Subversion Repositories ALCASAR

Rev

Rev 478 | Rev 493 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log

Rev 478 Rev 492
Line 1... Line 1...
1
#!/bin/sh
1
#!/bin/sh
2
# $Id: alcasar-iptables.sh 478 2011-02-07 23:17:10Z richard $
2
# $Id: alcasar-iptables.sh 492 2011-02-14 06:40:53Z franck $
3
# script de mise en place des regles du parefeu d'Alcasar (mode normal)
3
# script de mise en place des regles du parefeu d'Alcasar (mode normal)
4
# Rexy - 3abtux - CPN
4
# Rexy - 3abtux - CPN
5
# there are three channels for log : 1 (default) for tracability, 2 for secure admin (ssh), 3 for exterior access attempts,
5
# there are three channels for log : 1 (default) for tracability, 2 for secure admin (ssh), 3 for exterior access attempts,
6
 
6
 
7
IPTABLES="/sbin/iptables"
7
IPTABLES="/sbin/iptables"
8
FILTERING="no"
8
FILTERING="no"
-
 
9
QOS="no"
9
EXTIF="eth0"
10
EXTIF="eth0"
10
INTIF="eth1"
11
INTIF="eth1"
11
TUNIF="tun0"
12
TUNIF="tun0"
12
PRIVATE_NETWORK_MASK="192.168.182.0/24"
13
PRIVATE_NETWORK_MASK="192.168.182.0/24"
13
PRIVATE_IP="192.168.182.1"
14
PRIVATE_IP="192.168.182.1"
Line 17... Line 18...
17
$IPTABLES -t nat -F
18
$IPTABLES -t nat -F
18
$IPTABLES -t mangle -F
19
$IPTABLES -t mangle -F
19
$IPTABLES -F INPUT
20
$IPTABLES -F INPUT
20
$IPTABLES -F FORWARD
21
$IPTABLES -F FORWARD
21
$IPTABLES -F OUTPUT
22
$IPTABLES -F OUTPUT
-
 
23
$IPTABLES -N SYN-FLOOD
22
 
24
 
23
# Default policies
25
# Default policies
24
$IPTABLES -P INPUT DROP
26
$IPTABLES -P INPUT DROP
25
$IPTABLES -P FORWARD DROP
27
$IPTABLES -P FORWARD DROP
26
$IPTABLES -P OUTPUT ACCEPT
28
$IPTABLES -P OUTPUT ACCEPT
Line 33... Line 35...
33
$IPTABLES -t nat -X
35
$IPTABLES -t nat -X
34
 
36
 
35
# accept all on loopback
37
# accept all on loopback
36
$IPTABLES -A INPUT -i lo -j ACCEPT
38
$IPTABLES -A INPUT -i lo -j ACCEPT
37
 
39
 
-
 
40
# Block all attempts to spoof the loopback address
-
 
41
$IPTABLES -A INPUT -s 127.0.0.0/8 -j DROP
-
 
42
$IPTABLES -A INPUT -d 127.0.0.0/8 -j DROP
-
 
43
 
-
 
44
# Block all attempts to spoof the local IP address
-
 
45
$IPTABLES -A INPUT -s $PRIVATE_IP -j DROP
-
 
46
 
-
 
47
# Block Syn Flood attacks
-
 
48
$IPTABLES -A INPUT -p tcp -m tcp --syn -j SYN-FLOOD
-
 
49
 
-
 
50
# Syn flood filtering chain
-
 
51
$IPTABLES -A SYN-FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
-
 
52
$IPTABLES -A SYN-FLOOD -j DROP
-
 
53
 
-
 
54
# Ensure that TCP connections start with syn packets
-
 
55
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
-
 
56
 
38
#############################
57
#############################
39
#       INTIF rules         #
58
#       INTIF rules         #
40
#############################
59
#############################
41
# accept dhcp
60
# accept dhcp
42
$IPTABLES -A INPUT -i $INTIF -p udp -m udp --sport bootpc --dport bootps -j ACCEPT
61
$IPTABLES -A INPUT -i $INTIF -p udp -m udp --sport bootpc --dport bootps -j ACCEPT
Line 111... Line 130...
111
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
130
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
112
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
131
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
113
	$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
132
	$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
114
	$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT 
133
	$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT 
115
fi
134
fi
-
 
135
 
-
 
136
########################
-
 
137
#  If QOS is activate  #
-
 
138
########################
-
 
139
if [ $QOS = "yes" ]; then
-
 
140
	. /usr/local/etc/alcasar-iptables-qos.sh 	
-
 
141
fi
-
 
142
 
116
# Allow forward connections with log
143
# Allow forward connections with log
117
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
144
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
118
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
145
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
119
 
146
 
120
####################################################################################
147
####################################################################################
Line 147... Line 174...
147
 
174
 
148
# Deny and log on INPUT from the LAN
175
# Deny and log on INPUT from the LAN
149
$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
176
$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
150
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
177
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
151
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
178
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
-
 
179
 
152
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
180
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
153
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
181
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
154
# Drop on EXTIF
182
# Drop on EXTIF
155
$IPTABLES -A INPUT -i $EXTIF -j DROP
183
$IPTABLES -A INPUT -i $EXTIF -j DROP
156
 
184