --state INVALID

# restrict icmp traffic
iptables -A FORWARD -j icmp-forward -p icmp

## aus dem Ethernet (ethX)
iptables -A FORWARD -p ALL -i $INT_IF -o $EXT_IF -j ACCEPT
iptables -A FORWARD -p ALL -i $DMZ_IF -o $EXT_IF -j ACCEPT

## Weiterleitung Asterisk und iphone
iptables -A FORWARD -i ${EXT_IF} -o ${INT_IF} -p tcp -d 192.168.1.11 --dport 443 -j ACCEPT
iptables -A FORWARD -i ${EXT_IF} -o ${INT_IF} -p udp -d 192.168.1.13 --dport 5060 -j ACCEPT

# Anything else LOG & REJECT
iptables -A FORWARD ! -i ${EXT_IF} -m limit --limit 1/min -j LOG --log-prefix "[FORWARD] "
iptables -A FORWARD -j REJECT --reject-with icmp-net-unreachable
iptables -P FORWARD DROP

## aus dem Internet (ppp0)
###########################
##### NAT POSTROUTING #####
echo "NAT einstellen für ${EXT_IF}"

### Portforwarding 3/3
iptables -t nat -A PREROUTING -i ${EXT_IF} -p tcp --dport 443 -j DNAT --to 192.168.1.11:443
iptables -t nat -A PREROUTING -i ${EXT_IF} -p udp --dport 5060 -j DNAT --to 192.168.1.13:5060

[ -n "${EXT_IF}" -a -n "${INT_IF}" ] && \
iptables -t nat -A POSTROUTING -o ${EXT_IF} -s $(ifnet ${INT_IF}) -j MASQUERADE
[ -n "${EXT_IF}" -a -n "${DMZ_IF}" ] && \
iptables -t nat -A POSTROUTING -o ${EXT_IF} -s $(ifnet ${DMZ_IF}) -j MASQUERADE

#iptables -t nat -A POSTROUTING -o ${EXT_IF} -s $(ifnet ${INT_IF}) -d 192.168.1.11 -j MASQUERADE

# Zugriff auf SSH max 3 Logins pro Minute vom gleichen Server!
iptables -A INPUT -p tcp --dport 822 -i ${EXT_IF} -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 822 -i ${EXT_IF} -m state --state ESTABLISHED -m recent --update --seconds 60 --hitcount 2 -j REJECT --reject-with tcp-reset

Quellcode

 # echo $(ifnet ${EXT_IF})
92.75.155.42/ 1.0.0.0/2