debianforum.de

Firewall-Skript

SNIPPET_TEXT:

1. #!/bin/sh
2. # ***************************
3. # ***************************
4. # * *
5. # * 1. SETZEN VON VARIABLEN *
6. # * *
7. # ***************************
8. # ***************************
9.  
10. # 1.1. Netzwerkvariablen
11.  
12. # Schnittstelle zum lokalen Netzwerk
13. IFACE_INT=eth1
14.  
15. # Internetschnittstelle
16. IFACE_EXT=eth0
17.  
18. # Loopback device
19. IFACE_LO=lo
20.  
21. # Interner Netzwerkbereich
22. NET_INT=192.168.0.0/24
23.  
24.  
25.  
26.  
27.  
28. function StopFirewall() {
29. # **********************************
30. # **********************************
31. # * *
32. # * 2. HERUNTERFAHREN DER FIREWALL *
33. # * *
34. # **********************************
35. # **********************************
36.  
37. # Ausschalten des Routing
38. echo "0" > /proc/sys/net/ipv4/ip_forward
39.  
40. # Default-Policies: Alles rein und raus, kein Forwarding mehr
41. iptables -P INPUT ACCEPT
42. iptables -P FORWARD DROP
43. iptables -P OUTPUT ACCEPT
44.  
45. # Löschen aller Regeln
46. iptables -F
47. iptables -t nat -F
48.  
49. # Löschen aller zusätzlichen Ketten
50. iptables -X
51. iptables -t nat -X
52.  
53. }
54.  
55.  
56. function StartFirewall() {
57. # ***************************
58. # ***************************
59. # * *
60. # * 3. Starten der Firewall *
61. # * *
62. # ***************************
63. # ***************************
64.  
65. # 3.1 Allgemeines
66.  
67. # Default-Policies setzen - alles fliegt raus
68. iptables -P INPUT DROP
69. iptables -P FORWARD DROP
70. iptables -P OUTPUT DROP
71.  
72. # Einschalten von ip-Forwarding
73. echo "1" > /proc/sys/net/ipv4/ip_forward
74.  
75. # Wegen moeglicher Netzwerkprobleme zwecks MTU
76. iptables -I FORWARD -p TCP --tcp-flags SYN,RST SYN \
77. -j TCPMSS --clamp-mss-to-pmtu
78.  
79. # 3.1.1. Eigene Kette zum gleichzeitigen Protokollieren und Rausschmeissen
80.  
81. # Eigene Kette erstellen
82. iptables -N RAUS
83.  
84. # Protokollieren
85. iptables -A RAUS -j LOG -m limit --limit 5/minute \
86. --log-prefix "Böses Paket: "
87.  
88. # Raussschmeissen
89. iptables -A RAUS -j DROP
90.  
91.  
92. # 3.2. Regeln fuer eingehende Pakete
93.  
94. # 3.2.1. Vom internen Netzwerk
95.  
96. # Alles erlauben
97. iptables -A INPUT -i $IFACE_INT -s $NET_INT -j ACCEPT
98.  
99. # 3.2.2. Vom Loopback
100.  
101. # Alles erlauben
102. iptables -A INPUT -i $IFACE_LO -j ACCEPT
103.  
104. # 3.2.3. Vom Internet
105.  
106. # packets, which doesn't initiate a connection but state marked as new
107. # should be dropped
108. iptables -A INPUT -p TCP ! --syn -m state --state NEW -j RAUS
109.  
110. #Ping-Antworten empfangen
111. iptables -A INPUT -p ICMP -m icmp --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT
112.  
113. # Verbindung von Zeitserver ptbtime1.ptb.de zulassen
114. iptables -A INPUT -i $IFACE_EXT -p UDP -s 192.53.103.108 --sport 123 -j ACCEPT
115.  
116. # send requests for port 445 (samba) to a tarpit and log it
117. iptables -N TAR-PIT
118. iptables -A TAR-PIT -j LOG -m limit --limit 30/hour --log-prefix "(-: TARPIT :-)"
119. iptables -A TAR-PIT -i $IFACE_EXT -p tcp -j TARPIT
120. iptables -A INPUT -i $IFACE_EXT -p tcp --dport 445 -j TAR-PIT
121.  
122. # Private Addressräume von Extern. Kann nicht sein, daher manipulierte Pakete, daher raus
123. #iptables -A INPUT -i $IFACE_EXT -s 10.0.0.0/8 -j RAUS
124. #iptables -A INPUT -i $IFACE_EXT -s 172.16.0.0/12 -j RAUS
125. #iptables -A INPUT -i $IFACE_EXT -s 192.168.0.0/24 -j RAUS
126.  
127. # allow all packets with status "established" or "related" to pass the dev
128. # allow packets to pass the dev at udp-ports 68,80 explicitly
129. iptables -A INPUT -i $IFACE_EXT -p udp -m multiport --dports 53,68 -j ACCEPT
130. iptables -A INPUT -i $IFACE_EXT -p tcp --dport 80 -j ACCEPT
131. iptables -A INPUT -i $IFACE_EXT -m state --state ESTABLISHED,RELATED -j ACCEPT
132.  
133. # 3.3. Regeln fuers Forwarding
134.  
135. # 3.3.1. Lokal -> Internet
136. # Erlauben von FTP, Telnet, SMTP, HTML, POP3, SHTML, Secure POP3, ICQ Verbindungen, git, ICQ-rcv-ports, torrent-ports, debtorrent
