IpTables nemtommi

A Script:

#
#MyFirewall shell script V 0.3
#
# Beállítások
#
LANIFACES="bnep0 eth0"
INPUTTCP="ssh smtp imap http https"
INPUTUDP=""
LOG="off"

PORTSCAN="ALL_ALL ALL_NONE ALL_FIN,URG,PSH ALL_SYN,RST,ACK,FIN,URG SYN,RST_SYN,RST SYN,FIN_SYN,FIN FIN,RST_FIN,RST ACK,FIN_FIN ACK,PSH_PSH ACK,URG_URG"
BLACKLIST="10.0.0.0/8 172.16.0.0/16 224.0.0.0/4 240.0.0.0/5"

###############################################################
## Innentől csak akkor módosíts ha tudod hogy mit csinálsz!! ##
###############################################################

#
#A passziv ftphez szukseges modul betoltese
#
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

#
#Valtozok definialasa
#
NETIFACE=eth1
NETIP=`ifconfig $NETIFACE | grep inet | cut -d : -f 2 | cut -d \  -f 1`
NETMASK=`ifconfig $NETIFACE | grep Mask | cut -d : -f 4`
NETBCAST=`ifconfig $NETIFACE | grep inet | cut -d : -f 3 | cut -d \  -f 1`

for i in $LANIFACES; 
do
LANIP="$LANIP `ifconfig $i | grep inet | cut -d : -f 2 | cut -d \  -f 1`";
LANMASK="$LANMASK `ifconfig $i | grep Mask | cut -d : -f 4`";
LANBCAST="$LANBCAST `ifconfig $i | grep inet | cut -d : -f 3 | cut -d \  -f 1`";
done

#
#Alapallapot visszaallitasa...
#

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
iptables -Z
iptables -t nat -Z
iptables -t mangle -Z
#
#Uj Lancok letrehorasa
#
CHAINS="ILLEGAL PSDROP ILDROP LANINPUT LANOUTPUT NETINPUT NETOUTPUT"

for i in $CHAINS
do
iptables -N $i;
iptables -F $i;
done

#
#Csomag osztályozás
#
iptables -A INPUT -j ILLEGAL

for i in $LANIFACES;
do
        iptables -A INPUT -i $i -j LANINPUT;
        iptables -A OUTPUT -o $i -j LANOUTPUT; 
done

iptables -A INPUT -i $NETIFACE -j NETINPUT
iptables -A OUTPUT -o $NETIFACE -j NETOUTPUT



#TCP/IP szures


#Syn flood szures
iptables -A ILLEGAL -p tcp --syn -m limit ! --limit 3000/s -j ILDROP
# Lehetseges Port Scanneles 
iptables -A ILLEGAL -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

for i in $PORTSCAN
do
iptables -A ILLEGAL -p tcp --tcp-flags `echo $i | sed -e 's/\_/\ /g'` -j PSDROP;
done

# Blacklist IP címek tiltasa 

for i in $BLACKLIST
do
iptables -A ILLEGAL -i $NETIFACE -s $i -j PSDROP;
done

iptables -A ILLEGAL -j RETURN

#A lehetséges portscanner logolása

if [ "$LOG" = "on" ];then
echo "Tiltott csomagok naplózása: PSDROP";
iptables -A PSDROP -j LOG --log-level warn --log-prefix "Portscan?: ";
fi
iptables -A PSDROP -j DROP

#IP szűrés logolása

if [ "$LOG" = "on" ];then
echo "Tiltott csomagok naplózása: ILDROP";
iptables -A ILDROP -j LOG --log-level warn --log-prefix "Illegalis csomag: ";
fi

iptables -A ILDROP -j DROP

#
#Frogalom LAN -> FW
#

iptables -A LANINPUT -j ACCEPT

#
#Frogalom FW -> LAN
#

iptables -A LANOUTPUT -j ACCEPT

#
#Frogalom NET -> FW
#

for i in $INPUTTCP;
do
iptables -A NETINPUT -m state --state NEW,ESTABLISHED -p tcp --dport $i -j ACCEPT;
done

for i in $INPUTUDP;
do
iptables -A NETINPUT -m state --state NEW,ESTABLISHED -p udp --dport $i -j ACCEPT;
done

if [ "$LOG" = "on" ];then
echo "Tiltott csomagok naplózása: NETINPUT";
iptables -A NETINPUT -m limit --limit 5/s -j LOG --log-level warn --log-prefix "Tiltott csomag NET->FW: " ;
fi

iptables -A NETINPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A NETINPUT -j DROP

#
#Frogalom FW -> NET
#

iptables -A NETOUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#
#Forwarding
#
#Forgalom LAN -> NET
#

for i in $LANIFACES;
do
iptables -A FORWARD -i $i -o $NETIFACE -j ACCEPT;
done

#
# Forgalom NET -> LAN
#

for i in $LANIFACES;
do
iptables -A FORWARD -i $NETIFACE -o $i -m state --state ESTABLISHED,RELATED -j ACCEPT;
done

#
# Maszkolas
#

iptables -t nat -A POSTROUTING -o $NETIFACE -j MASQUERADE