Administrace komentářů

#! /bin/sh

#exit 0
#nohup sh -c '(sleep 60; iptables -P INPUT ACCEPT; iptables -F )' &
#--------------------------------------------------------------------------
# predpoklad: existuje prave jedno vnejsi rozhrani - pozna se podle
# defaultni routy OUTIF=`ip route list | grep '^default' | awk '{print $5}'`
# OTHERIFS jsou vsechna rozhrani, ktera jsou UP a nejsou lo ani $OUTIF OTHERIFS=`ip link list | grep '^[0-9].*UP' | awk '{print $2}' | \
grep -v $OUTIF | grep -v lo | awk -F : '{print $1}'`
SECURENETS="217.112.160.0/23"
ALLOWED_SERVICES="smtp www ftp ftp-data"
RESTRICTED_SERVICES="ssh"
#------------------------------------------------------------------------------
insert_rules () {
# antispoofing
for dev in $OUTIF $OTHERIFS
do
# tento prikaz muze selhat, pokud je rozhrani UP, takze se dostalo do
# OUTIF nebo OTHERIFS, ale nema pridelenou adresu - adresar
# /proc/sys/net/ipv4/conf/$dev nezacne existovat, kdyz jde
# rozhrani UP, ale az kdyz rozhrani dostane adresu
(echo "1" >/proc/sys/net/ipv4/conf/$dev/rp_filter) 2>/dev/null
done
#--------------------------------------------------------------------------
# INPUT
#
# default = neprojdou
iptables -P INPUT DROP
# akceptujeme vsechno, co nejde z Internetu (a vsechny pravidla od tohoto
# dolu uz resi vylucne provoz prichazejici pres OUTIF)
iptables -A INPUT -j ACCEPT -i ! $OUTIF
# povolene sluzby akceptujeme i z Internetu
for service in $ALLOWED_SERVICES
do
iptables -A INPUT -j ACCEPT -p tcp --dport $service
done
# omezene sluzby jenom z nasich siti
for service in $RESTRICTED_SERVICES
do
for secure_net in $SECURENETS
do
iptables -A INPUT -j ACCEPT -p tcp -s $secure_net --dport $service
done
done
# zajisti stastny navrat paketu iniciovanych timto strojem
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# co neni povoleno na TCP, dostane RST, na UDP ICMP Port Unreachable
iptables -A INPUT -i $OUTIF -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -i $OUTIF -p udp -j REJECT \
--reject-with icmp-port-unreachable
# ICMP akceptujeme odevsad
iptables -A INPUT -p icmp -j ACCEPT
#--------------------------------------------------------------------------
# FORWARD
iptables -P FORWARD ACCEPT
#--------------------------------------------------------------------------
# NAT
iptables -t nat -A POSTROUTING -s 192.168.0.100/32 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.0.100:80
iptables -t nat -A PREROUTING -p tcp --dport 20 -j DNAT --to-destination 192.168.0.100:20
iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to-destination 192.168.0.100:21
#--------------------------------------------------------------------------
}
delete_rules () {
iptables -t filter -F
iptables -t nat -F
iptables -t mangle -F
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
}
case "$1" in
start)
echo -n "Starting firewall ... "
insert_rules
echo "done."
;;
stop)
echo -n "Stopping firewall ... "
delete_rules
echo "done."
;;
*)
N=/etc/init.d/firewall
echo "Usage: $N {start|stop}" >&2
exit 1
;;
esac
exit 0