Dit is de firewall waar het over gaat:
--------------------------------------------------------------------------------------
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
# Set path to iptables
export path_iptables="/sbin/iptables"
function testresult {
let i=i+$1
case $1 in
'0')
echo -e "\033[40m\033[1;32mOK\033[0m"
;;
'1')
echo -e "\033[40m\033[1;31mFailed\033[0m"
;;
'2')
echo -e "\033[40m\033[1;31mFatal Error: 2\033[0m"
;;
*)
echo -e "\033[40m\033[1;31mFatal Error: ?\033[0m"
;;
esac
return $i
}
case "$1" in
start)
# *********************** STARTING FIREWALL ***************************
echo;
datum=`date +'%b %d %k:%M:%S'`;
echo "$datum Starting firewall iptables ..." | tee -a /var/log/messages
# Define, check and read firewall configuration file
FILE=/www/ee/adslfirewall.conf
if [ -e $FILE ];
then
. $FILE
else
echo;
echo "The file $FILE doesn't exist!"
echo "The firewall is using this file for his configurationparameters."
echo "Please check if the file is in place and readable for root."
echo;
exit;
fi;
#----------------------
# Load kernel modules
#----------------------
# Insert modules if not compiled within the kernel
if [ $load_modules = "y" ]; then
/sbin/insmod ip_tables
/sbin/insmod ip_conntrack
/sbin/insmod ip_conntrack_ftp
/sbin/insmod ip_queue
/sbin/insmod iptable_nat
/sbin/insmod iptable_filter
/sbin/insmod iptable_mangle
/sbin/insmod ip_nat_ftp
/sbin/insmod ip_nat_irc
/sbin/insmod ipt_iplimit
/sbin/insmod ipt_limit
/sbin/insmod ipt_state
/sbin/insmod ipt_multiport
/sbin/insmod ipt_mark
/sbin/insmod ipt_MASQUERADE
/sbin/insmod ipt_REJECT
/sbin/insmod ipt_REDIRECT
/sbin/insmod ipt_TOS
/sbin/insmod ipt_MIRROR
/sbin/insmod ipt_LOG
echo "Loading kernel modules ...";
fi;
#-------------------
# Initialize kernel
#-------------------
if [ $initialize_kernel = "y" ]; then
echo "Initializing kernel ..."
# CRITICAL: Enable IP forwarding since it is disabled by default since
if [ -e /proc/sys/net/ipv4/ip_forward ]; then
echo 1 > /proc/sys/net/ipv4/ip_forward
else
echo "Uh oh: /proc/sys/net/ipv4/ip_forward does not exist"
echo "(That may be a problem)"
echo
fi;
# Turn on source address verification in kernel
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $interface;
done
fi;
# Disable ICMP Redirect acceptance
if [ -e /proc/sys/net/ipv4/conf/all/accept_redirects ]; then
for interface in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $interface;
done
fi;
# Disable ICMP send_redirect
if [ -e /proc/sys/net/ipv4/conf/all/send_redirects ]; then
for interface in /proc/sys/net/ipv4/conf/*/send_redirects; do
echo 0 > $interface;
done
fi;
# Don't accept source routed packets
if [ -e /proc/sys/net/ipv4/conf/all/accept_source_route ]; then
for interface in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $interface;
done
fi;
# Log spoofed packets, source routed packets, redirect packets
if [ -e /proc/sys/net/ipv4/conf/all/log_martians ]; then
for interface in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 1 > $interface;
done
fi;
# Turn on syn cookies protection in kernel
if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
fi;
# ICMP Broadcasting protection
if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
fi;
# ICMP Dead Error Messages protection
if [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]; then
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
fi;
# Enable automatic IP defragmenting
if [ -e /proc/sys/net/ipv4/ip_always_defrag ]; then
echo 1 > /proc/sys/net/ipv4/ip_always_defrag
fi;
# Turn on dynamic TCP/IP address hacking ... turn of with echo 0 > ...
if [ -e /proc/sys/net/ipv4/ip_dynaddr ]; then
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
fi;
# Set the maximum number of connections to track. (Kernel Default: 2048)
if [ -e /proc/sys/net/ipv4/ip_conntrack_max ]; then
echo 4096 > /proc/sys/net/ipv4/ip_conntrack_max
fi
# Enable the LooseUDP patch which some Internet-based games require
#
# If you are trying to get an Internet game to work through your IP MASQ box,
# and you have set it up to the best of your ability without it working, try
# enabling this option (delete the "#" character). This option is disabled
# by default due to possible internal machine UDP port scanning
# vunerabilities.
# Turned off by default ... turn on with echo 1 > ...
if [ -e /proc/sys/net/ipv4/ip_masq_udp_dloose ]; then
echo 0 > /proc/sys/net/ipv4/ip_masq_udp_dloose
fi;
fi;
#############################################################################
#-------------------------------------------------------------------
# Flush and clearing rulez and setting default policies
#-------------------------------------------------------------------
$path_iptables -F &&
$path_iptables -X &&
$path_iptables -Z &&
$path_iptables -t nat -F &&
$path_iptables -t nat -X &&
$path_iptables -t nat -Z &&
$path_iptables -t mangle -F &&
$path_iptables -t mangle -X &&
$path_iptables -t mangle -Z
err=`testresult $?`
i=$?
echo "Flushing and clearing rules ...$err";
$path_iptables -P INPUT DROP &&
$path_iptables -P OUTPUT DROP &&
$path_iptables -P FORWARD DROP &&
$path_iptables -t nat -P POSTROUTING ACCEPT &&
$path_iptables -t nat -P PREROUTING ACCEPT &&
$path_iptables -t mangle -P OUTPUT ACCEPT &&
$path_iptables -t mangle -P PREROUTING ACCEPT &&
# Creating new chain (LDROP = LOG & DROP) for logging
$path_iptables -N LDROP &&
# Creating new chain (CHECK_FLAGS) for checking the flags of incoming packets
$path_iptables -N CHECK_FLAGS &&
$path_iptables -F CHECK_FLAGS
err=`testresult $?`
i=$?
echo "Setting default policies ... $err";
#--------------------------
# Loopback settings
#--------------------------
$path_iptables -A INPUT -i lo -j ACCEPT &&
$path_iptables -A OUTPUT -o lo -j ACCEPT &&
$path_iptables -A INPUT -i $ext_if -d 127.0.0.0/8 -j LDROP
err=`testresult $?`
i=$?
echo "Enabling loopback settings ... $err";
#----------------
# Local traffic
#----------------
# Assemble before forwarding
$path_iptables -A OUTPUT -f -o $local_if -j LDROP &&
# Refuse spoofing
$path_iptables -A INPUT -i $ext_if -s $local_net -j LDROP &&
# Everything else is fine
$path_iptables -A INPUT -i $local_if -s $local_net -j ACCEPT &&
$path_iptables -A OUTPUT -o $local_if -d $local_net -j ACCEPT
err=`testresult $?`
i=$?
echo "Enabling local traffic ... $err";
#-------------------------------------------------
# This is all generic protection against spoofing
#-------------------------------------------------
if [ $spoofing_protection = "y" ]; then
# Block Packets with Stuffed Routing
$path_iptables -A INPUT -s 0.0.0.0 -j LDROP &&
$path_iptables -A OUTPUT -s 0.0.0.0 -j LDROP &&
$path_iptables -A INPUT -s 255.255.255.255 -j LDROP &&
$path_iptables -A OUTPUT -s 255.255.255.255 -j LDROP &&
# Block Fragmented Packets
$path_iptables -A INPUT -f -m limit --limit 5/minute -j LDROP &&
# Block all reserved private IP addresses
#$path_iptables -A INPUT -i $ext_if -s $class_a -j LDROP &&
