debianforum.de

desktopfirewall

SNIPPET_TEXT:

1. #!/bin/sh
2.  
3. # where is it?
4. IPTABLES=`which iptables`
5.  
6. # if we don't have iptables die
7. test -f $IPTABLES || exit 0
8.  
9. case "$1" in
10.    start)
11.       echo "Starting Firewall..."
12.       # erase all previous rulesets
13.       $IPTABLES -t nat -F
14.       $IPTABLES -t filter -F
15.       $IPTABLES -X
16.  
17.       # create new rulesets
18.       $IPTABLES -N TRASHCAN
19.       $IPTABLES -I TRASHCAN -p TCP -j LOG --log-prefix="IPTABLES - DROP TCP-Packet: " --log-level info
20.       $IPTABLES -I TRASHCAN -p UDP -j LOG --log-prefix="IPTABLES - DROP UDP-Packet: " --log-level info
21.       $IPTABLES -I TRASHCAN -p ICMP -j LOG --log-prefix="IPTABLES - DROP ICMP-Packet: " --log-level info
22.  
23.       # default policy
24.       $IPTABLES -P INPUT DROP
25.       $IPTABLES -P OUTPUT DROP
26.       $IPTABLES -P FORWARD DROP
27.  
28.       # loopback is ok
29.       $IPTABLES -I INPUT -i lo -j ACCEPT
30.       $IPTABLES -I OUTPUT -o lo -j ACCEPT
31.  
32.       #####################################################
33.       # outgoing
34.       $IPTABLES -I OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
35.  
36.       #####################################################
37.       # incoming
38.       # port 22 (SSH)
39.       #$IPTABLES -I INPUT -i eth0 -p TCP --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
40.       #$IPTABLES -I OUTPUT -o eth0 -p TCP --sport 22 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
41.      
42.       # established connections are ok
43.       $IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
44.       $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
45.  
46.       #####################################################
47.       # TRASHCAN ;)
48.       $IPTABLES -A INPUT -m state --state NEW,INVALID -j TRASHCAN
49.  
50.       #####################################################
51.       # if there's anything left not really allowed yet we declare it being evil
52.       $IPTABLES -A INPUT -j TRASHCAN
53.       $IPTABLES -A OUTPUT -j TRASHCAN
54.       $IPTABLES -A FORWARD -j TRASHCAN
55.       ;;
56.    stop)
57.       echo "stopping firewall..."
58.       $IPTABLES -t nat -F
59.       $IPTABLES -t filter -F
60.       $IPTABLES -X
61.       $IPTABLES -P INPUT ACCEPT
62.       $IPTABLES -P OUTPUT ACCEPT
63.       $IPTABLES -P FORWARD ACCEPT
64.       ;;
65.    *)
66.       echo "usage: /etc/init.d/firewall (start|stop)"
67.       exit 1
68.       ;;
69. esac
70. exit 0

Quellcode

Hier kannst du den Code kopieren und ihn in deinen bevorzugten Editor einfügen. PASTEBIN_DOWNLOAD_SNIPPET_EXPLAIN