Subversion Repositories ALCASAR

Rev

Rev 672 | Rev 688 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 672 Rev 675
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/sh
2 
# $Id: alcasar-iptables.sh 672 2011-07-08 15:34:22Z richard $
 2 
# $Id: alcasar-iptables.sh 675 2011-07-18 21:24:19Z richard $
3 
 
 - 
 
4 
# alcasar-iptables.sh
 - 
 
5 
# by Rexy - 3abtux - CPN
 - 
 
6 
# This script is distributed under the Gnu General Public License (GPL)
 - 
 
7 
 
 - 
 
8 
# Mise en place des regles du parefeu d'Alcasar (mode normal)
 3 
# Script de mise en place des regles du parefeu d'Alcasar (mode normal)
9 
# This script write the netfilter rules for ALCASAR
 4 
# This script write the netfilter rules for ALCASAR
- 
 
 5 
# Rexy - 3abtux - CPN
- 
 
 6 
#
- 
 
 7 
# Reminders
10 
# There are three channels for log :
 8 
# There are three channels for log :
11 
#	1 (default) for tracability;
 9 
#	1 (default) for tracability;
12 
#	2 for secure admin (ssh);
 10 
#	2 for secure admin (ssh);
13 
#	3 for exterior access attempts.
 11 
#	3 for exterior access attempts.
14 
# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
 12 
# The French Security Agency (ANSSI) rules was applied by 'alcasar.sh' script
- 
 
 13 
# The bootps/dhcp (67) port is always open on tun0/eth1 by coova
15 
 
 14 
 
16 
conf_file="/usr/local/etc/alcasar.conf"
 15 
conf_file="/usr/local/etc/alcasar.conf"
17 
private_ip_mask=`grep PRIVATE_IP $conf_file|cut -d"=" -f2`
 16 
private_ip_mask=`grep PRIVATE_IP $conf_file|cut -d"=" -f2`
18 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
 17 
private_ip_mask=${private_ip_mask:=192.168.182.1/24}
19 
private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`		# LAN IP address (ie.: 192.168.182.0)
 18 
private_network=`/bin/ipcalc -n $private_ip_mask|cut -d"=" -f2`		# LAN IP address (ie.: 192.168.182.0)
Line 33... Line 32...
33 
LDAP=`grep LDAP $conf_file|cut -d"=" -f2`				# ldap external server active (on/off)
 32 
LDAP=`grep LDAP $conf_file|cut -d"=" -f2`				# ldap external server active (on/off)
34 
LDAP=${LDAP:=off}
 33 
LDAP=${LDAP:=off}
35 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
 34 
PRIVATE_NETWORK_MASK=$private_network/$private_prefix			# Lan IP address + prefix (192.168.182.0/24)
36 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
 35 
PRIVATE_IP=`echo $private_ip_mask | cut -d"/" -f1`			# ALCASAR LAN IP address
37 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
 36 
DNSSERVERS="$dns1,$dns2"						# first and second DNS IP servers addresses
38 
EXTIF="eth0"
37 
EXTIF="eth0"
39 
INTIF="eth1"
 38 
INTIF="eth1"
40 
TUNIF="tun0"								# listen card for chilli daemon
 39 
TUNIF="tun0"								# listen card for chilli daemon
41 
IPTABLES="/sbin/iptables"
 40 
IPTABLES="/sbin/iptables"
42 
 
 41 
 
43 
# Effacement des règles existantes
 42 
# Effacement des règles existantes
Line 64... Line 63...
64 
$IPTABLES -t nat -P OUTPUT ACCEPT
 63 
$IPTABLES -t nat -P OUTPUT ACCEPT
65 
 
 64 
 
66 
# Tout passe sur loopback
 65 
# Tout passe sur loopback
67 
# accept all on loopback
 66 
# accept all on loopback
68 
$IPTABLES -A INPUT -i lo -j ACCEPT
 67 
$IPTABLES -A INPUT -i lo -j ACCEPT
69
- 
 
70 
# On élimine les paquets "NEW not SYN"
 - 
 
71 
# Ensure that TCP connections start with syn packets
 - 
 
72 
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
 - 
 
73 
 
 68 
 
74 
#############################
 69 
#############################
75 
#       INTIF rules         #
 70 
#       INTIF rules         #
76 
#############################
 71 
#############################
77 
# les requètes dhcp entrantes sont acceptées
 - 
 
78 
# accept dhcp
 - 
 
79 
$IPTABLES -A INPUT -i $INTIF -p udp -m udp --sport bootpc --dport bootps -j ACCEPT
 - 
 
80 
 
 - 
 
81 
# La règle suivante interdit la sortie par INTIF. Elle n'est utile que lorsque chilli est arrêté.
 72 
# interdit l'accès à INTIF (n'est utile que lorsque chilli est arrêté).
82 
# INTIF is closed (all by TUNIF)
 73 
# Reject INTIF access (only when chilli is down)
83 
$IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE Protect1 -- REJECT "
 74 
$IPTABLES -A INPUT -i $INTIF -j ULOG --ulog-prefix "RULE Protect1 -- REJECT "
84 
$IPTABLES -A INPUT -i $INTIF -j REJECT
 75 
$IPTABLES -A INPUT -i $INTIF -j REJECT
85 
 
 76 
 
86 
#############################
 77 
#############################
87 
#  Local protection rules   #
 78 
#  Local protection rules   #
88 
#############################
 79 
#############################
89 
# On stoppe les tentatives de NULLSCAN et XMAS (tous flags à 1)
 80 
# On stoppe les demande de connexions non conformes (NullScan, XMAS (tous flags à 1), NEW not SYN, etc.)
90 
# Drop XMAS & NULLscans
81 
# Drop non standard connexions (NULLscans, XMAS, "NEW not SYN", etc.)
91 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
 82 
$IPTABLES -A INPUT -p tcp --tcp-flags FIN,URG,PSH FIN,URG,PSH -j DROP
92 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 83 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
93 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 84 
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
94 
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
 85 
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
- 
 
 86 
$IPTABLES -A INPUT -p tcp -m tcp ! --syn -m state --state NEW -j DROP
95 
 
 87 
 
96 
# On stoppe les broadcasts et multicast
 88 
# On ne traite pas les broadcasts et multicast
97 
# Drop broadcast & multicast
 89 
# Drop broadcast & multicast
98 
$IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
 90 
$IPTABLES -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP
99 
 
 91 
 
100 
# Rejet des tentatives de création de tunnels DNS (même pour les utilisateurs authentifiés)
92 
# Rejet des tentatives de création de tunnels DNS (même pour les utilisateurs authentifiés)
101 
# Deny forward DNS (even for authenticated users ...)
 93 
# Deny forward DNS (even for authenticated users ...)