#$path_iptables -A INPUT -i $ext_if -s $class_b -j LDROP &&
#$path_iptables -A INPUT -i $ext_if -s $class_c -j LDROP &&
#$path_iptables -A INPUT -i $ext_if -s $class_d -j LDROP &&
#$path_iptables -A INPUT -i $ext_if -s $class_e -j LDROP &&
# Block all ip addresses reserved by IANA (for the time being)
# this changes regulary, see
http://www.iana.org/assignments/ipv4-address-space
# Updated 25 May 2001
RESERVED_NET="
0.0.0.0/8 1.0.0.0/8 2.0.0.0/8 \
5.0.0.0/8 \
7.0.0.0/8 \
23.0.0.0/8 \
27.0.0.0/8 \
31.0.0.0/8 \
36.0.0.0/8 37.0.0.0/8 \
39.0.0.0/8 \
41.0.0.0/8 42.0.0.0/8 \
58.0.0.0/8 59.0.0.0/8 60.0.0.0/8 \
68.0.0.0/8 69.0.0.0/8 70.0.0.0/8 71.0.0.0/8 72.0.0.0/8 73.0.0.0/8 \
74.0.0.0/8 75.0.0.0/8 76.0.0.0/8 77.0.0.0/8 78.0.0.0/8 79.0.0.0/8 \
82.0.0.0/8 83.0.0.0/8 84.0.0.0/8 85.0.0.0/8 86.0.0.0/8 87.0.0.0/8 \
88.0.0.0/8 89.0.0.0/8 90.0.0.0/8 91.0.0.0/8 92.0.0.0/8 93.0.0.0/8 94.0.0.0/8 \
95.0.0.0/8 96.0.0.0/8 97.0.0.0/8 98.0.0.0/8 99.0.0.0/8 100.0.0.0/8 101.0.0.0/8 \
102.0.0.0/8 103.0.0.0/8 104.0.0.0/8 105.0.0.0/8 106.0.0.0/8 107.0.0.0/8 \
108.0.0.0/8 109.0.0.0/8 110.0.0.0/8 111.0.0.0/8 112.0.0.0/8 113.0.0.0/8 \
114.0.0.0/8 115.0.0.0/8 116.0.0.0/8 117.0.0.0/8 118.0.0.0/8 119.0.0.0/8 \
120.0.0.0/8 121.0.0.0/8 122.0.0.0/8 123.0.0.0/8 124.0.0.0/8 125.0.0.0/8 \
126.0.0.0/8 127.0.0.0/8 \
197.0.0.0/8 \
219.0.0.0/8 220.0.0.0/8 221.0.0.0/8 222.0.0.0/8 223.0.0.0/8 \
224.0.0.0/8 225.0.0.0/8 226.0.0.0/8 227.0.0.0/8 228.0.0.0/8 229.0.0.0/8 \
230.0.0.0/8 231.0.0.0/8 232.0.0.0/8 233.0.0.0/8 234.0.0.0/8 235.0.0.0/8 \
236.0.0.0/8 237.0.0.0/8 238.0.0.0/8 239.0.0.0/8 \
240.0.0.0/8 241.0.0.0/8 242.0.0.0/8 243.0.0.0/8 244.0.0.0/8 245.0.0.0/8 \
246.0.0.0/8 247.0.0.0/8 248.0.0.0/8 249.0.0.0/8 250.0.0.0/8 251.0.0.0/8 \
252.0.0.0/8 253.0.0.0/8 254.0.0.0/8 255.0.0.0/8"
a=0
for NET in $RESERVED_NET; do
$path_iptables -A INPUT -s $NET -j LDROP
if [ $? != 0 ]
then
a=1
break;
fi
done;
err=`testresult $a`
let i=i+$?
echo "Setting up generic protection against spoofing ... $err"
fi;
#------------------------------
# Refusing some common ports
#------------------------------
# Especially necessary to set this feature when opening ALL unpriv_ports
# for instance due to ICQ filetransfer.
# Avoid ports subject to protocol & system administration problems.
if [ $refuse_common_ports = "y" ]; then
# SOCKS: disable incoming connections on port 1080
# Openwindows: disable incoming connections on port 2000
# NFS: disable incoming connections to port 2049
# SQUID: disable incoming connections on port 3128
# Xwindows: disable incoming connections on ports 6000:6063
# Block IRC on ports 6665:6669
# WEBPROXY: disable incoming connections on port 8080
common_ports_refused="1080 2000 2049 3128 6000:6063 6665:6669 8080"
a=0
for common_ports in $common_ports_refused;
do
$path_iptables -A INPUT -p tcp -i $ext_if --dport $common_ports -j LDROP &&
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport $common_ports -j LDROP &&
$path_iptables -A INPUT -p udp -i $ext_if --dport $common_ports -j LDROP &&
$path_iptables -A OUTPUT -p udp -o $ext_if --dport $common_ports -j LDROP
if [ $? != 0 ]
then
a=1
break;
fi
done;
err=`testresult $a`
i=$?
