Navigation

Mark_NL · #1 9th August 2011, 11:59

Code:

#!/bin/bash
### BEGIN INIT INFO
# Provides:          Firewall
# Required-Start:    $local_fs $network $syslog
# Required-Stop:     $local_fs $network $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start/stop Firewall
### END INIT INFO

. /lib/lsb/init-functions

#---------------------------------------------------------------------
# /etc/init.d/firewall
#
# IPTables (netfilter) firewall manager script
#
# Server: backup
#
# History of modifications
# When         Who      What
# ----         ---      ----------
# 2011-06-01   Mark     Original version
# 2011-07-13   Mark     Moved OUTPUT rules above INPUT rules
#
#---------------------------------------------------------------------


#---------------------------------------------------------------------
# Global variables
#

IPT=`which iptables`
MODPROBE=`which modprobe`
DEPMOD=`which depmod`
FLAGS='URG,ACK,PSH,RST,SYN,FIN'
LOG_LEVEL="debug"
CONFIG_FILE="/usr/local/etc/firewall.conf"

#---------------------------------------------------------------------
# Config file
#
if [ ! -f $CONFIG_FILE ];
then
    echo "Error: $CONFIG_FILE not found!";
    exit 1;
else
    source $CONFIG_FILE
fi


#---------------------------------------------------------------------
# Function: Usage
#    Shows a reminder
#---------------------------------------------------------------------

Usage() {
    echo "Usage: $0: start|stop|restart"
    exit 1
}


#---------------------------------------------------------------------
# Function: StartFirewall
#    Loads the rules in memory
#---------------------------------------------------------------------

StartFirewall() {

    #---------------------------------------------------------------------
    # Load kernel modules
    #
    $DEPMOD -a
    $MODPROBE ip_tables
    $MODPROBE ip_conntrack
    $MODPROBE ip_conntrack_ftp
    $MODPROBE iptable_filter
    $MODPROBE ipt_LOG
    $MODPROBE ipt_limit
    $MODPROBE ipt_state



    #---------------------------------------------------------------------
    # Empty the "filter" table
    #
    $IPT -t filter -F
    $IPT -t filter -X



    #---------------------------------------------------------------------
    # Default policy for all tables: drop everything
    #
    $IPT -t filter -P INPUT DROP
    $IPT -t filter -P OUTPUT DROP
    $IPT -t filter -P FORWARD DROP
    


    #---------------------------------------------------------------------
    # Log entries definitions
    #
    # Every log "line" will be prefixed with "[FW:" (for firewall), to
    # make log filtering easier down the road.

    # Log DROPs
    $IPT -N LOG_DROP
    if [ `echo "x$LOG_DROPPED_PACKETS" | tr [:upper:] [:lower:]` = "xyes" ];
    then
	$IPT -A LOG_DROP -j LOG --log-prefix '[FW:DROP] ' --log-level $LOG_LEVEL
    fi
    $IPT -A LOG_DROP -j DROP
    
    # Log ACCEPTs
    $IPT -N LOG_ACCEPT
    if [ `echo "x$LOG_ACCEPTED_PACKETS" | tr [:upper:] [:lower:]` = "xyes" ];
    then
	$IPT -A LOG_ACCEPT -j LOG --log-prefix '[FW:ACCEPT] ' --log-level $LOG_LEVEL
    fi
    $IPT -A LOG_ACCEPT -j ACCEPT
    
    # Log REJECTs
    $IPT -N LOG_REJECT
    if [ `echo "x$LOG_REJECTED_PACKETS" | tr [:upper:] [:lower:]` = "xyes" ];
    then
	$IPT -A LOG_REJECT -j LOG --log-prefix '[FW: REJECT] ' --log-level $LOG_LEVEL
    fi
    $IPT -A LOG_REJECT -j REJECT



    #---------------------------------------------------------------------
    # Drop weird packets
    #
    
    # A packet can't have SYN+ACK and also be new! (state NEW)
    $IPT -A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j LOG_REJECT
    
    # No legal packet can have all flags on or off: doesn't make sense
    $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j LOG_DROP
    $IPT -A INPUT -p tcp --tcp-flags ALL ALL  -j LOG_DROP


    
    #---------------------------------------------------------------------
    #Loopback interface (lo: 127.0.0.1) must be open to itself
    #
    $IPT -A INPUT -i lo -j ACCEPT
    $IPT -A OUTPUT -o lo -j ACCEPT
    
    # Anti spoofing: traffic from 127.0.0.0/8 must originate from the loopback interface
    $IPT -A INPUT -s 127.0.0.0/8 ! -i lo -j LOG_DROP


    
    #---------------------------------------------------------------------
    # Logging of start and end of connections (but not the "middle" packets)
    #
    $IPT -t filter -A OUTPUT -p tcp --tcp-flags $FLAGS SYN,ACK -m state --state ESTABLISHED,RELATED -j LOG_ACCEPT
    $IPT -t filter -A OUTPUT -p tcp --tcp-flags $FLAGS FIN,ACK -m state --state ESTABLISHED,RELATED -j LOG_ACCEPT
    $IPT -t filter -A OUTPUT -p tcp --tcp-flags $FLAGS RST,ACK -m state --state ESTABLISHED,RELATED -j LOG_ACCEPT

