#!/bin/sh
#
# 石牌國小防火牆設定
# 2004/12/13
# 設定者：李忠憲（修改自 iptables tutorial 1.1.11 by Oskar Andreasson ）
# 原文件是依 DMZ 需求設計，已根據校園 NAT 網(wǎng)路之需求修改，其餘改動(dòng)部份包括：
# 新增通訊協(xié)定定義區塊
# 新增執行時(shí)，自動(dòng)清除已設定之規則
# 支援 FTP
# 修改所有規則，改採 multiport 方式以簡(jiǎn)化規則
# 原文件僅支援 IP 偽裝（多對一對應），已擴充為支援一對一對應及多對多對應
# 原文件僅支援 DNS 及 WEB，新增 ftp、mail、wam、PCAnywhere、ssh......等多種伺服器
# 修改若干原文件規則設定上的小錯誤
# 新增各類(lèi) port scan 偵測防護規則
# 新增 IP 防假冒功能
# 修改規則架構，可同時(shí)支援：無(wú) DMZ (伺服器放在內部網(wǎng)路)，DMZ 以及混合模式(伺服器有的放在內部網(wǎng)路，有的放在DMZ)
# 修改程式碼支援機器群組設定，例如：新增一臺 web server 172.16.1.10
# 1. 請在 server-nat 中定義此電腦 172.16.1.10:163.21.xxx.10
# 2. 請將 172.16.1.10 新增到 server-web 檔案中
# 3. 重新執行 iptables.sh
# 不需要再修改 iptables.sh 內的程式碼
#
# Copyright (C) 2001 Oskar Andreasson <bluefluxATkoffeinDOTnet>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program or from the site that you downloaded it
# from; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA 02111-1307 USA
#
###########################################################################
#
# 1. Configuration options.
#
# 1.0 Protocols Configuration.
#
NTP="123"
FTP_DATA="20"
FTP="21"
TFTP="69"
DHCP_SERVER="67"
DHCP_CLIENT="68"
SMTP="25"
POP3="110"
AUTH="113"
IMAP="143"
SSH="22"
DNS="53"
HTTP="80"
HTTPS="443"
WINS="41"
RPC1="135"
RPC2="445"
NETBIOS1="137"
NETBIOS2="138"
NETBIOS3="139"
PCAW_TCP="5631"
PCAW_UDP="5632"
REAL="6970:7170"
WEBMIN="10000"
WAM="12000"
ED_TCP1="4661"
ED_TCP2="4662"
ED_UDP="4665"
######## ADD for SQL Server JSDB database #############
#SQL="1433"
#REMOTE_SQL_IP="163.21.178.0/255.255.255.128"
#########################################
#
# 1.1 Internet Configuration.
#
INET_IP="202.119.76.64"
#IP_POOL="163.21.166.240-163.21.166.250"
INET_IFACE="eth0"
#
# 1.2 Local Area Network configuration.
#
# your LAN‘s IP range and localhost IP. /24 means to only use the first 24
# bits of the 32 bit IP address. the same as netmask 255.255.255.0
#
LAN_IP="192.168.214.1"
LAN_IP_RANGE="192.168.214.0/24"
LAN_BROADCAST_ADDRESS="192.168.214.255"
LAN_IFACE="eth1"
#
# 1.3 DMZ Network configuration.
#
# your DMZ‘s IP range and dmz IP. /24 means to only use the first 24
# bits of the 32 bit IP address. the same as netmask 255.255.255.0
#
#DMZ_IP="192.168.1.254"
#DMZ_IP_RANGE="192.168.1.0/24"
#DMZ_BROADCAST_ADDRESS="192.168.1.255"
#DMZ_IFACE="eth2"
#
# 1.4 Localhost Configuration.
#
LO_IFACE="lo"
LO_IP="127.0.0.1"
#
# 1.5 IPTables Configuration.
#
IPTABLES="/sbin/iptables"
#
# 1.6 Other Configuration.
#
BAD="00:90:96:0a:b7:52"
###########################################################################
#
# 2. Module loading.
#
#
/sbin/depmod -a
#
# 2.1 Required modules
#
#
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
#
# 2.2 Non-Required modules
#
#/sbin/modprobe ipt_owner
#/sbin/modprobe ipt_REJECT
#/sbin/modprobe ipt_MASQUERADE
#/sbin/modprobe ip_conntrack_irc
#/sbin/modprobe ip_nat_irc
###########################################################################
#
# 3. /proc set up.
#
#
# 3.1 Required proc configuration
#
# trying to stop some smurf attacks.
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Don‘t accept source routed packets.