echo "Refuse connection to common known ports ... $err";
fi;
#------------------------------
# Refusing some Trojan-ports
#------------------------------
# Especially necessary to set this feature when opening ALL unpriv_ports
# for instance due to ICQ filetransfer.
# Trojan-ports: disable incoming connections to common trojan ports
if [ $block_trojans = "y" ]; then
# Block Subseven (1.7/1.9) 1243 / 6711:6713
# Block Backdoor-G and Subseven (2.X) 1999 / 6776 / 27374
# Block NetBus 12345:12346
# Block NetBus 2 Pro 20034
# Block Stacheldraht 16660 / 60001 / 65000
# Block Back Orifice, Deep BO 31337:31338
# Block Back Orifice 2K 54320:54321
# Block Trinity v3\n 33270
# Block Trin00 1524 / 27444 / 27665 / 31335
# Block Cheeseworm 10008
trojan_ports="1243 6711:6713 1999 6776 27374 12345:12346 20034 16660 60001 \
65000 31337:31338 54320:54321 33270 1524 27444 27665 31335 10008"
a=0
for trojans in $trojan_ports;
do
$path_iptables -A INPUT -p tcp -i $ext_if --dport $trojans -j LDROP &&
$path_iptables -A OUTPUT -p tcp -o $ext_if --dport $trojans -j LDROP &&
$path_iptables -A INPUT -p udp -i $ext_if --dport $trojans -j LDROP &&
$path_iptables -A OUTPUT -p udp -o $ext_if --dport $trojans -j LDROP
if [ $? != 0 ]
then
a=1
break;
fi
done;
err=`testresult $a`
i=$?
echo "Block Trojans ... $err";
fi;
#-----------------------------------------
# Refusing some common scans and attacks
#-----------------------------------------
# Especially necessary to set this feature when opening ALL unpriv_ports
# for instance due to ICQ filetransfer.
# Check flags incoming packets
if [ $check_flags_packets = "y" ]; then
# NMAP FIN/URG/PSH - XMAS - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "NMAP-XMAS: " &&
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP &&
# SYN/RST - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "SYN/RST: " &&
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP &&
# SYN/FIN -- scan(probably)
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "SYN/FIN: " &&
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP &&
# FIN - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "FIN: " &&
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN -j DROP &&
# ALL/ALL - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL ALL -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "ALL/ALL: " &&
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL ALL -j DROP &&
# NULL - scan
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL NONE -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "NULL: " &&
$path_iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL NONE -j DROP &&
# Check TCP packets coming in on the external interface for wierd flags
$path_iptables -A INPUT -i $ext_if -p tcp -j CHECK_FLAGS &&
# Check TCP packets going out on the external interface for wierd flags.
$path_iptables -A OUTPUT -o $ext_if -p tcp -j CHECK_FLAGS
err=`testresult $?`
i=$?
echo "Setup checking flags incoming packets ... $err";
fi;
#-----------------------
# ICMP settings
#-----------------------
# Only accept pings from
www.watchmyserver.com (195.179.115.45)
# With protection against ping of death
# icmp trafic
# 0 = echo-reply needed by ping
# 3 = destination-unreachable needed by any TCP/UDP trafic
# 5 = redirect needed by routing if not running routing daemon
# 8 = echo-request needed by ping
#11 = time-exceeded needed by traceroute
#if [ $accept_pings = "y" ]; then
#$path_iptables -A INPUT -p icmp --icmp-type 0 -s any/0 -d 192.168.1.12
#-m limit --limit 1/s -j ACCEPT &&
#$path_iptables -A INPUT -p icmp --icmp-type 3 -s any/0 -d 192.168.1.12
#-m limit --limit 1/s -j ACCEPT &&
#$path_iptables -A INPUT -p icmp --icmp-type 8 -s any/0 -d 192.168.1.12
#-m limit --limit 1/s -j ACCEPT &&
$path_iptables -A INPUT -p icmp --icmp-type 11 -s any/0 -d 192.168.1.12 -m limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 3 -s $ext_ip -d any/0 -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 8 -s $ext_ip -d any/0 -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 0 -s $ext_ip -d any/0 -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 11 -s $ext_ip -d any/0 -m
#limit --limit 1/s -j ACCEPT &&
# Accept redirect icmp-packets
#$path_iptables -A INPUT -p icmp --icmp-type 5 -s any/0 -d $ext_ip -m
#limit --limit 1/s -j ACCEPT
#err=`testresult $?`
#i=$?
#echo "Set accept pings ... $err";
#else
#$path_iptables -A INPUT -p icmp --icmp-type 0 -s any/0 -d $ext_ip -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A INPUT -p icmp --icmp-type 3 -s any/0 -d $ext_ip -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A INPUT -p icmp --icmp-type 8 -s 195.179.115.45 -d
#$ext_ip -m limit --limit 1/s -j ACCEPT &&
#$path_iptables -A INPUT -p icmp --icmp-type 11 -s any/0 -d $ext_ip -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 3 -s $ext_ip -d any/0 -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 8 -s $ext_ip -d any/0 -m
#limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 0 -s $ext_ip -d
#195.179.115.45 -m limit --limit 1/s -j ACCEPT &&
#$path_iptables -A OUTPUT -p icmp --icmp-type 11 -s $ext_ip -d
#195.179.115.45 -m limit --limit 1/s -j ACCEPT &&
# Deny redirect icmp-packets
#$path_iptables -A INPUT -p icmp --icmp-type 5 -s any/0 -d $ext_ip -j
#LDROP
#err=`testresult $?`
#i=$?
#echo "Set no pings accepted ... $err";
#fi;
#----------------------------------------------------------------------
# Mangles the TOS on standard ports so they get priority in routers
#----------------------------------------------------------------------
# TOS table
# Options:
# Normal-Service = 0 (0x00)
# Minimize-Cost = 2 (0x02)
# Maximize-Reliability = 4 (0x04)
# Maximize-Throughput = 8 (0x08)
# Minimize-Delay = 16 (0x10)
if [ $mangle_tos = "y" ]; then
# ToS: Client Applications; data => tos_client
# Most of these are the RFC 1060/1349 suggested TOS values, yours might vary.
# To view mangle table, type: iptables -L -t mangle
# Mangle values of packets created locally.
$path_iptables -t mangle -A OUTPUT -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 21 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 22 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 23 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 25 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p udp --dport 53 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 67 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 113 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 123 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 143 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 993 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 995 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 1080 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A OUTPUT -p tcp --dport 6000:6063 -j TOS --set-tos Maximize-Throughput &&
# Rules to mangle TOS values of packets routed through the firewall
$path_iptables -t mangle -A PREROUTING -p tcp --dport 20 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 21 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 22 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 23 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 25 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p udp --dport 53 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 67 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 110 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 113 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 123 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 143 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 443 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 993 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 995 -j TOS --set-tos Maximize-Throughput &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 1080 -j TOS --set-tos Minimize-Delay &&
$path_iptables -t mangle -A PREROUTING -p tcp --dport 6000:6063 -j TOS --set-tos Maximize-Throughput
err=`testresult $?`
i=$?
echo "Setup mangling TOS ... $err";
fi;
#-------------------------------------------
# ICQ filetransfer / Syn-flood protection
#-------------------------------------------
# Unfortunatelly ICQ uses the whole unpriv_port range for client to client connections (filetransfer)
# Enabling this feature will open ALL unpriv_ports. Hackers are then able to establish a
# connection to these ports. However you are prevented from DoS (Denial of Service) attacks.
# --limit followed by a number; specifies the maximum average number of matches to allow per second.
if [ $icq_filetransfer_all = "y" ]; then
$path_iptables -A INPUT -p tcp -i $ext_if -d $ext_ip --dport $unpriv_ports -m limit --limit 1/s --syn -j ACCEPT
err=`testresult $?`
i=$?
