I welcome today I am describing the firewall for you
Code:
#!/bin/sh
#######################################
### BEGIN INIT INFO
# Provides: firewall
# Required-Start: $local_fs $network $named $time $syslog $remote_fs
# Required-Stop: $local_fs $network $named $time $syslog $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Description: Personal Firewall - Preventing attacks/open common ports
### END INIT INFO
### Module loading ###
/sbin/depmod -a
### Required modules ###
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe ipt_REJECT
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
### Non-Required modules ###
#/sbin/modprobe ipt_owner
#/sbin/modprobe iptable_mangle
#/sbin/modprobe ip_conntrack
#/sbin/modprobe ip_conntrack_ftp
#/sbin/modprobe ip_conntrack_irc
#/sbin/modprobe ip_nat_ftp
#/sbin/modprobe ip_nat_irc
#/sbin/modprobe ipt_MASQUERADE
# To start the firewall
start()
{
### Allow Forward ip ###
echo 1 > /proc/sys/net/ipv4/ip_forward
### Flush any Existing iptable Rules and start afresh ###
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F POSTROUTING -t nat
iptables -F PREROUTING -t nat
### Setting up Port Services ###
iptables -A INPUT -p tcp --dport 25 -j ACCEPT //incoming mail
iptables -A INPUT -p tcp --dport 53 -j ACCEPT //dns - udp for large queries
iptables -A INPUT -p udp --dport 53 -j ACCEPT //dns - udp for small queries
iptables -A INPUT -p tcp --dport 80 -j ACCEPT //apache
iptables -A INPUT -p tcp --dport 443 -j ACCEPT //apache ssl
iptables -A INPUT -p udp --dport 161 -j ACCEPT //snmpd
iptables -A INPUT -p tcp --dport 953 -j ACCEPT //dns internal
iptables -A INPUT -p tcp --dport 1080 -j ACCEPT //dante socks server
iptables -A INPUT -p all --dport 3020 -j ACCEPT //cifs-smb
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT //squid
iptables -A INPUT -p tcp --dport 4949 -j ACCEPT //munin stats
### Setting up Local Ports ###
iptables -A INPUT -d 192.168.1.120 -p udp --dport 9 -j ACCEPT //WOL (wake on lan)
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 20:21 -j ACCEPT //ftp
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -j ACCEPT //sshd
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 139 -j ACCEPT //samba
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 993 -j ACCEPT //imaps
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 3306 -j ACCEPT //mysql
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 8000 -j ACCEPT //apache on phi
iptables -A INPUT -s 192.168.1.120 -p tcp --dport 8080 -j ACCEPT //tomcat
iptables -A INPUT -s 127.0.0.1 -p tcp --dport 111 -j ACCEPT //to speed up mail via courier. Identified via logging
iptables -A INPUT -s 127.0.0.1 -p tcp --dport 143 -j ACCEPT //squirrelmail
### Preventing Attacks ###
iptables -A INPUT -p icmp -j ACCEPT //Allow ICMP Ping packets.
iptables -A INPUT -p tcp --tcp-flags ACK ACK -j ACCEPT //Accept traffic with the ACK flag set
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP //Deny all null packets
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP //Deny all recon packets
iptables -A INPUT -p tcp --tcp-flags ALL FIN -j DROP //nmap FIN stealth scan
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP //SYN + FIN
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP //SYN + RST
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP //FIN + RST
iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP //FIN + URG + PSH
iptables -A INPUT -p tcp --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN -j DROP //XMAS
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP //FIN without ACK
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP //PSH without ACK
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP //URG without ACK
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP //Deny SYN flood attack
iptables -A INPUT -m state --state ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT //Accept traffic with ESTABLISHED flag set (limit - DDoS prevent)
iptables -A INPUT -m state --state RELATED -m limit --limit 50/second --limit-burst 50 -j ACCEPT //Accept traffic with RELATED flag set (limit - DDoS prevent)
iptables -A INPUT -m state --state INVALID -j DROP //Deny traffic with the INVALID flag set
#################################
### PERSONALIZED RULES 80 PORT ###
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT //Protection DDoS attacks
### PERSONALIZED RULES 22 PORT ###
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m state --state NEW -m recent --set --name SSH --rsource
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m recent --rcheck --seconds 30 --hitcount 4 --rttl --name SSH --rsource -j REJECT --reject-with tcp-reset //Protection bruteforce SSH
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m recent --rcheck --seconds 30 --hitcount 3 --rttl --name SSH --rsource -j LOG --log-prefix "SSH brute force "
iptables -A INPUT -d 192.168.1.120 -p tcp --dport 22 -m tcp -m recent --update --seconds 30 --hitcount 3 --rttl --name SSH --rsource -j REJECT --reject-with tcp-reset
########### CLOSE ALL ############
iptables -A INPUT -j REJECT //Close up firewall. All else blocked.
######### PORT FORWARDING #######
iptables -t nat -A PREROUTING -p tcp -d 192.168.1.120 --dport 8000 -j DNAT --to 1.2.3.4:80
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4 //for static ip
#iptables -t nat -A POSTROUTING -d 1.2.3.4 -j MASQUERADE //for dynamic ip
#################################
echo "--------------------------------------------------"
echo "Firewall Loaded"
echo "--------------------------------------------------"
echo "Netstat output:"
echo ""
netstat -tuanp
echo "Verify enabled rules with:"
echo "filter) iptables -L -nvx"
echo "nat) iptables -t nat -L -nvx"
echo "script) firewall.sh status"
EXT=0
}
### To stop the firewall ###
stop()
{
### Deny Forward ip ###
echo 0 > /proc/sys/net/ipv4/ip_forward
echo "--------------------------------------------------"
echo "Firewall Stopped"
echo "--------------------------------------------------"
EXT=0
}
### To clear rules ###
clear()
{
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F POSTROUTING -t nat
iptables -F PREROUTING -t nat
EXT=0
}
case $1 in
start)
clear
start
;;
stop)
clear
stop
;;
restart)
clear
sleep 2
start
;;
status)
echo "--------------------------------------------------"
echo "--------------------------------------------------"
echo "Status Firewall"
echo "--------------------------------------------------"
#iptables -L -n
echo "--------------------------------------------------"
echo "FILTER"
echo "--------------------------------------------------"
iptables -L -nvx
echo "--------------------------------------------------"
echo "NAT"
echo "--------------------------------------------------"
iptables -t nat -L -nvx
EXT=0
;;
*)
echo "Usage: firewall.sh {start|stop|restart|status}"
EXT=1
;;
esac
exit $EXT
[code]
