|
#!/bin/sh
IPT='/usr/local/sbin/iptables'
$IPT -F
$IPT -X
$IPT -P FORWARD DROP
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -N logd
$IPT -N inet
$IPT -N loga
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -m state --state INVALID -j DROP
$IPT -A FORWARD -i eth1 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 9237 -j ACCEPT
$IPT -A FORWARD -p udp -m multiport --dports 8888,9237 -j ACCEPT
$IPT -A FORWARD -j ULOG --ulog-qthreshold 1 --ulog-prefix F
#state
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -m state --state INVALID -j DROP
#protocol, interface, source
$IPT -A INPUT -p ipv6 -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -i eth1 -j ACCEPT
$IPT -A INPUT -p tcp ! --syn -j DROP
$IPT -A INPUT -i eth0 -j inet
#portscan-block
#take a look at /proc/net/ipt_recent/ to see who has been blocked
$IPT -A INPUT -m recent --update --name BANME --rsource --seconds 3600 -j DROP
#tcp ports: 22 is opened for 5 minutes if you connect to 12345; 139&445 silently dropped; others logged and accept/dropped
$IPT -A INPUT -p tcp -m tcp --dport 22 -m recent --rcheck --name SSHGO --rsource --seconds 300 -j loga
$IPT -A INPUT -p tcp -m tcp --dport 12345 -m recent --set --name SSHGO --rsource -j logd
$IPT -A INPUT -p tcp -m multiport --dports 139,445 -j DROP
$IPT -A INPUT -p tcp -m multiport --dports 21,25,53,80 -j loga
$IPT -A INPUT -p tcp -m multiport --dports 22,110,135,443,463,6000 -j logd
$IPT -A INPUT -p udp -m multiport --dports 137,138,1026,1027,1028,1029,1434 -j DROP
$IPT -A INPUT -p udp --dport 53 -j loga
$IPT -A INPUT -p icmp -j DROP --icmp-type 8
#ping, in case you were wondering
$IPT -A INPUT -j ULOG --ulog-prefix B
$IPT -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
#IRC servers like to check ident; well, I don't run it!
$IPT -A INPUT -m recent --set --name BANME --rsource -j DROP
#and add them to the portscan-block list!
$IPT -A loga -j ULOG --ulog-prefix A
$IPT -A loga -j ACCEPT
$IPT -A logd -j ULOG --ulog-prefix D
$IPT -A logd -j DROP
$IPT -A inet -d 0.0.0.255/0.0.0.255 -j DROP
$IPT -A inet -d 0.0.0.0/0.0.0.255 -j DROP
$IPT -A inet -s 10.0.0.0/8 -j DROP
$IPT -A inet -s 127.0.0.0/8 -j DROP
$IPT -A inet -s 169.254.0.0/16 -j DROP
$IPT -A inet -s 172.16.0.0/12 -j DROP
$IPT -A inet -s 192.168.0.0/16 -j DROP
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -A PREROUTING -i eth0 -j DNAT --to-destination 10.0.0.2 -p tcp --dport 9237
$IPT -t nat -A PREROUTING -i eth0 -j DNAT --to-destination 10.0.0.2 -p udp -m multiport --dports 8888,9237
$IPT -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 1.2.3.4
|
