Administrace komentářů

#!/bin/bash

  IPT="/usr/sbin/iptables"
  IFC="/sbin/ifconfig"
  G="/bin/grep"
  SED="/bin/sed"
  AWK="/usr/bin/awk"
  ECHO="/bin/echo"

  # External interface
  EXTIF="eth1"
  EXTIP="192.168.3.2"
  EXTBC="255.255.255.255"
  EXTMSK="255.255.255.0"
  EXTNET="192.168.3.2/$EXTMSK"

  # Wifi siet
  WIFI="eth0"
  WIFINET="192.168.1.0"
  WIFIIP="192.168.1.254"
  WIFIMASK="255.255.255.0"
  WIFINETMASK="$WIFINET/$WIFIMASK"
  WIFIENABLE="yes"

  # Loop device/localhost
  LPDIF="lo"
  LPDIP="127.0.0.1"
  LPDMSK="255.0.0.0"
  LPDNET="$LPDIP/$LPDMSK"

  # services ENABLED from wifi network openvpn sa povoluje iba v cykle pre tap iface
  WIFI_SERVICE_TCP=(http domain ssh 67 10000 pop3 1194);
  WIFI_SERVICE_UDP=(http domain ssh 67 1194);

  # services ENABLED from external network
  EXTERNAL_SERVICE_TCP=(ssh http domain 445 139 2049 111 831 761 946 1629 1194);
  EXTERNAL_SERVICE_UDP=(ssh http domain 445 139 2049 111 831 761 946 1629 1194);

  # services ENABLED from localhost
  TCPSERV=(smtp http ftp ftps ftp-data ftps-data https mysql imap imaps pop3 pop3s domain ssh 445 139 2049 111 831 761 946 1629 1194)
  UDPSERV=(smtp http ftp ftps ftp-data ftps-data https mysql imap imaps pop3 pop3s domain ssh 445 139 2049 111 831 761 946 1629 1194)

start() {

  trap "" 2 3

  echo "Setting default policy:"
  $IPT -P INPUT DROP;
  $IPT -P OUTPUT ACCEPT;
  $IPT -P FORWARD DROP;

  CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
  for i in $CHAINS
  do
   $IPT -t $i -F
  done
  for i in $CHAINS
  do
   $IPT -t $i -X
  done

  echo "  INPUT -> DROP";
  echo " OUTPUT -> ACCEPT";
  echo "FORWARD -> DROP";

  echo 1 > /proc/sys/net/ipv4/ip_forward

  # DROP invalid packets
  $IPT -A INPUT -i $EXTIF -m state --state INVALID -j DROP

  # Block IP with bad destination
  $IPT -A INPUT -i $EXTIF -d ! $EXTIP -j DROP
 
  # allow localhost (local connections)
  $IPT -A INPUT -i tap0 -j ACCEPT
  $IPT -A INPUT -i $LPDIF -s $LPDIP -j ACCEPT
  $IPT -A INPUT -i $LPDIF -s $EXTIP -j ACCEPT
  # MASQUERADING internal network, if requested
  echo "MASQuerading outgoing connections"
  $IPT -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

  # input
  $IPT -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT

  # forward
  $IPT -A FORWARD -p TCP -m state --state RELATED,ESTABLISHED -j ACCEPT
  $IPT -A FORWARD -p UDP -m state --state RELATED,ESTABLISHED -j ACCEPT
  $IPT -A FORWARD -i tap0 -o eth1 -j ACCEPT

    ## INPUT Z VONKU TCP
  ############################################################################
  echo -n "FW: ACCEPTing external TCP services... ";
  let a=0;
  for port in ${EXTERNAL_SERVICE_TCP[@]} ; do
      $IPT -A INPUT -p tcp -d $EXTIP -i $EXTIF --dport $port -j ACCEPT ;
      let a=$a+1;
  done;
  echo "($a)";
    ## INPUT Z VONKU UDP
  ############################################################################
  echo -n "FW: ACCEPTing external UDP services... ";
  let a=0;
  for port in ${EXTERNAL_SERVICE_UDP[@]} ; do
      $IPT -A INPUT -p udp -d $EXTIP -i $EXTIF --dport $port -j ACCEPT ;
      let a=$a+1;
  done;
  echo "($a)";

  ## INPUT Z WIFI TCP
  ############################################################################
  echo -n "FW: ACCEPTing wifi TCP services... ";
  let a=0;
  for port in ${WIFI_SERVICE_TCP[@]} ; do
      $IPT -A INPUT -i $WIFI -p tcp  --dport $port -j ACCEPT ;
      let a=$a+1;
  done;
  echo "($a)";
  ## INPUT Z WIFI UDP
  ############################################################################
  echo -n "FW: ACCEPTing wifi UDP services... ";
  let a=0;
  for port in ${WIFI_SERVICE_UDP[@]} ; do
      $IPT -A INPUT -i $WIFI -p udp  --dport $port -j ACCEPT ;
      let a=$a+1;
  done;
  echo "($a)";

  echo "Firewall rules applied!"
  trap - 2 3
}

stop() {
  trap "" 2 3
  echo "Stopping $prog: "


  CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null`
  for i in $CHAINS
  do
   $IPT -t $i -F
  done
  for i in $CHAINS
  do
   $IPT -t $i -X
  done

  echo "Setting default policies to ACCEPT"
  $IPT -P INPUT ACCEPT
  $IPT -P OUTPUT ACCEPT
  $IPT -P FORWARD ACCEPT

  trap - 2 3
}

restart() {
  stop
  start
}

case "$1" in
  start)
        start
        ;;
  stop)
        stop
        ;;
  restart)
        restart
        ;;
  *)
        echo $"Usage: $0 {start|stop|restart}"
        exit 1
esac

exit $?