add wark things
[firewall-squeep] / firewall.sh
1 #!/bin/sh
2
3 set -e
4
5 . ./common.sh
6
7 debug=0
8
9 if [ ${debug} -ne 0 ]
10 then
11 IPTABLES="echo ${IPTABLES}"
12 IP6TABLES="echo ${IP6TABLES}"
13 IPSET="echo ${IPSET}"
14 fi
15
16 if [ $# -lt 1 ]
17 then
18 echo "Usage: $(basename "$0") external_interface" 1>&2
19 exit 64
20 fi
21
22 EXT_IF="$1"
23 if ! ip link show "${EXT_IF}" >/dev/null 2>&1
24 then
25 echo "'${EXT_IF}' does not seem to be a valid interface"
26 exit 1
27 fi
28
29 $IPTABLES -F
30 $IPTABLES -F INPUT
31 $IPTABLES -X
32
33 $IP6TABLES -F
34 $IP6TABLES -F INPUT
35 $IP6TABLES -X
36
37 # default policies
38 $IPTABLES -P INPUT DROP
39 $IPTABLES -P OUTPUT ACCEPT
40
41 $IP6TABLES -P INPUT DROP
42 $IP6TABLES -P OUTPUT ACCEPT
43
44 # accept local traffic
45 $IPTABLES -A INPUT -i lo -j ACCEPT
46
47 $IP6TABLES -A INPUT -i lo -j ACCEPT
48
49 # accept ICMP
50 $IPTABLES -A INPUT -p icmp -j ACCEPT
51
52 $IP6TABLES -A INPUT -p ipv6-icmp -j ACCEPT
53
54 # drop source-route rh0 headery things
55 $IP6TABLES -A INPUT -m rt --rt-type 0 -j DROP || echo "MISSING RT MATCH" 1>&2
56
57 # accept things we set up
58 $IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
59
60 $IP6TABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
61
62 # accept ipv6 link-local traffic
63 $IP6TABLES -A INPUT -s fe80::/10 -j ACCEPT
64
65 # accept ipv6 multicast
66 $IP6TABLES -A INPUT -s ff00::/8 -j ACCEPT
67
68 # log and drop invalid flag combinations
69 for flags in 'ALL FIN,URG,PSH' 'ALL ALL' 'ALL SYN,RST,ACK,FIN,URG' 'ALL NONE' 'SYN,RST SYN,RST' 'SYN,FIN SYN,FIN'
70 do
71 $IPTABLES -A INPUT -p tcp --tcp-flags ${flags} -j DROP
72 done
73
74 create_set allowed_udp bitmap:port range 0-65535
75 create_set allowed_tcp bitmap:port range 0-65535
76
77 for sfx in '' ".$(hostname -s)"
78 do
79 if [ -e "services${sfx}" ]
80 then
81
82 for l in $(decommentcat "services${sfx}")
83 do
84 allow_services "${l}"
85 done
86 fi
87 done
88
89 $IPTABLES -A INPUT -i "${EXT_IF}" -p tcp -m set --match-set allowed_tcp dst -j ACCEPT
90 $IPTABLES -A INPUT -i "${EXT_IF}" -p udp -m set --match-set allowed_udp dst -j ACCEPT
91 $IP6TABLES -A INPUT -i "${EXT_IF}" -p tcp -m set --match-set allowed_tcp dst -j ACCEPT
92 $IP6TABLES -A INPUT -i "${EXT_IF}" -p udp -m set --match-set allowed_udp dst -j ACCEPT
93
94 create_drop_chain xenophobe
95
96 # insert asia blocker
97 ./sinokorea.sh
98
99 # insert persistent-pest-blocker
100 ./xenophobe.sh
101
102 # insert trusted passes
103 ./trusted.sh
104