echo "Enabling ICQ filetransfer ... !!! Caution, opens ALL unpriv_ports !!! ... $err";
fi;
# Restricted ICQ filetransfer based on IP-address
if [ $icq_filetransfer_friends = "y" ]; then
a=0
for icq_ip in $icq_friends;
do
$path_iptables -A INPUT -p tcp -i $ext_if -s $icq_ip --sport $unpriv_ports -d $ext_ip --dport $unpriv_ports -j ACCEPT
if [ $? != 0 ]
then
a=1
break;
fi
done;
err=`testresult $a`
let i=i+$?
echo "Enable restricted ICQ filetransfer ... $err";
fi;
#-----------------
# FTP-server
#-----------------
if [ $ftp_active = "y" -o $ftp_passive = "y" ]; then
# Open port 21 (ftp) for FTP-server
$path_iptables -A INPUT -p tcp -s 294.109.239.141 -d ***.***.***.*** --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$path_iptables -A OUTPUT -p tcp -s ***.***.***.*** --sport ftp -d any/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
err=`testresult $?`
i=$?
echo "Opening port 21 for ftp ... $err";
fi;
if [ $ftp_active = "y" ]; then
# Open port 20 (ftp-data) for active FTP-server
$path_iptables -A INPUT -p tcp -i $ext_if -s 294.109.239.141 -d ***.***.***.*** --dport 20 -m state --state ESTABLISHED,RELATED ! --syn -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s ***.***.***.*** --sport 20 -d any/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
err=`testresult $?`
i=$?
echo "Opening port 20 for datatransfer active FTP ... $err";
fi;
if [ $ftp_passive = "y" ]; then
$path_iptables -A INPUT -p tcp -i $ext_if -s 294.109.239.141 -d ***.***.***.*** --dport $unpriv_ports -m state --state ESTABLISHED,RELATED -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s ***.***.***.*** --sport $unpriv_ports -d any/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
err=`testresult $?`
i=$?
echo "Opening unpriv. ports for datatransfer passive FTP ... $err";
fi;
#-----------------
# FTP-server
#-----------------
if [ $ftp_active = "y" -o $ftp_passive = "y" ]; then
# Open port 21 (ftp) for FTP-server
$path_iptables -A INPUT -p tcp -s 194.109.239.141 -d ***.***.***.*** --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
$path_iptables -A OUTPUT -p tcp -s ***.***.***.*** --sport ftp -d any/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
err=`testresult $?`
i=$?
echo "Opening port 21 for ftp2 ... $err";
fi;
if [ $ftp_active = "y" ]; then
# Open port 20 (ftp-data) for active FTP-server
$path_iptables -A INPUT -p tcp -i $ext_if -s 194.109.239.141 -d ***.***.***.*** --dport 20 -m state --state ESTABLISHED,RELATED ! -syn -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s ***.***.***.*** --sport 20 -d any/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
err=`testresult $?`
i=$?
echo "Opening port 20 for datatransfer active FTP2 ... $err";
fi;
if [ $ftp_passive = "y" ]; then
$path_iptables -A INPUT -p tcp -i $ext_if -s 194.109.239.141 -d ***.***.***.*** --dport $unpriv_ports -m state --state ESTABLISHED,RELATED -j ACCEPT
$path_iptables -A OUTPUT -p tcp -o $ext_if -s ***.***.***.*** --sport $unpriv_ports -d any/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
err=`testresult $?`
i=$?
echo "Opening unpriv. ports for datatransfer passive FTP ... $err";
fi;
#--------------------------------
# SSH server and client trafic
#--------------------------------
# Any trafic to/from ssh deamon permitted
if [ $ssh = "y" ]; then
$path_iptables -A INPUT -p tcp -s 194.109.239.141 -d ***.***.***.*** --dport 63 -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -s any/0 --sport 63 -d any/0 ! --syn -j ACCEPT
err=`testresult $?`
i=$?
echo "Enable SSH ... $err";
fi;
#-----------------
# DNS-server
#-----------------
# Open port 53 (domain) for DNS-server
if [ $dns = "y" ]; then
$path_iptables -A INPUT -p tcp -i eth0 -s any/0 -d ***.***.***.*** --dport domain -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -o eth0 -s ***.***.***.*** --sport domain -d any/0 ! --syn -j ACCEPT &&
$path_iptables -A INPUT -p udp -i eth0 -s any/0 -d ***.***.***.*** --dport domain -j ACCEPT &&
$path_iptables -A OUTPUT -p udp -o eth0 -s ***.***.***.*** --sport domain -d any/0 -j ACCEPT
err=`testresult $?`
i=$?
echo "Enable DNS ... $err";
fi;
#--------------------
# SMTP-server
#--------------------
# Open port 25 (smtp) for SMTP-server
if [ $smtp = "y" ]; then
$path_iptables -A INPUT -p tcp -s any/0 -d ***.***.***.*** --dport smtp -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -s ***.***.***.*** --sport smtp -d any/0 ! --syn -j ACCEPT
err=`testresult $?`
i=$?
echo "Opening SMTP for mailserver ... $err";
fi;
#----------------------------
# Apache - webserver
#----------------------------
# Open port 80 (http) for webserver
if [ $http = "y" ]; then
$path_iptables -A INPUT -p tcp -s any/0 -d ***.***.***.*** --dport http -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -s ***.***.***.*** --sport http -d any/0 ! --syn -j ACCEPT
$path_iptables -A OUTPUT -p tcp -d 194.109.239.141 -s ***.***.***.*** -j ACCEPT
err=`testresult $?`
i=$?
echo "Give access to webserver ... $err"
fi;
# Open poort 443 (https) for webserver
if [ $https = "y" ]; then
$path_iptables -A INPUT -p tcp -s any/0 -d ***.***.***.*** --dport https -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -s ***.***.***.*** --sport https -d any/0 ! --syn -j ACCEPT
err=`testresult $?`
i=$?
echo "Setup SSL ... $err";
fi;
#-------------------
# POP3-server
#-------------------
# Open port 110 (pop3) for POP3-server
if [ $pop3 = "y" ]; then
$path_iptables -A INPUT -p tcp -s any/0 -d ***.***.***.*** --dport pop3 -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -s ***.***.***.*** --sport pop3 -d any/0 ! --syn -j ACCEPT
err=`testresult $?`
i=$?
echo "Open POP3 connection ... $err";
fi;
# Open port 995 (pop3s) for POP3-server over SSL
if [ $pop3s = "y" ]; then
$path_iptables -A INPUT -p tcp -s any/0 -d ***.***.***.*** --dport pop3s -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -s ***.***.***.*** --sport pop3s -d any/0 ! --syn -j ACCEPT
err=`testresult $?`
i=$?
echo "Open POP3 over SSL ... $err";
fi;
#-----------------------
# Auth-server (ident)
#-----------------------
# Open port 113 (auth/ident) for ident-server
# On some distributions "auth" needs to be replaced by "ident"
if [ $auth = "y" ]; then
$path_iptables -A INPUT -p tcp -s any/0 -d $ext_ip --dport auth -j ACCEPT &&
$path_iptables -A OUTPUT -p tcp -o $ext_if -s $ext_ip --sport auth -d any/0 ! --syn -j ACCEPT
err=`testresult $?`
i=$?
echo "Enable Auth ... $err";
else
$path_iptables -A INPUT -p tcp -s any/0 -d 192.168.1.12 --dport auth -j REJECT --reject-with tcp-reset &&
$path_iptables -A OUTPUT -p tcp -s 192.168.1.12 --sport auth -d any/0 ! --syn -j REJECT --reject-with tcp-reset
err=`testresult $?`
i=$?
echo "Reject instead of drop Auth requests ... $err";
fi;
#------------------------
# Private firewall rules
#------------------------
if [ $private_rules = "y" ]; then
cat=`$path_private_rules`;
err=`testresult $?`
i=$?