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
# Syncookies (if they are really needed any more?)
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# We don‘t like ICMP redirect,
echo "0" > /proc/sys/net/ipv4/conf/default/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
# Enable bad error message protection.
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Enabling IP forwarding.
echo "1" > /proc/sys/net/ipv4/ip_forward
#
# 3.2 Non-Required proc configuration
#
# We don‘t like IP spoofing,
#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
# This enables dynamic IP address following
#echo "7" > /proc/sys/net/ipv4/ip_dynaddr
# Maximum limit of ip_conntrack
# This is RAM dependant so be careful with this.
# The max, which is the valuehere, needs around 32M RAM to work properly.
#echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max
# This is commented out and will be an option when we have a "LOG_STUFF"
# config option.
#echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
###########################################################################
#
# 4. rules set up.
#
######
# 4.1 Filter table
#
#
# 4.1.0 Reset all rules
#
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
# 4.1.1 Set policies
#
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
#
# 4.1.2 Create userspecified chains
#
# tcp_allowed chain
#
$IPTABLES -N tcp_allowed
#$IPTABLES -A tcp_allowed -p TCP --syn -j \
#LOG --log-level INFO --log-prefix "IPTABLES CONNECT IN:"
$IPTABLES -A tcp_allowed -p TCP --syn -j ACCEPT
$IPTABLES -A tcp_allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A tcp_allowed -p TCP -j DROP
#
# icmp_allowed chain
#
$IPTABLES -N icmp_allowed
$IPTABLES -A icmp_allowed -p ICMP --icmp-type 11 -j ACCEPT
$IPTABLES -A icmp_allowed -p ICMP --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_allowed -p ICMP -j DROP
#
# 4.1.3 Anti hacker
#
# null-scan
#
#$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL NONE -j LOG \
#--log-level INFO --log-prefix "IPTABLES NULL-SCAN:"
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL NONE -j DROP
#
# xmas-scan
#
#$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL ALL -j LOG \
#--log-level INFO --log-prefix "IPTABLES XMAS-SCAN:"
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL ALL -j DROP
#
# synfin-scan
#
#$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL SYN,FIN -j LOG \
#--log-level INFO --log-prefix "IPTABLES SYNFIN-SCAN:"
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL SYN,FIN -j DROP
#
# nmap-xmas-scan
#
#$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL URG,PSH,FIN -j LOG \
#--log-level INFO --log-prefix "IPTABLES NMAP-XMAS-SCAN:"
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL URG,PSH,FIN -j DROP
#
# fin-scan
#
#$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL FIN -j LOG \
#--log-level INFO --log-prefix "IPTABLES FIN-SCAN:"
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL FIN -j DROP
#
# nmap-id
#
#$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL URG,PSH,SYN,FIN -j LOG \
#--log-level INFO --log-prefix "IPTABLES NMAP-ID:"
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags ALL URG,PSH,SYN,FIN -j DROP
#
# syn-rst
#
#$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags SYN,RST SYN,RST -j LOG \
#--log-level INFO --log-prefix "IPTABLES SYN-RST:"
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags SYN,RST SYN,RST -j DROP
#
# new-without-syn
#
#$IPTABLES -t nat -A PREROUTING -p TCP ! --syn -m state --state NEW -j \
#LOG --log-level INFO --log-prefix "IPTABLES NEW-WITHOUT-SYN:"
$IPTABLES -t nat -A PREROUTING -p TCP ! --syn -m state --state NEW -j DROP
#
# syn-flood
#
#$IPTABLES -t nat -N syn_flood
#$IPTABLES -t nat -A syn_flood -m limit --limit 3/m --limit-burst 3 -j RETURN
#$IPTABLES -t nat -A syn_flood -j \
#LOG --log-level INFO --log-prefix "IPTABLES SYN-FLOOD:"
#$IPTABLES -t nat -A syn_flood -j DROP
#$IPTABLES -t nat -A PREROUTING -p TCP --syn -j syn_flood
#
# port-scan
#
$IPTABLES -t nat -N port_scan
$IPTABLES -t nat -A port_scan -m limit --limit 1/s --limit-burst 4 -j RETURN
#$IPTABLES -t nat -A port_scan -j \
#LOG --log-level INFO --log-prefix "IPTABLES PORT-SCAN:"
$IPTABLES -t nat -A port_scan -j DROP
$IPTABLES -t nat -A PREROUTING -p TCP --tcp-flags SYN,ACK,FIN,RST RST -j port_scan
#
# ping-death
#
$IPTABLES -t nat -N ping_death
$IPTABLES -t nat -A ping_death -m limit --limit 1/s --limit-burst 4 -j RETURN
#$IPTABLES -t nat -A ping_death -j \
#LOG --log-level INFO --log-prefix "IPTABLES PING-DEATH:"
$IPTABLES -t nat -A ping_death -j DROP
$IPTABLES -t nat -A PREROUTING -p ICMP --icmp-type 8 -j ping_death
#
# ip spoofing
#
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/8 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 127.0.0.0/8 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 172.16.0.0/12 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 192.168.0.0/16 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 224.0.0.0/4 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 240.0.0.0/5 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s $LAN_IP_RANGE -j DROP
#$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s $DMZ_IP_RANGE -j DROP
$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE ! -s $LAN_IP_RANGE -j DROP
#$IPTABLES -t nat -A PREROUTING -i $DMZ_IFACE ! -s $DMZ_IP_RANGE -j DROP
#
# 4.1.4 INPUT chain
#
#
#
# Packets from LAN or LOCALHOST
#
#
# From LAN Interface to LAN firewall IP
#
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BROADCAST_ADDRESS -j ACCEPT
#
# From DMZ Interface to DMZ firewall IP
#
#$IPTABLES -A INPUT -p ALL -i $DMZ_IFACE -d $DMZ_IP -j ACCEPT
#$IPTABLES -A INPUT -p ALL -i $DMZ_IFACE -d $DMZ_BROADCAST_ADDRESS -j ACCEPT
#
# From Localhost interface to Localhost IP‘s
#
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
#$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $DMZ_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
#
# Special rule for DHCP requests from LAN, which are not caught properly
# otherwise.
#
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport $DHCP_SERVER --sport
$DHCP_CLIENT -j ACCEPT
#
# All established and related packets incoming from the internet to the
# firewall
#
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED
-j ACCEPT
#
# Log weird packets that don‘t match the above.
#
#$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j \
#LOG --log-level INFO --log-prefix "IPTABLES INPUT died: "
#
# 4.1.5 FORWARD chain
#
# Block using Mac
$IPTABLES -A FORWARD -p ALL -m mac --mac-source $BAD -j DROP
#
# Hacker‘s IP
#
for client in `cat bad-ip`
do
$IPTABLES -A FORWARD -p ALL -s $client -j DROP
done
################# microsoft RPC SCAN block ###########################
$IPTABLES -A FORWARD -p TCP -m multiport
--dport $WINS,$RPC1,$RPC2,$NETBIOS1,$NETBIOS2,$NETBIOS3 -j DROP
$IPTABLES -A FORWARD -p UDP -m multiport
--dport $WINS,$RPC1,$RPC2,$NETBIOS1,$NETBIOS2,$NETBIOS3 -j DROP
######################################################################
#
# General rules
#
#$IPTABLES -A FORWARD -p TCP --syn -o $INET_IFACE -j \
#LOG --log-level INFO --log-prefix "IPTABLES CONNECT OUT:"
$IPTABLES -A FORWARD -p ALL -i $LAN_IFACE -o $INET_IFACE -j ACCEPT
#$IPTABLES -A FORWARD -p ALL -i $DMZ_IFACE -o $INET_IFACE -j ACCEPT
$IPTABLES -A FORWARD -p ALL -i $INET_IFACE -m state
--state ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A FORWARD -p ALL -i $DMZ_IFACE -m state \
#--state ESTABLISHED,RELATED -j ACCEPT
############# Nation Infomation Security ScanIP #####################
#$IPTABLES -A FORWARD -s xxx.xxx.xxx.xxx -j ACCEPT
#$IPTABLES -A FORWARD -s xxx.xxx.xxx.xxx/29 -j ACCEPT
#####################################################################
#
# PING
#
for server in `cat server-ping`
do
$IPTABLES -A FORWARD -p ICMP -d $server -j icmp_allowed
done
#
# HTTP server
#
for server in `cat server-web`
do
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -d $server
-m multiport --dport $HTTP,$HTTPS -j tcp_allowed
done
#
# FTP server
#
for server in `cat server-ftp`
do
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -d $server
-m multiport --dport $FTP,$FTP_DATA -j tcp_allowed
done
#
# MAIL server
#
for server in `cat server-mail`
do
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -d $server
-m multiport --dport $SMTP,$POP3,$IMAP,$AUTH -j tcp_allowed
done
#
# WAM server
#
for server in `cat server-wam`
do
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -d $server
-m multiport --dport $SSH,$WEBMIN,$WAM -j tcp_allowed
done
#
# PCanywhere server
#
for server in `cat server-pcaw`
do
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -d $server
--dport $PCAW_TCP -j tcp_allowed
$IPTABLES -A FORWARD -p UDP -i $INET_IFACE -d $server
--dport $PCAW_UDP -j ACCEPT
done
#
# DNS server
#
for server in `cat server-dns`
do
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -d $server
--dport $DNS -j tcp_allowed
$IPTABLES -A FORWARD -p UDP -i $INET_IFACE -d $server
--dport $DNS -j ACCEPT
done
########## ADD for SQL Server JSDB database ##############
#for server in `cat server-sql`
#do
#$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -s $REMOTE_SQL_IP \
#-d $server --dport $SQL -j tcp_allowed
#done
#######################################################
#
# ED server
#
for server in `cat server-ed2k`
do
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -d $server
-m multiport --dport $ED_TCP1,$ED_TCP2,$ED_UDP -j tcp_allowed
$IPTABLES -A FORWARD -p UDP -i $INET_IFACE -d $server
-m multiport --dport $ED_TCP1,$ED_TCP2,$ED_UDP -j ACCEPT
done
#
# TFTP
#
#$IPTABLES -A FORWARD -p UDP -i $INET_IFACE -d $DMZ_IP_RANGE \
#--dport $TFTP -j ACCEPT
#
# Log weird packets that don‘t match the above.
#
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j
LOG --log-level DEBUG --log-prefix "IPTABLES FORWARD died:"
#
# 4.1.6 OUTPUT chain
#
#
# Special OUTPUT rules to decide which IP‘s to allow.
#
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
#$IPTABLES -A OUTPUT -p ALL -s $DMZ_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
#
# Log weird packets that don‘t match the above.
#
#$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j \
#LOG --log-level DEBUG --log-prefix "IPTABLES OUTPUT died: "
######
# 4.2 nat table
#
#
# 4.2.1 Set policies
#
#
# 4.2.2 Create user specified chains
#
#
# 4.2.3 Create content in user specified chains
#
#
# 4.2.4 PREROUTING chain
#
#
# Enable IP Destination Network Address Translation
#
for server in `cat server-nat`
do
nat_ip=${server%%:*}
nic_ip=${server##*:}
$IPTABLES -t nat -A PREROUTING -d $nic_ip -j DNAT --to-destination $nat_ip
done
#
# 4.2.5 POSTROUTING chain
#
#
# Enable IP Source Network Address Translation
#
for server in `cat server-nat`
do
nat_ip=${server%%:*}
nic_ip=${server##*:}
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE
-s $nat_ip -j SNAT --to-source $nic_ip
done
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
#
# 4.2.6 OUTPUT chain
#
######
# 4.3 mangle table
#
#
# 4.3.1 Set policies
#
#
# 4.3.2 Create user specified chains
#
#
# 4.3.3 Create content in user specified chains
#
#
# 4.3.4 PREROUTING chain
#
#
# 4.3.5 INPUT chain
#
#
# 4.3.6 FORWARD chain
#
#
# 4.3.7 OUTPUT chain
#
#
# 4.3.8 POSTROUTING chain
