git.squeep.com Git - firewall-squeep/blob - firewall.sh

   1 #!/bin/sh
   2
   3 set -e
   4
   5 . ./common.sh
   6
   7 debug=0
   8
   9 if [ ${debug} -ne 0 ]
  10 then
  11         IPTABLES="echo ${IPTABLES}"
  12         IP6TABLES="echo ${IP6TABLES}"
  13         IPSET="echo ${IPSET}"
  14 fi
  15
  16 if [ $# -lt 1 ]
  17 then
  18         echo "Usage: $(basename "$0") external_interface [external_addr]" 1>&2
  19         exit 64
  20 fi
  21
  22 EXT_IF="$1"
  23 if ! ip link show "${EXT_IF}" >/dev/null 2>&1
  24 then
  25         echo "'${EXT_IF}' does not seem to be a valid interface"
  26         exit 1
  27 fi
  28
  29 is_router=0
  30 if [ $# -gt 1 ]
  31 then
  32         is_router=1
  33         EXT_ADDR="$2"
  34 fi
  35
  36 $IPTABLES -F
  37 $IPTABLES -F INPUT
  38 $IPTABLES -X
  39
  40 $IP6TABLES -F
  41 $IP6TABLES -F INPUT
  42 $IP6TABLES -X
  43
  44 # default policies
  45 $IPTABLES -P INPUT DROP
  46 $IPTABLES -P OUTPUT ACCEPT
  47
  48 $IP6TABLES -P INPUT DROP
  49 $IP6TABLES -P OUTPUT ACCEPT
  50
  51 # accept local traffic
  52 $IPTABLES -A INPUT -i lo -j ACCEPT
  53 $IP6TABLES -A INPUT -i lo -j ACCEPT
  54
  55 # accept ICMP
  56 $IPTABLES -A INPUT -p icmp -j ACCEPT
  57 $IP6TABLES -A INPUT -p ipv6-icmp -j ACCEPT
  58
  59 # drop source-route rh0 headery things
  60 $IP6TABLES -A INPUT -m rt --rt-type 0 -j DROP || echo "MISSING RT MATCH" 1>&2
  61
  62 # accept things we set up
  63 $IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  64 $IP6TABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  65
  66 # accept ipv6 link-local traffic
  67 $IP6TABLES -A INPUT -s fe80::/10 -j ACCEPT
  68
  69 # accept ipv6 multicast
  70 $IP6TABLES -A INPUT -s ff00::/8 -j ACCEPT
  71
  72 # log and drop invalid flag combinations
  73 for flags in 'ALL FIN,URG,PSH' 'ALL ALL' 'ALL SYN,RST,ACK,FIN,URG' 'ALL NONE' 'SYN,RST SYN,RST' 'SYN,FIN SYN,FIN'
  74 do
  75         $IPTABLES -A INPUT -p tcp --tcp-flags ${flags} -j DROP
  76 done
  77
  78 # accept ESP for IPSec
  79 $IPTABLES -A INPUT -p esp -j ACCEPT
  80 $IP6TABLES -A INPUT -p esp -j ACCEPT
  81
  82 # accept all IPSec traffic
  83 $IPTABLES -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
  84 $IP6TABLES -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
  85
  86 if [ $is_router -gt 0 ]
  87 then
  88         $IPTABLES -t nat -A POSTROUTING -o ${EXT_IF} -j SNAT --to ${EXT_ADDR}
  89 fi
  90
  91 ./services.sh ${EXT_IF}
  92
  93 create_drop_chain xenophobe
  94
  95 # insert asia blocker
  96 ./sinokorea.sh
  97
  98 # insert persistent-pest-blocker
  99 ./xenophobe.sh
 100
 101 # insert trusted passes
 102 ./trusted.sh
 103