    $IPT -t filter -A INPUT -p tcp --tcp-flags $FLAGS SYN,ACK -m state --state ESTABLISHED,RELATED -j LOG_ACCEPT
    $IPT -t filter -A INPUT -p tcp --tcp-flags $FLAGS FIN,ACK -m state --state ESTABLISHED,RELATED -j LOG_ACCEPT
    $IPT -t filter -A INPUT -p tcp --tcp-flags $FLAGS RST,ACK -m state --state ESTABLISHED,RELATED -j LOG_ACCEPT
    
    $IPT -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    $IPT -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


    
    #---------------------------------------------------------------------
    # OUTBOUND traffic (OUTPUT table)
    # Traffic that this server sends (not forwarded traffic)

    # Allow all outbound traffic
    $IPT -t filter -A OUTPUT -j ACCEPT    



    #---------------------------------------------------------------------
    # INBOUND traffic (INPUT table)
    # Traffic addressed explicitly for this server (ie: not forwarded traffic,
    # if the server is used as router/firewall).

    for SERVICE in $SERVICES_ALLOWED_TCP;
    do
	IPS_LIST=`echo IP_ALLOWED_$SERVICE | tr '[:lower:]' '[:upper:]'`

	if [ "x${!IPS_LIST}" = "x" ];
	then
	    # No IP limitations for this service
	    $IPT -t filter -A INPUT -p tcp --dport $SERVICE --tcp-flags $FLAGS SYN -m state --state NEW -j LOG_ACCEPT
	else
	    for IP in ${!IPS_LIST};
	    do
		$IPT -t filter -A INPUT -p tcp --dport $SERVICE -s "$IP" --tcp-flags $FLAGS SYN -m state --state NEW -j LOG_ACCEPT
    	    done
	fi
    done

    for SERVICE in $SERVICES_ALLOWED_UDP;
    do
	IPS_LIST=`echo IP_ALLOWED_$SERVICE | tr '[:lower:]' '[:upper:]'`

	if [ "x${!IPS_LIST}" = "x" ];
	then
	    # No IP limitations for this service
	    $IPT -t filter -A INPUT -p udp --dport $SERVICE -j LOG_ACCEPT
	else
	    for IP in ${!IPS_LIST};
	    do
		$IPT -t filter -A INPUT -p udp --dport $SERVICE -s "$IP" -j LOG_ACCEPT
    	    done
	fi
    done

    # PING
    $IPT -t filter -A INPUT -p icmp --icmp-type echo-request -j LOG_ACCEPT


    
    #---------------------------------------------------------------------
    # Log all packets before they are dropped
    # (default policy)

    $IPT -t filter -A INPUT -j LOG_DROP
    $IPT -t filter -A OUTPUT -j LOG_DROP
    $IPT -t filter -A FORWARD -j LOG_DROP
}


#---------------------------------------------------------------------
# Function: StopFirewall
#    Stop the firewall and ACCEPT ALL TRAFFIC
#---------------------------------------------------------------------

StopFirewall() {

    #---------------------------------------------------------------------
    # Empty all filter tables
    #
    $IPT -t filter -F
    $IPT -t filter -X


    
    #---------------------------------------------------------------------
    # Default policy: Accept everything
    #
    $IPT -P INPUT ACCEPT
    $IPT -P OUTPUT ACCEPT
    $IPT -P FORWARD ACCEPT
}


#---------------------------------------------------------------------
# Function: RestartFirewall
#    Empty and reload firewall rules
#---------------------------------------------------------------------

RestartFirewall() {

    StartFirewall
}


#---------------------------------------------------------------------
# Main program [ main() ]
#    Check first argument and launch appropriate function
#---------------------------------------------------------------------

case "$1" in
    start)
        echo -n "Starting firewall: "
	StartFirewall
	echo `basename $0`;
    ;;
    stop)
	echo -n "Stopping firewall: "
	StopFirewall
	echo `basename $0`;
    ;;
    restart)
	echo -n "Restarting firewall: "
	RestartFirewall
	echo `basename $0`;
	;;
    *)
	Usage
	;;
esac

exit 0

Code:

# Configuration file for firewall
# ===============================
# SERVICES_ALLOWED: defines the services that are allowed to be accessed
# IP_ALLOWED_<SERVICE>: Default all have access to the open services defined in SERVICES_ALLOWED
#		        But if you define an "IP_ALLOWED_<SERVICE>" variable, 
#			only those ip's are allowed to the service.
#			(this counts for internal AND external traffic!!)


# Checkout /etc/services for service names, else use port number
SERVICES_ALLOWED_TCP="ssh http https nrpe"
SERVICES_ALLOWED_UDP="snmp"

IP_ALLOWED_SSH="192.168.4.0/22 host1.domain.tld host2.domain.tld"

IP_ALLOWED_NRPE="noc.domain.tld"
IP_ALLOWED_SNMP="noc.domain.tld"

LOG_DROPPED_PACKETS=no
LOG_ACCEPTED_PACKETS=no
LOG_REJECTED_PACKETS=yes

basic example of the setup.
I'm no bash guru, but I think it's a nice base to start working with.

Navigation

Facebook

News

Recent comments

Newsletter