echo "Setting up private firewall rules ... $err"
else
echo -e "No private firewall rules defined ...\033[40m\033[1;32mOK\033[0m"
fi;
#----------------
# Logging
#----------------
# All other incoming, forwarding and outgoing is denied and logged.
#$path_iptables -A INPUT -i $ext_if -s any/0 -d any/0 -j LDROP &&
#$path_iptables -A OUTPUT -o $ext_if -s any/0 -d any/0 -j LDROP &&
#$path_iptables -A FORWARD -o $ext_if -s any/0 -d any/0 -j LDROP &&
# Set up LDROP
#$path_iptables -A LDROP -m state --state INVALID -j LOG --log-level info --log-prefix "State INVALID Dropped: " &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL FIN,URG,PSH -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "NMAP-XMAS: " &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP &&
#$path_iptables -A LDROP -p tcp --tcp-flags SYN,RST SYN,RST -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "SYN/RST: " &&
#$path_iptables -A LDROP -p tcp --tcp-flags SYN,RST SYN,RST -j DROP &&
#$path_iptables -A LDROP -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "SYN/FIN: " &&
#$path_iptables -A LDROP -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL FIN -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "FIN: " &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL FIN -j DROP &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL ALL -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "ALL/ALL: " &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL ALL -j DROP &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL NONE -m limit \
--limit 5/minute -j LOG --log-level notice --log-prefix "NULL: " &&
#$path_iptables -A LDROP -p tcp --tcp-flags ALL NONE -j DROP &&
#$path_iptables -A LDROP -p tcp -m limit --limit 1/s -j LOG --log-level info --log-prefix "TCP_Dropped: " &&
#$path_iptables -A LDROP -p udp -m limit --limit 1/s -j LOG --log-level info --log-prefix "UDP_Dropped: " &&
#$path_iptables -A LDROP -p icmp -m limit --limit 1/s -j LOG --log-level info --log-prefix "ICMP_Dropped: " &&
#$path_iptables -A LDROP -f -m limit --limit 1/s -j LOG --log-level warning --log-prefix "FRAGMENT_Dropped: " &&
#$path_iptables -A LDROP -j DROP
err=`testresult $?`
i=$?
echo "Enable logging ... $err";
#
if [ "$i" -gt "0" ]
then
echo "Firewall error" >> /var/log/messages
echo -e "$datum \033[40m\033[1;31mErrors detected in bringing up firewall!\033[0m" | tee -a /var/log/messages
echo -e "$datum \033[40m\033[1;31mCheck your configuration.\033[0m" | tee -a /var/log/messages
else
echo -e "$datum \033[40m\033[1;32mFirewall is up without errors!\033[0m" | tee -a /var/log/messages
echo;
fi
;;
stop)
# *********************** STOPPING FIREWALL ***************************
echo;
datum=`date +'%b %d %k:%M:%S'`;
echo "$datum Shutting down firewall and masquerading" | tee -a /var/log/messages
echo "$datum WARNING: YOUR MACHINE IS NOW OPEN FOR ATTACKS!!!" | tee -a /var/log/messages
echo;
# Remove all existing rules belonging to this filter
$path_iptables -F
$path_iptables -t nat -F
$path_iptables -t mangle -F
# Delete all user-defined chain to this filter
$path_iptables -X
$path_iptables -t nat -X
$path_iptables -t mangle -X
# Reset the default policy of the filter to accept.
$path_iptables -P INPUT ACCEPT
$path_iptables -P OUTPUT ACCEPT
$path_iptables -P FORWARD ACCEPT
$path_iptables -t nat -P POSTROUTING ACCEPT
$path_iptables -t nat -P PREROUTING ACCEPT
$path_iptables -t mangle -P OUTPUT ACCEPT
$path_iptables -t mangle -P PREROUTING ACCEPT
;;
restart)
datum=`date +'%b %d %k:%M:%S'`;
echo "$datum Firewall restart ..." | tee -a /var/log/messages
$0 stop
echo "-----------------------"
$0 start
;;
status)
$path_iptables -L -n --line-numbers
;;
*)
# ************************* WRONG PARAMETERS **************************
echo;
echo "Wrong parameter input!"
echo "Usage: $0 {start|stop|restart|status}"
;;
esac
----------------------------------------------------------------------------------------
misschien dat iemand hier iets in ziet, ik kan niks vinden .....
Het firewall gedeelte voor de smtp ziet er als volgt uit: :strip_icc():strip_exif()/u/23437/crop5db08c996ac2e.jpeg?f=community)
