防火墙模板

#!/bin/sh

/sbin/modprobe ip_conntrack_ftp

CONNECTION_TRACKING="1"
ACCEPT_AUTH="0"
DHCP_CLIENT="0"
IPT="/sbin/iptables"
INTERNET="eth1"
LOOPBACK_INTERFACE="lo"
IPADDR="my.ip.address"
SUBNET_BASE="network.address"
SUBNET_BROADCAST="directed.broadcast"
MY_ISP="my.isp.address.range"

NAMESERVER_1="isp.name.server.1"
NAMESERVER_2="isp.name.server.2"
NAMESERVER_3="isp.name.server.3"
POP_SERVER="isp.pop.server"
MAIL_SERVER="isp.mail.server"
NEWS_SERVER="isp.news.server"
TIMES_SERVER="some.time.server"
#DHCP_SERVER="isp.dhcp.server"
SSH_CLIENT="some.ssh.client"

LOOPBACK="127.0.0.0/8"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="224.0.0.0/5"
BROADCAST_SRC="0.0.0.0"
BROADCAST_DEST="255.255.255.255"

PRIVPORTS="0:1023"
UNPRIVPORTS="1024:65535"

TRACEROUTE_SRC_PORTS="32769:65535"
TRACEROUTE_DEST_PORTS="33434:33523"

USER_CHAINS="EXT-input                     EXT-ouput \
             tcp-state-flags               connection-tracking \
             source-address-check          destination-address-check \
             local-dns-server-query        remote-dns-server-response \
             local-tcp-client-request      remote-tcp-client-response \
             remote-tcp-client-request     local-tcp-server-response \
             local-udp-client-request      remote-udp-server-response \
             local-dhcp-client-query       remote-dhcp-server-response \
             EXT-icmp-out                  EXT-icmp-in
             EXT-log-in                    EXT-log-out
             log-tcp-state"

# Enable broadcast ehco Protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
  echo 0 > $f
done

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
  echo 0 >$f
done

for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
  echo 0 >$f
done

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
  echo 1 >$f
done

for f in /proc/sys/net/ipv4/conf/*/log_martians; do
  echo 1 >$f 
done
##################

# remove any existing rules from all chain
$IPT --flush
$IPT -t nat --flush
$IPT -t mangle --flush
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

$IPT --policy INPUT ACCEPT
$IPT --policy OUTPUT ACCEPT
$IPT --policy FORWARD ACCEPT
$IPT -t nat --policy PREROUTING ACCEPT
$IPT -t nat --policy OUTPUT ACCEPT
$IPT -t nat --policy POSTROUTING ACCEPT
$IPT -t mangle --policy PREROUTING ACCEPT
$IPT -t mangle --policy OUTPUT ACCEPT
if [ "$1" = "stop" ]
then
echo "Firewall complete stoped!"
exit 0
fi


$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

$IPT --policy INPUT DROP
$IPT --policy OUTPUT DROP
$IPT --policy FORWARD DROP

for i in $USER_CHAINS; do
  $IPT -N $i
done

$IPT -A EXT-ouput -p udp --sport 53 --dport 53 \
-j local-dns-server-query
$IPT -A EXT-input -p udp --sport 53 --dport 53 \
-j remote-dns-server-response

$IPT -A EXT-ouput -p tcp \
--sport $UNPRIVPORTS --dport 53 \
-j local-dns-server-query
$IPT -A EXT-input -p tcp \
--sport 53 --dport $UNPRIVPORTS \
-j remote-dns-server-response

if [ "$CONNECTION_TRACKING" = "1"]; then
  $IPT -A local-dns-server-query \
  -d $NAMESERVER_1 \
  -m state --state NEW -j ACCEPT
  
  $IPT -A local-dns-server-query \
  -d $NAMESERVER_2 \
  -m state --state NEW -j ACCEPT

  $IPT -A local-dns-server-query \
  -d $NAMESERVER_3 \
  -m state --state NEW -j ACCEPT
fi 

$IPT -A local-dns-server-query \
-d $NAMESERVER_1 -j ACCEPT
$IPT -A local-dns-server-query \
-d $NAMESERVER_2 -j ACCEPT
$IPT -A local-dns-server-query \
-d $NAMESERVER_3 -j ACCEPT


$IPT -A remote-dns-server-response \
-s $NAMESERVER_1 -j ACCEPT
$IPT -A remote-dns-server-response \
-s $NAMESERVER_2 -j ACCEPT
$IPT -A remote-dns-server-response \
-s $NAMESERVER_3 -j ACCEPT

###############
#local TCP client remote server

$IPT -A EXT-ouput -p tcp \
--sport $UNPRIVPORTS \
-j local-tcp-client-request
$IPT -A EXT-input -p ! --syn \
--dport $UNPRIVPORTS \
-j remote-tcp-server-response

#SSH
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d  --dport 22 \
  -m state --state NEW \
  -j ACCEPT
fi  
$IPT -A local-tcp-client-request -p tcp \
-d  --dport 22 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s  --sport 22 \
-j ACCEPT

# client http https auth FTP
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -m multiport --destination-port 80,433,21 \
  --syn -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-m multiport --destination-port 80,433,21 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp \
-m multiport --source-port 80,433,21 ! --syn \
-j ACCEPT

#POP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $POP_SERVER --dport 110 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $POP_SERVER --dport 110 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $POP_SERVER --sport 110 \
-j ACCEPT

