git.squeep.com Git - firewall-squeep/blob - firewall.sh

   1 #!/bin/sh
   2
   3 set -e
   4
   5 . ./common.sh
   6
   7 debug=0
   8
   9 if [ ${debug} -ne 0 ]
  10 then
  11         IPTABLES="echo ${IPTABLES}"
  12         IP6TABLES="echo ${IP6TABLES}"
  13         IPSET="echo ${IPSET}"
  14 fi
  15
  16 if [ $# -lt 1 ]
  17 then
  18         echo "Usage: $(basename "$0") external_interface" 1>&2
  19         exit 64
  20 fi
  21
  22 EXT_IF="$1"
  23 if ! ip link show "${EXT_IF}" >/dev/null 2>&1
  24 then
  25         echo "'${EXT_IF}' does not seem to be a valid interface"
  26         exit 1
  27 fi
  28
  29 $IPTABLES -F
  30 $IPTABLES -F INPUT
  31 $IPTABLES -X
  32
  33 $IP6TABLES -F
  34 $IP6TABLES -F INPUT
  35 $IP6TABLES -X
  36
  37 # default policies
  38 $IPTABLES -P INPUT DROP
  39 $IPTABLES -P OUTPUT ACCEPT
  40
  41 $IP6TABLES -P INPUT DROP
  42 $IP6TABLES -P OUTPUT ACCEPT
  43
  44 # accept local traffic
  45 $IPTABLES -A INPUT -i lo -j ACCEPT
  46
  47 $IP6TABLES -A INPUT -i lo -j ACCEPT
  48
  49 # accept ICMP
  50 $IPTABLES -A INPUT -p icmp -j ACCEPT
  51
  52 $IP6TABLES -A INPUT -p ipv6-icmp -j ACCEPT
  53
  54 # drop source-route rh0 headery things
  55 $IP6TABLES -A INPUT -m rt --rt-type 0 -j DROP || echo "MISSING RT MATCH" 1>&2
  56
  57 # accept things we set up
  58 $IPTABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  59
  60 $IP6TABLES -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  61
  62 # accept ipv6 link-local traffic
  63 $IP6TABLES -A INPUT -s fe80::/10 -j ACCEPT
  64
  65 # accept ipv6 multicast
  66 $IP6TABLES -A INPUT -s ff00::/8 -j ACCEPT
  67
  68 # log and drop invalid flag combinations
  69 for flags in 'ALL FIN,URG,PSH' 'ALL ALL' 'ALL SYN,RST,ACK,FIN,URG' 'ALL NONE' 'SYN,RST SYN,RST' 'SYN,FIN SYN,FIN'
  70 do
  71         $IPTABLES -A INPUT -p tcp --tcp-flags ${flags} -j DROP
  72 done
  73
  74 create_set allowed_udp bitmap:port range 0-65535
  75 create_set allowed_tcp bitmap:port range 0-65535
  76
  77 for sfx in '' ".$(hostname -s)"
  78 do
  79         if [ -e "services${sfx}" ]
  80         then
  81
  82                 for l in $(decommentcat "services${sfx}")
  83                 do
  84                         allow_services "${l}"
  85                 done
  86         fi
  87 done
  88
  89 $IPTABLES -A INPUT -i "${EXT_IF}" -p tcp -m set --match-set allowed_tcp dst -j ACCEPT
  90 $IPTABLES -A INPUT -i "${EXT_IF}" -p udp -m set --match-set allowed_udp dst -j ACCEPT
  91 $IP6TABLES -A INPUT -i "${EXT_IF}" -p tcp -m set --match-set allowed_tcp dst -j ACCEPT
  92 $IP6TABLES -A INPUT -i "${EXT_IF}" -p udp -m set --match-set allowed_udp dst -j ACCEPT
  93
  94 # insert persistent-pest-blocker
  95 ./xenophobe.sh
  96
  97 # insert trusted passes
  98 ./trusted.sh
  99