137. iptables -A FORWARD -i $IFACE_INT -o $IFACE_EXT -p TCP -m multiport \
138. --dports 21,23,25,80,110,443,995,5190,9418,6000:6010,6011:6020,6969 -j ACCEPT
139.  
140. #SIP
141. iptables -A FORWARD -i $IFACE_INT -o $IFACE_EXT -p UDP --sport 5060 -j ACCEPT
142.  
143. #Ping-Pakete versenden
144. iptables -A FORWARD -i $IFACE_INT -o $IFACE_EXT -p ICMP -m icmp --icmp-type echo-request -j ACCEPT
145.  
146.  
147. # 3.3.2. Internet -> Lokales
148.  
149. # Erlauben von eingehenden Paketen
150. iptables -A FORWARD -i $IFACE_EXT -o $IFACE_INT -m state --state ESTABLISHED,RELATED -j ACCEPT
151.  
152. # Ping-Pakete empfangen
153. iptables -A FORWARD -i $IFACE_EXT -o $IFACE_INT -p ICMP -m icmp --icmp-type echo-reply -m state --state ESTABLISHED,RELATED -j ACCEPT
154.  
155.  
156.  
157.  
158.  
159.  
160.  
161. # 3.4. Regeln für ausgehende Pakete
162.  
163. # 3.4.1. Ins lokale Netzwerk
164.  
165. # Alles erlauben
166. iptables -A OUTPUT -o $IFACE_INT -j ACCEPT
167.  
168.  
169. # 3.4.2. Ans Loopback
170.  
171. # Alles erlauben
172. iptables -A OUTPUT -o $IFACE_LO -j ACCEPT
173.  
174.  
175. # 3.4.3. Ins Internet
176.  
177. # Ping-Pakete senden
178. iptables -A OUTPUT -o $IFACE_EXT -p ICMP -m icmp --icmp-type echo-request -j ACCEPT
179.  
180. # Verkehr zu dem Zeitserver ptbtime1.ptb.de erlauben
181. iptables -A OUTPUT -o $IFACE_EXT -p UDP -d 192.53.103.108 --sport 123 -j ACCEPT
182.  
183. # open ports from router to output
184. iptables -A OUTPUT -p udp -m multiport --dports 53,67 -j ACCEPT
185.  
186. # lighttpd:
187. iptables -A OUTPUT -o $IFACE_EXT -p tcp --sport 80 -j ACCEPT
188. iptables -A OUTPUT -o $IFACE_EXT -p tcp --dport 80 -j ACCEPT
189.  
190. # Masquerading
191.  
192. iptables -A POSTROUTING -s $NET_INT -o $IFACE_EXT -t nat -j MASQUERADE
193.  
194. # 3.5 Mitprotokollieren
195.  
196. iptables -A OUTPUT -j LOG --log-prefix "Nicht raus: "
197.  
198. iptables -A FORWARD -j LOG --log-prefix "Nicht durch: "
199.  
200. iptables -A INPUT -p all ! --dport 445 -j LOG --log-prefix "Nicht rein: "
201.  
202. }
203.  
204. function InternSsh() {
205. # ***************************
206. # ***************************
207. # * *
208. # * SSH-LAN Mode            *
209. # * *
210. # ***************************
211. # ***************************
212.  
213. /etc/init.d/ssh stop
214. cp /etc/ssh/sshd_config_int /etc/ssh/sshd_config
215. iptables -D INPUT -i $IFACE_EXT -p tcp --dport <ssh-port> -j ACCEPT
216. iptables -D OUTPUT -o $IFACE_EXT -p tcp --sport <ssh-port> -j ACCEPT
217. /etc/init.d/ssh start
218. }
219.  
220. function ExternSsh() {
221. # ***************************
222. # ***************************
223. # * *
224. # * SSH-WAN Mode            *
225. # * *
226. # ***************************
227. # ***************************
228.  
229. /etc/init.d/ssh stop
230. cp /etc/ssh/sshd_config_ext /etc/ssh/sshd_config
231. iptables -A INPUT -i $IFACE_EXT -p tcp --dport <ssh-port> -j ACCEPT
232. iptables -A OUTPUT -o $IFACE_EXT -p tcp --sport <ssh-port> -j ACCEPT
233. /etc/init.d/ssh start
234. }
235.  
236. # **********************
237. # **********************
238. # * *
239. # * START-STOP-SKRIPT *
240. # * *
241. # **********************
242. # **********************
243.  
244. case "$1" in
245. start)
246. echo -n "Starting firewall: iptables"
247. StartFirewall
248. ;;
249.  
250. stop)
251. echo "Stopping firewall: iptables"
252. StopFirewall
253. echo "."
254. ;;
255.  
256. force-reload|restart)
257. $0 stop
258. $0 start
259. ;;
260.  
261. ssh-intern)
262. echo "Modifying rules for SSH in LAN-Mode"
263. InternSsh
264. echo "."
265. ;;
266.  
267. ssh-extern)
268. echo "Modifying rules for SSH in WAN-Mode"
269. ExternSsh
270. echo "."
271. ;;
272.  
273. *)
274. echo "Usage: /var/scripts/firewall {start|stop|restart" \
275. "|force-reload ssh-intern ssh-extern}"
276. exit 1
277. ;;
278. esac

Quellcode

Hier kannst du den Code kopieren und ihn in deinen bevorzugten Editor einfügen. PASTEBIN_DOWNLOAD_SNIPPET_EXPLAIN