Subversion Repositories ALCASAR

Rev

Rev 478 | Rev 493 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 478 Rev 492
Line 1... Line 1...
1 
#!/bin/sh
 1 
#!/bin/sh
2 
# $Id: alcasar-iptables.sh 478 2011-02-07 23:17:10Z richard $
 2 
# $Id: alcasar-iptables.sh 492 2011-02-14 06:40:53Z franck $
3 
# script de mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# script de mise en place des regles du parefeu d'Alcasar (mode normal)
4 
# Rexy - 3abtux - CPN
 4 
# Rexy - 3abtux - CPN
5 
# there are three channels for log : 1 (default) for tracability, 2 for secure admin (ssh), 3 for exterior access attempts,
 5 
# there are three channels for log : 1 (default) for tracability, 2 for secure admin (ssh), 3 for exterior access attempts,
6 
 
 6 
 
7 
IPTABLES="/sbin/iptables"
 7 
IPTABLES="/sbin/iptables"
8 
FILTERING="no"
 8 
FILTERING="no"
- 
 
 9 
QOS="no"
9 
EXTIF="eth0"
 10 
EXTIF="eth0"
10 
INTIF="eth1"
 11 
INTIF="eth1"
11 
TUNIF="tun0"
 12 
TUNIF="tun0"
12 
PRIVATE_NETWORK_MASK="192.168.182.0/24"
 13 
PRIVATE_NETWORK_MASK="192.168.182.0/24"
13 
PRIVATE_IP="192.168.182.1"
 14 
PRIVATE_IP="192.168.182.1"
Line 17... Line 18...
17 
$IPTABLES -t nat -F
 18 
$IPTABLES -t nat -F
18 
$IPTABLES -t mangle -F
 19 
$IPTABLES -t mangle -F
19 
$IPTABLES -F INPUT
 20 
$IPTABLES -F INPUT
20 
$IPTABLES -F FORWARD
 21 
$IPTABLES -F FORWARD
21 
$IPTABLES -F OUTPUT
 22 
$IPTABLES -F OUTPUT
- 
 
 23 
$IPTABLES -N SYN-FLOOD
22 
 
 24 
 
23 
# Default policies
 25 
# Default policies
24 
$IPTABLES -P INPUT DROP
 26 
$IPTABLES -P INPUT DROP
25 
$IPTABLES -P FORWARD DROP
 27 
$IPTABLES -P FORWARD DROP
26 
$IPTABLES -P OUTPUT ACCEPT
 28 
$IPTABLES -P OUTPUT ACCEPT
Line 33... Line 35...
33 
$IPTABLES -t nat -X
 35 
$IPTABLES -t nat -X
34 
 
 36 
 
35 
# accept all on loopback
 37 
# accept all on loopback
36 
$IPTABLES -A INPUT -i lo -j ACCEPT
 38 
$IPTABLES -A INPUT -i lo -j ACCEPT
37 
 
 39 
 
- 
 
 40 
# Block all attempts to spoof the loopback address
- 
 
 41 
$IPTABLES -A INPUT -s 127.0.0.0/8 -j DROP
- 
 
 42 
$IPTABLES -A INPUT -d 127.0.0.0/8 -j DROP
- 
 
 43 
 
- 
 
 44 
# Block all attempts to spoof the local IP address
- 
 
 45 
$IPTABLES -A INPUT -s $PRIVATE_IP -j DROP
- 
 
 46 
 
- 
 
 47 
# Block Syn Flood attacks
- 
 
 48 
$IPTABLES -A INPUT -p tcp -m tcp --syn -j SYN-FLOOD
- 
 
 49 
 
- 
 
 50 
# Syn flood filtering chain
- 
 
 51 
$IPTABLES -A SYN-FLOOD -m limit --limit 1/s --limit-burst 4 -j RETURN
- 
 
 52 
$IPTABLES -A SYN-FLOOD -j DROP
- 
 
 53 
 
- 
 
 54 
# Ensure that TCP connections start with syn packets
- 
 
 55 
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
- 
 
 56 
 
38 
#############################
 57 
#############################
39 
#       INTIF rules         #
 58 
#       INTIF rules         #
40 
#############################
 59 
#############################
41 
# accept dhcp
 60 
# accept dhcp
42 
$IPTABLES -A INPUT -i $INTIF -p udp -m udp --sport bootpc --dport bootps -j ACCEPT
 61 
$IPTABLES -A INPUT -i $INTIF -p udp -m udp --sport bootpc --dport bootps -j ACCEPT
Line 111... Line 130...
111 
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
 130 
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j ULOG --ulog-prefix "RULE F_filter -- REJECT "
112 
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
 131 
	$IPTABLES -A FORWARD -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
113 
	$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
 132 
	$IPTABLES -A FORWARD -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
114 
	$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT
133 
	$IPTABLES -A FORWARD -i $TUNIF -p icmp -j REJECT
115 
fi
 134 
fi
- 
 
 135 
 
- 
 
 136 
########################
- 
 
 137 
#  If QOS is activate  #
- 
 
 138 
########################
- 
 
 139 
if [ $QOS = "yes" ]; then
- 
 
 140 
	. /usr/local/etc/alcasar-iptables-qos.sh
- 
 
 141 
fi
- 
 
 142 
 
116 
# Allow forward connections with log
 143 
# Allow forward connections with log
117 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
 144 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
118 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
 145 
$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
119 
 
 146 
 
120 
####################################################################################
 147 
####################################################################################
Line 147... Line 174...
147 
 
 174 
 
148 
# Deny and log on INPUT from the LAN
 175 
# Deny and log on INPUT from the LAN
149 
$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
 176 
$IPTABLES -A INPUT -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE rej-int -- REJECT "
150 
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
 177 
$IPTABLES -A INPUT -i $TUNIF -p tcp -j REJECT --reject-with tcp-reset
151 
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
 178 
$IPTABLES -A INPUT -i $TUNIF -p udp -j REJECT --reject-with icmp-port-unreachable
- 
 
 179 
 
152 
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
 180 
# On EXTIF, the access attempts are log in channel 2 (we should test --limit option to avoid deny of service)
153 
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
 181 
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW -j ULOG --ulog-nlgroup 3 --ulog-qthreshold 10 --ulog-prefix "RULE rej-ext -- DROP"
154 
# Drop on EXTIF
 182 
# Drop on EXTIF
155 
$IPTABLES -A INPUT -i $EXTIF -j DROP
 183 
$IPTABLES -A INPUT -i $EXTIF -j DROP
156 
 
 184