#!/bin/sh

# Filename: /etc/init.d/rc.firewall
# Beskrivelse: Simpel iptables firewall script til ungamed.
# Version 1.0.0
# Senest redigeret: 20100620 21:00UTC

# ---------------------------------------------------
# Placering af iptables, modprobe og sysctl
# ---------------------------------------------------

IPT="/sbin/iptables"
MOP="/sbin/modprobe"
SCTL="/sbin/sysctl -w"

# ---------------------------------------------------
# Interfaces
# ---------------------------------------------------

INET_IFACE="eth0"
#INET_ADDRESS="99.99.99.99"

LO_IFACE="lo"
LO_IP="127.0.0.1"

# ---------------------------------------------------
# Load moduler
# ---------------------------------------------------
# OBS: Du behøver IKKE disse linier hvis du har compilet modulerne til kernel

$MOP ip_tables
$MOP ip_conntrack
$MOP iptable_filter
$MOP iptable_mangle
$MOP iptable_nat
$MOP ipt_state
$MOP ipt_LOG

# Du bør som udgangspunkt ikke behøve disse moduler

# $MOP ipt_MASQUERADE
# $MOP ipt_owner
# $MOP ipt_limit
# $MOP ipt_REJECT
# $MOP multiport
# $MOP ip_conntrack_ftp
# $MOP ip_nat_ftp

# ---------------------------------------------------
# Sæt firewall indstillinger i /proc med sysctl (kernelparms)
# ---------------------------------------------------
# Brug kun ip_dynaddr="1" på maskine der kører med en dynamisk DHCP addresse
# ip_forward="1" kun hvis du har flere netkort aktive/kører en vpnserver el. lign.
# bemærk at slår du forwarding til så SKAL den være først og kun med forward giver rp_filter mening.

# $SCTL net.ipv4.ip_forward="1"
# $SCTL net.ipv4.conf.all.rp_filter="1"
# $SCTL net.ipv4.ip_dynaddr="1"

$SCTL net.ipv4.tcp_syncookies="1"
$SCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
$SCTL net.ipv4.conf.all.accept_source_route="0"


# ---------------------------------------------------
# Ryd alle Chains - (Stop firewallen)
# ---------------------------------------------------
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT

# Flush alt
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F

# Slet andre kæder
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

if [ "$1" = "stop" ]
then
	echo "Firewall inaktiv - Alle policies = accept"
	exit 0
fi

# ---------------------------------------------------
# Opret selve firewallen (chains m.m.)
# ---------------------------------------------------
#
# Sæt standard policies
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

# Opret user chains
# Bad chains = hurtig drop
$IPT -N bad_packets
$IPT -N bad_tcp_packets

# Inbound chains
$IPT -N udp_inbound
$IPT -N tcp_inbound

# Outbound chains
$IPT -N udp_outbound
$IPT -N tcp_outbound

# Andre chains
$IPT -N icmp_packets

# Regler for chains vi lige har oprettet
# Vi starter med at droppe invalide pakker (linierne herunder er en meget anvendt copy/paste version)
# OBS: Jeg har remmet alle log entrys for hastighed - aktiver hvis du vil

# ---------------------------------------------------
# Bad packets
# ---------------------------------------------------

# $IPT -A bad_packets -p ALL -m state --state INVALID -j LOG --log-prefix "Invalid packet: "
$IPT -A bad_packets -p ALL -m state --state INVALID -j DROP

# Then check the tcp packets for additional problems
$IPT -A bad_packets -p tcp -j bad_tcp_packets

# All good, so return
$IPT -A bad_packets -p ALL -j RETURN

# bad_tcp_packets chain
#
# All tcp packets will traverse this chain.
# Every new connection attempt should begin with
# a syn packet.  If it doesn't, it is likely a
# port scan.  This drops packets in state
# NEW that are not flagged as syn packets.

# $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn: "
$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

# $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "Stealth scan: "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP

# $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j LOG --log-prefix "Stealth scan: "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP

# $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG --log-prefix "Stealth scan: "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

# $IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-prefix "Stealth scan: "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

# $IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Stealth scan: "
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# $IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "Stealth scan: "
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# All good, so return
$IPT -A bad_tcp_packets -p tcp -j RETURN

# ---------------------------------------------------
# ICMP
# ---------------------------------------------------

# Fragmenterede ICMP pakker = DoS - vi dropper på stedet

# $IPT -A icmp_packets --fragment -p ICMP -j LOG --log-prefix "ICMP Fragment: "
$IPT -A icmp_packets --fragment -p ICMP -j DROP

# ICMP type 8 = ping - fjern comment for at tillade
# $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j LOG --log-prefix "Ping detected: "
# $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT

# Time Exceeded = 11 - Betragtes som ufarlig så vi tillader
$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

$IPT -A icmp_packets -p ICMP -j RETURN


# ---------------------------------------------------
# UDP INBOUND
# ---------------------------------------------------

# Drop støj (netbios) fra windows maskiner
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP

# Tillad UDP til CSS servere
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 27015 -j ACCEPT
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 27035 -j ACCEPT
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 27055 -j ACCEPT

$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 27020 -j ACCEPT

$IPT -A udp_inbound -p UDP -j RETURN

# ---------------------------------------------------
# TCP INBOUND
# ---------------------------------------------------

# Webserver (http og https)
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 443 -j ACCEPT

# FTP Server 
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 21 -j ACCEPT

# FTP Client (aktive transfers)
$IPT -A tcp_inbound -p TCP -s 0/0 --source-port 20 -j ACCEPT

# SSH
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT

# TCP til CSS - RCON
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 27015 -j ACCEPT
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 27035 -j ACCEPT
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 27055 -j ACCEPT

# Webmin
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 10000 -j ACCEPT

$IPT -A tcp_inbound -p TCP -j RETURN


# ---------------------------------------------------
# UDP OUTBOUND
# ---------------------------------------------------

# Vi tillader al udgående UDP

$IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT


# ---------------------------------------------------
# TCP OUTBOUND
# ---------------------------------------------------

# Vi tillader al udgående TCP
$IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT


# ---------------------------------------------------
# Overordnet INPUT chain
# ---------------------------------------------------

# tillad alt til localhost
$IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT

# Drop skodpakker
$IPT -A INPUT -p ALL -j bad_packets

# Drop IGMP bcasts
$IPT -A INPUT -p ALL -d 224.0.0.1 -j DROP

# Accepter forbindelser vi allerede har accepted
$IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT

# Send andre inputs til vore userchains
$IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
$IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
$IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

# Drop bcasts der har overlevet hertil
$IPT -A INPUT -m pkttype --pkt-type broadcast -j DROP

# Log evt. (uncomment) pakker der havner her. (døde pakker og fejl)
# $IPT -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "FW:INPUT dead packet: "


# ---------------------------------------------------
# Overordnet OUTPUT chain
# ---------------------------------------------------

# Det eneste vi ikke tillader er inval icmp
$IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP

$IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT
$IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT

# Hvis en OUTPUT havner her så er der noget helt galt!
$IPT -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-prefix "FW:OUTPUT dead packet: "


# ---------------------------------------------------
# Overordnet FORWARD chain, NAT og MANGLE
# ---------------------------------------------------

# Bruger vi ikke i dette setup


echo "Firewall aktiv..."

MYS_ACC1="99.99.99.99"
...
...
$IPT -A tcp_inbound -p TCP -s $MYS_ACC1 --destination-port 3306 -j ACCEPT

iptables -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT

$IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT