Provides: firewall

Required-Start: $local_fs $network $named $time $syslog $remote_fs

Required-Stop: $local_fs $network $named $time $syslog $remote_fs

Default-Start: 2 3 4 5

Default-Stop: 0 1 6

Description: Personal Firewall - Preventing attacks/open common ports

END INIT INFO

Module loading

/sbin/depmod -a

Required modules

/sbin/modprobe ip_tables /sbin/modprobe iptable_filter /sbin/modprobe ipt_REJECT /sbin/modprobe iptable_nat /sbin/modprobe ipt_LOG /sbin/modprobe ipt_limit

Non-Required modules

#/sbin/modprobe ipt_owner #/sbin/modprobe iptable_mangle #/sbin/modprobe ip_conntrack #/sbin/modprobe ip_conntrack_ftp #/sbin/modprobe ip_conntrack_irc #/sbin/modprobe ip_nat_ftp #/sbin/modprobe ip_nat_irc #/sbin/modprobe ipt_MASQUERADE

To start the firewall

start() { ### Allow Forward ip ### echo 1 > /proc/sys/net/ipv4/ip_forward ### Flush any Existing iptable Rules and start afresh ### iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -F POSTROUTING -t nat iptables -F PREROUTING -t nat

### Setting up Port Services ###
iptables -A INPUT -p tcp --dport 25 -j ACCEPT    //incoming mail
iptables -A INPUT -p tcp --dport 53 -j ACCEPT    //dns - udp for large queries
iptables -A INPUT -p udp --dport 53 -j ACCEPT    //dns - udp for small queries
iptables -A INPUT -p tcp --dport 80 -j ACCEPT    //apache
iptables -A INPUT -p tcp --dport 443 -j ACCEPT    //apache ssl
iptables -A INPUT -p udp --dport 161 -j ACCEPT   //snmpd
iptables -A INPUT -p tcp --dport 953 -j ACCEPT    //dns internal
iptables -A INPUT -p tcp --dport 1080 -j ACCEPT    //dante socks server
iptables -A INPUT -p all --dport 3020 -j ACCEPT  //cifs-smb
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT  //squid
iptables -A INPUT -p tcp --dport 4949 -j ACCEPT   //munin stats

### Setting up Local Ports ###
iptables -A INPUT -d 192.168.1.120 -p udp --dport 9 -j ACCEPT    //WOL (wake on lan)
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 20:21 -j ACCEPT     //ftp
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -j ACCEPT       //sshd
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 139 -j ACCEPT     //samba
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 993 -j ACCEPT    //imaps
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 3306 -j ACCEPT     //mysql
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 8000 -j ACCEPT    //apache on phi
iptables -A INPUT -s 192.168.1.120 -p tcp --dport 8080 -j ACCEPT   //tomcat
iptables -A INPUT -s 127.0.0.1 -p tcp --dport 111 -j ACCEPT       //to speed up mail via courier. Identified via logging
iptables -A INPUT -s 127.0.0.1 -p tcp --dport 143 -j ACCEPT      //squirrelmail

### Preventing Attacks ###
iptables -A INPUT -p icmp -j ACCEPT      //Allow ICMP Ping packets.
iptables -A INPUT -p tcp --tcp-flags ACK ACK -j ACCEPT      //Accept traffic with the ACK flag set
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP             //Deny all null packets
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP             //Deny all recon packets
iptables -A INPUT -p tcp --tcp-flags ALL FIN -j DROP            //nmap FIN stealth scan
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP       //SYN + FIN
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP      //SYN + RST
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP     //FIN + RST
iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP    //FIN + URG + PSH
iptables -A INPUT -p tcp --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN -j DROP       //XMAS
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP       //FIN without ACK
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP      //PSH without ACK
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP     //URG without ACK
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP        //Deny SYN flood attack
iptables -A INPUT -m state --state ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT     //Accept traffic with ESTABLISHED flag set (limit - DDoS prevent)
iptables -A INPUT -m state --state RELATED -m limit --limit 50/second --limit-burst 50 -j ACCEPT        //Accept traffic with RELATED flag set (limit - DDoS prevent)
iptables -A INPUT -m state --state INVALID -j DROP       //Deny traffic with the INVALID flag set
#################################

### PERSONALIZED RULES 80 PORT ###
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT       //Protection DDoS attacks
### PERSONALIZED RULES 22 PORT ###
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m state --state NEW -m recent --set --name SSH --rsource
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m recent --rcheck --seconds 30 --hitcount 4 --rttl --name SSH --rsource -j REJECT --reject-with tcp-reset      //Protection bruteforce SSH
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m recent --rcheck --seconds 30 --hitcount 3 --rttl --name SSH --rsource -j LOG --log-prefix "SSH brute force "
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m recent --update --seconds 30 --hitcount 3 --rttl --name SSH --rsource -j REJECT --reject-with tcp-reset

########### CLOSE ALL ############
iptables -A INPUT -j REJECT         //Close up firewall. All else blocked.

######### PORT FORWARDING #######
iptables -t nat -A PREROUTING -p tcp -d 192.168.1.120 --dport 8000 -j DNAT --to 1.2.3.4:80
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4     //for static ip
#iptables -t nat -A POSTROUTING -d 1.2.3.4 -j MASQUERADE       //for dynamic ip
#################################

echo "--------------------------------------------------"
echo "Firewall Loaded"
echo "--------------------------------------------------"
echo "Netstat output:"
echo ""
netstat -tuanp
echo "Verify enabled rules with:"
echo "filter) iptables -L -nvx"
echo "nat) iptables -t nat -L -nvx"
echo "script) firewall.sh status"
EXT=0

}

To stop the firewall

stop() { ### Deny Forward ip ### echo 0 > /proc/sys/net/ipv4/ip_forward echo "--------------------------------------------------" echo "Firewall Stopped" echo "--------------------------------------------------" EXT=0 }

To clear rules

clear() { iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -F POSTROUTING -t nat iptables -F PREROUTING -t nat EXT=0 }

case $1 in start) clear start ;; stop) clear stop ;; restart) clear sleep 2 start ;; status) echo "--------------------------------------------------" echo "--------------------------------------------------" echo "Status Firewall" echo "--------------------------------------------------" #iptables -L -n echo "--------------------------------------------------" echo "FILTER" echo "--------------------------------------------------" iptables -L -nvx echo "--------------------------------------------------" echo "NAT" echo "--------------------------------------------------"
iptables -t nat -L -nvx EXT=0 ;; *) echo "Usage: firewall.sh {start|stop|restart|status}" EXT=1 ;; esac exit $EXT [/code]

Iptables firewall

BEGIN INIT INFO