#SMTP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $MAIL_SERVER --dport 25 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $MAIL_SERVER --dport 25 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $MAIL_SERVER --sport 25 \
-j ACCEPT
# new client

if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  -d $NEWS_SERVER --dport 119 \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
-d $NEWS_SERVER --dport 119 \
-j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
-s $NEWS_SERVER --sport 119 \
-j ACCEPT

#FTP client
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-tcp-client-request -p tcp \
  --dport $UNPRIVPORTS \
  -m state --state NEW \
  -j ACCEPT
fi 

$IPT -A local-tcp-client-request -p tcp \
--dport $UNPRIVPORTS -j ACCEPT
$IPT -A remote-tcp-server-response -p tcp ! --syn \
--sport $UNPRIVPORTS -j ACCEPT

##################
#local tcp server

$IPT -A EXT-input -p tcp \
--sport $UNPRIVPORTS \
-j remote-tcp-client-request
$IPT -A EXT-ouput -p tcp ! --syn \
--dport $UNPRIVPORTS \
-j local-tcp-server-response

#FTP

$IPT -A EXT-input -p tcp \
--sport 20 --dport $UNPRIVPORTS \
-j ACCEPT

$IPT -A EXT-ouput -p tcp ! --syn \
--sport $UNPRIVPORTS --dport 20 \
-j ACCEPT

#ssh server
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A remote-tcp-client-request -p tcp \
  -s  --dport 22 \
  -m state --state NEW \
  -j ACCEPT
fi  
$IPT -A remote-tcp-client-request -p tcp \
-s  --dport 22 \
-j ACCEPT
$IPT -A local-tcp-server-response -p tcp ! --syn \
-d  --sport 22 \
-j ACCEPT
#local udp client remote server

$IPT -A EXT-ouput -p udp \
--sport $UNPRIVPORTS \
-j local-udp-client-request

$IPT -A EXT-input -p udp \
--dport $UNPRIVPORTS \
-j remote-udp-server-response
# time client
if [ "CONNECTION_TRACKING" = "1" ]; then
  $IPT -A local-udp-client-request -p udp \
  -d $TIMES_SERVER --dport 123 \
  -m state --state NEW \
  -j ACCEPT
fi 
$IPT -A local-udp-client-request -p udp \
-d $TIMES_SERVER --dport 123 \
-j ACCEPT
$IPT -A remote-udp-server-response -p udp \
-s $TIMES_SERVER --sport 123 \
-j ACCEPT
######################
#icmp
 

#################
#TCP state flags 
$IPT -A tcp-state-flags -p tcp --tcp-flags ALL NONE -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags SYN,RST SYN,RST -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags FIN,RST FIN,RST -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,FIN FIN -j log-tcp-state
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,PSH PSH -j log-tcp-state 
$IPT -A tcp-state-flags -p tcp --tcp-flags ACK,URG URG -j log-tcp-state

$IPT -A log-tcp-state -p tcp -j LOG \
--log-prefix "Illegal TCP state: " \
--log-ip-options --log-tcp-options
$IPT -A log-tcp-state -j DROP
#bypass rule check for ESTABLISHED exchanges
if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A connection-tracking -m state \
  --state ESTABLISHED,RELATED \
  -j ACCEPT
  $IPT -A connection-tracking -m state --state INVALID \
  -j LOG --log-prefix "INVALID packet: "
  $IPT -A connection-tracking -m state --state INVALID -j DROP
fi 
#source-address-check
$IPT -A source-address-check -s $IPADDR -j DROP
$IPT -A source-address-check -s $CLASS_A -j DROP
$IPT -A source-address-check -s $CLASS_B -j DROP
$IPT -A source-address-check -s $CLASS_C -j DROP
$IPT -A source-address-check -s $CLASS_D_MULTICAST -j DROP
$IPT -A source-address-check -s $CLASS_E_RESERVED_NET -j DROP
$IPT -A source-address-check -s $LOOPBACK -j DROP
$IPT -A source-address-check -s 0.0.0.0/8 -j DROP
$IPT -A source-address-check -s 169.254.0.0/16 -j DROP
$IPT -A source-address-check -s 192.0.2.0/24 -j DROP
#destination-address-check
$IPT -A destination-address-check -d $BROADCAST_DEST -j DROP
$IPT -A destination-address-check -d $SUBNET_BASE -j DROP
$IPT -A destination-address-check -d $SUBNET_BROADCAST -j DROP
$IPT -A destination-address-check ! -p udp \
-d $CLASS_D_MULTICAST -j DROP
$IPT -A INPUT -p -tcp -j tcp-state-flags
$IPT -A OUTPUT -p -tcp -j tcp-state-flags

if [ "$CONNECTION_TRACKING" = "1" ]; then
  $IPT -A INPUT -j connection-tracking
  $IPT -A OUTPUT -j connection-tracking
fi 

$IPT -A INPUT ! -p tcp -j source-address-check 
$IPT -A INPUT -p tcp --syn -j source-address-check
$IPT -A INPUT -j destination-address-check

$IPT -A OUTPUT -j destination-address-check

$IPT -A INPUT -i $INTERNET -d $IPADDR -j EXT-input

$IPT -A INPUT -i $INTERNET -p udp -d $CLASS_D_MULTICAST -j DROP
$IPT -A OUTPUT -o $INTERNET -p udp -s $IPADDR -d $CLASS_D_MULTICAST \
-j DROP


$IPT -A OUTPUT -o $INTERNET -s $IPADDR -j EXT-ouput

$IPT -A INPUT -j EXT-log-in
$IPT -A OUTPUT -j EXT-log-out
exit 0