Administrace komentářů

#! /bin/sh
TCP_PUBLIC="80 25 21 443"
TCP_ADMIN="22 10000"
ADMIN_ACCESS="povolene_ip_zvenku"
BAD_IP="zle_ip_adresy_ktere_delaji_portscan_atd"
MY_IP="ip_vnejsiho_rozhrani"

iptables -F
iptables -F -t nat
iptables -X
iptables -Z

#maskarada
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 0/0 -j MASQUERADE

#DEFAULT POLICY
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#vynuceni proxy a vyjimky
# --> vyjimky
iptables -A FORWARD -p TCP -s 192.168.1.75 -d 0/0 --dport 80 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.75 -d 0/0 --dport 3128 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.75 -d 0/0 --dport 8080 -j ACCEPT

iptables -A FORWARD -p TCP -s 192.168.1.76 -d 0/0 --dport 80 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.76 -d 0/0 --dport 3128 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.76 -d 0/0 --dport 8080 -j ACCEPT

iptables -A FORWARD -p TCP -s 192.168.1.77 -d 0/0 --dport 80 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.77 -d 0/0 --dport 3128 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.77 -d 0/0 --dport 8080 -j ACCEPT

iptables -A FORWARD -p TCP -s 192.168.1.215 -d 0/0 --dport 80 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.215 -d 0/0 --dport 3128 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.215 -d 0/0 --dport 8080 -j ACCEPT

iptables -A FORWARD -p TCP -s 192.168.1.33 -d 0/0 --dport 80 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.33 -d 0/0 --dport 3128 -j ACCEPT
iptables -A FORWARD -p TCP -s 192.168.1.33 -d 0/0 --dport 8080 -j ACCEPT

# ---> vynuceni proxy
iptables -A FORWARD -p tcp -d 0/0 --dport 80 -j REJECT
iptables -A FORWARD -p tcp -d 0/0 --dport 3128 -j REJECT
iptables -A FORWARD -p tcp -d 0/0 --dport 8080 -j REJECT

#ping limit atd.
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 5 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
iptables -A INPUT -p tcp -m tcp --tcp-flags RST RST -j ACCEPT

iptables -A INPUT -p ALL -i eth0 -j ACCEPT
iptables -A INPUT -p ALL -i lo -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#AUTH off
iptables -A INPUT -i eth1 -p tcp --dport 113 -j REJECT

#FTP aktivni
echo "1" > /proc/sys/net/ipv4/conf/eth1/rp_filter
iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

#IP Spoof
iptables -N spoofing
iptables -A spoofing -s 192.168.0.0/16 -j DROP
iptables -A spoofing -s 172.16.0.0/12 -j DROP
iptables -A spoofing -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth1 -j spoofing
iptables -A FORWARD -i eth1 -j spoofing

for v_port in $TCP_ADMIN; do
	for v_host in $ADMIN_ACCESS; do
		iptables -A INPUT -p tcp -s $v_host -d 0/0 --dport $v_port -j ACCEPT
	done
done

for pc_ip in $BAD_IP; do
    iptables -A INPUT -p tcp -s $pc_ip -d 0/0 -j DROP
    iptables -A INPUT -p udp -s $pc_ip -d 0/0 -j DROP
done	

for v_port in $TCP_PUBLIC; do
    iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport $v_port -j ACCEPT
done

#DC
iptables -A FORWARD -p tcp -d 192.168.1.75 --dport 2584 -o eth0 -j ACCEPT
iptables -A FORWARD -p udp -d 192.168.1.75 --dport 2584 -o eth0 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.77 --dport 2585 -o eth0 -j ACCEPT
iptables -A FORWARD -p udp -d 192.168.1.77 --dport 2585 -o eth0 -j ACCEPT
iptables -A PREROUTING -t nat -p tcp -i eth1 --dport 2584 -j DNAT --to 192.168.1.75:2584
iptables -A PREROUTING -t nat -p udp -i eth1 --dport 2584 -j DNAT --to 192.168.1.75:2584
iptables -A PREROUTING -t nat -p tcp -i eth1 --dport 2585 -j DNAT --to 192.168.1.77:2585
iptables -A PREROUTING -t nat -p udp -i eth1 --dport 2585 -j DNAT --to 192.168.1.77:2585

#prerouting na www 81  intranetu (apache zde bezi na portu 81)
iptables -t nat -A PREROUTING -p tcp -d vnejsi_ip --dport 81 -s z_povolene_ip -j DNAT --to vnitrni_ip:81
iptables -A FORWARD -i eth1 -o eth0 -p tcp -d vnitrni_ip --dport 81 -s z_povolene_ip -j ACCEPT

iptables -A INPUT -p tcp -s 0/0 -d 0/0 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -s 0/0 -d 0/0 -j REJECT