#!/bin/sh
# Originally by Friends Land and edited by Kaiser
# find iptables binary
ipt=`/usr/bin/whereis iptables | awk '{print $2}'`
# configure kernel
conf_kernel() {
# Smurf protection
# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# drop "source route" packets (change routing tables)
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
# drop ICMP redirect packets that can change routing tables
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
# protection from wrong ICMP error packets
# echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# spoofing protection - network interfaces will only accept packets
# from routing tables
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
# logs weird (spoofed, source routed, redirects) packets
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
# ignores ICMP at all
# disables by default
# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
}
# deconfigure kernel
deconf_kernel() {
# echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "1" > /proc/sys/net/ipv4/conf/all/accept_redirects
# echo "0" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "0" > /proc/sys/net/ipv4/conf/all/log_martians
# echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
}
clean_rules() {
$ipt -F
$ipt -X
$ipt -t nat -F
$ipt -t nat -X
$ipt -P FORWARD ACCEPT
$ipt -P INPUT ACCEPT
$ipt -P OUTPUT ACCEPT
}
start_rules() {
# Default rules
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
# Block NEW connection with flag other than SYN
$ipt -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$ipt -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
# Drop fragmented packets
$ipt -A INPUT -f -j DROP
$ipt -A FORWARD -f -j DROP
# Drop connections in INVALID state
$ipt -A INPUT -m state --state INVALID -j DROP
$ipt -A FORWARD -m state --state INVALID -j DROP
# Allow loopback interface connections
# IMPORTANT !
$ipt -A INPUT -i lo -j ACCEPT
# Allow estabilished connections
$ipt -A INPUT -p tcp -j ACCEPT -m state --state ESTABLISHED,RELATED
$ipt -A INPUT -p udp -j ACCEPT -m state --state ESTABLISHED
# NULL scanning detection
$ipt -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "firewall: SKAN_NULL: "
$ipt -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
# NEW packets without SYN flah are always suspicious
$ipt -N scans
$ipt -A INPUT -p tcp ! --syn -m state --state NEW -j scans
$ipt -A scans -p tcp --tcp-flags ALL RST -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "firewall: SKAN_INVERSE: "
$ipt -A scans -p tcp --tcp-flags ALL RST -j DROP
$ipt -A scans -p tcp --tcp-flags ALL ACK -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "firewall: SKAN_TCP_PING: "
$ipt -A scans -p tcp --tcp-flags ALL ACK -j DROP
$ipt -A scans -p tcp --tcp-flags ALL FIN -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "firewall: SKAN_FIN: "
$ipt -A scans -p tcp --tcp-flags ALL FIN -j DROP
$ipt -A scans -p tcp --tcp-flags ALL FIN,PSH,URG -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "firewall: SKAN_XMAS-NMAP: "
$ipt -A scans -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
$ipt -A scans -p tcp -m limit --limit 10/s --limit-burst 4 -j LOG --log-level debug --log-prefix "firewall: SKAN_INNE: "
$ipt -A scans -j DROP
# packets from unwanted sources
$ipt -A INPUT -s 178.217.184.190 -j DROP # Land attack
$ipt -A INPUT -s 10.0.0.0/8 -j DROP # A class
$ipt -A INPUT -s 172.16.0.0/12 -j DROP # B class
$ipt -A INPUT -s 192.168.0.0/16 -j DROP # C class
$ipt -A INPUT -s 224.0.0.0/4 -j DROP # multicast
$ipt -A INPUT -d 224.0.0.0/4 -j DROP # multicast
$ipt -A INPUT -s 240.0.0.0/5 -j DROP # reserved
# OTS - limit concurrent connections
$ipt -A INPUT -p tcp -m recent --rcheck --seconds 60 -j DROP
$ipt -A INPUT -p tcp --dport 7171 -m connlimit --connlimit-above 10 -m recent --set -j DROP
$ipt -A INPUT -p tcp --dport 7172 -m connlimit --connlimit-above 10 -m recent --set -j DROP
# OTS - Iptable rules for common floods attacks
$ipt -N conn-flood
$ipt -I INPUT 1 -p tcp .syn -j conn-flood
$ipt -A conn-flood -m limit .limit 7/s .limit-burst 20 -j RETURN
$ipt -A conn-flood -j DROP
$ipt -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
$ipt -A INPUT -p icmp -j DROP
$ipt -I INPUT -p tcp -m state --state NEW,ESTABLISHED -m recent --set -j ACCEPT
$ipt -I INPUT -p tcp -m state --state NEW -m recent --update --seconds 3 --hitcount 20 -j DROP
# What we allow
# ICMP
$ipt -A INPUT -p icmp -m limit --limit 15/s -j ACCEPT
# SSH
$ipt -A INPUT -p tcp --dport 22 -j ACCEPT
# FTP
$ipt -A INPUT -p tcp --dport 21 -j ACCEPT
# http
$ipt -A INPUT -p tcp --dport 80 -j ACCEPT
# Tibia ( Otserv )
$ipt -A INPUT -p tcp --dport 7171 -j ACCEPT
$ipt -A INPUT -p tcp --dport 7172 -j ACCEPT
}
case $1 in
start)
echo "Firewall: Loading..."
conf_kernel
clean_rules
start_rules
echo "Firewall: Loaded."
exit 1
;;
stop)
echo "Firewall: Unloading..."
deconf_kernel
clean_rules
echo "Firewall: Unloaded."
;;
*)
echo "Usage: $NAME {start|stop}" >&2
exit 1
;;
esac
exit 0
