path: root/firewall

#!/bin/bash

### BEGIN INIT INFO
# Provides:          firewall
# Required-Start:    $remote_fs $syslog $network
# Required-Stop:     $remote_fs $syslog $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Iptables firewall
# Description:       An iptables firewall
### END INIT INFO

NAME="firewall"

abort()
{
    message=$@
    echo >&2
    echo -e "$message" >&2
    echo >&2
    exit 1
}

if [ -f "/etc/firewall/firewall.conf" ]; then
    source /etc/firewall/firewall.conf
else
    abort "No configuration file /etc/firewall/firewall.conf"
fi

clean()
{
    $IPTABLES -F
    $IPTABLES -F INPUT
    $IPTABLES -F OUTPUT
    $IPTABLES -F FORWARD
    $IPTABLES -F -t mangle
    $IPTABLES -F -t nat
    $IPTABLES -X
}

test_config()
{
    if [ ! "$WAN_INT" -o ! "$IP" ]; then
        echo "Bad configuration please check your /etc/firewall/firewall.conf"
        exit 1
    fi
}

critical_return()
{
    if [ `echo $?` != 0 ]; then
        echo "!!! CRITICAL error on the last command firewall will be stop"
        stop
        exit 1
    fi
}

forward_port()
{
    if [ $# != 4 ]; then
        echo "! Bad syntax for port forward : $*"
        return
    fi

    source=$1
    port=$2
    destination=$3
    proto=$4

    if echo "$destination" | grep -q ":"; then
        dest_ip=$(echo $destination | cut -d ":" -f1)
        dest_port=$(echo $destination | cut -d ":" -f2)
        if [ ! "$LAN_INT" ]; then
            echo "!! WARNING you must add a LAN interface (LAN_INT) for a port forward"
        else
            echo "+ Forward $port to $destination for protocol $proto"
            $IPTABLES -A FORWARD -i $WAN_INT -o $LAN_INT -p $proto -s $source -d $dest_ip --dport $dest_port -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
            $IPTABLES -t nat -A PREROUTING -i $WAN_INT -p $proto -s $source -d $IP --dport $port -j DNAT --to $destination
        fi
    fi

}

open_port()
{
    if [ $# == 4 ]; then
        destination=$2
        proto=$3
        ports=$4
    elif [ $# == 3 ]; then
        destination=$IP
        proto=$2
        ports=$3
    else
        echo "!!! CRITICAL Open port bad syntax : $*"
        stop && exit 1
    fi
    source=$1
    for port in $(echo $ports | sed 's/,/ /g'); do
        echo "+ Open port $port from $source to $destination for protocol $proto"
        $IPTABLES -A INPUT -i $WAN_INT -p $proto -s $source -d $destination --dport $port -m state --state NEW -j ACCEPT
        critical_return
    done
}

port_redirection()
{
    if [ $# != 4 ]; then
        echo "! Bad syntax for port redirection : $*"
        return
    fi

    if=$1
    proto=$2
    srcport=$3
    destport=$4

    echo "+ Redirect $if port $srcport to $destport for portocol $proto"
    iptables -t nat -A PREROUTING -i $if -p $proto --dport $srcport -j REDIRECT --to-port $destport
}

port_knocking()
{
    if [ $# != 2 ]; then
        echo "! Bad syntax for port knocking : $*"
        return
    fi

    port=$1
    knock_ports=$2
    i=0

    for kport in $(echo $knock_ports | sed 's/,/ /g'); do
        ((i++))
        if [ $i -gt 1 ]; then
            iptables -N toc$i
            iptables -A toc$i -m recent --name toc$(($i-1)) --remove
            iptables -A toc$i -m recent --name toc$i --set
            iptables -A INPUT -i $WAN_INT -p tcp --dport $kport -m recent --rcheck --name toc$(($i-1)) -j toc$i
        else
            iptables -A INPUT -i $WAN_INT -p tcp --dport $kport -m recent --set --name toc$i
        fi
    done
    iptables -A INPUT -i $WAN_INT -p tcp --dport $port -m recent --rcheck --seconds 15 --name toc$i -m state --state NEW -j ACCEPT
}

start()
{
    echo "Starting: Firewall"
    modprobe ip_conntrack
    clean

    test_config

    # default policies
    $IPTABLES -P INPUT DROP
    $IPTABLES -P FORWARD DROP
    $IPTABLES -P OUTPUT DROP

    ## allow packets coming from the machine
    $IPTABLES -A INPUT -i lo -j ACCEPT
    $IPTABLES -A OUTPUT -o lo -j ACCEPT

    echo "+ Allow WAN outgoing traffic"
    $IPTABLES -A OUTPUT -o $WAN_INT -p all -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
    $IPTABLES -A INPUT -i $WAN_INT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT

    critical_return

    if [ $LAN == 1 ]; then
        echo "+ Allow WAN outgoing traffic from lan"
        $IPTABLES -A FORWARD -i $LAN_INT -o $WAN_INT -p all -m state ESTABLISHED,RELATED,NEW -j ACCEPT
        $IPTABLES -A FORWARD -i $WAN_INT -o $LAN_INT -p all -m state --state RELATED,ESTABLISHED -j ACCEPT

        echo "+ Allow local network"
        $IPTABLES -A OUTPUT -o $LAN_INT -p all -j ACCEPT
        $IPTABLES -A INPUT  -i $LAN_INT -p all -j ACCEPT
        for ALLOW_INT in $ALLOW_INTS; do
                echo "+ Allow WAN outgoing traffic for interface $ALLOW_INT"
                $IPTABLES -A FORWARD -i $ALLOW_INT -o $WAN_INT -p all -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
                $IPTABLES -A FORWARD -i $WAN_INT -o $ALLOW_INT -p all -m state --state RELATED,ESTABLISHED -j ACCEPT

                echo "+ Allow local network"
                $IPTABLES -A OUTPUT -o $ALLOW_INT -p all -j ACCEPT
                $IPTABLES -A INPUT  -i $ALLOW_INT -p all -j ACCEPT
        done
   fi

    ## block spoofing
    echo "+ Block spoofing"
    echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

    ## NMAP FIN/URG/PSH
    echo "+ Block scan ports"
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG --log-prefix 'iptables: Port scan: ' --log-level 4
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

    ## stop Xmas Tree type scanning
    echo "+ Block Xmas Tree"
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL ALL -j LOG --log-prefix "iptables: Xmas tree: " --log-level 4
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL ALL -j DROP
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-prefix "iptables: Xmas tree: " --log-level 4
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

    ## stop null scanning
    echo "+ Block null scanning"
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "iptables: Null scanning: " --log-level 4
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags ALL NONE -j DROP
    ## SYN/RST
    echo "+ Block SYN/RST"
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "iptables: SYN/RST: " --log-level 4
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
    ## SYN/FIN
    echo "+ Block SYN/FIN"
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG --log-prefix "iptables: SYN/FIN: " --log-level 4
    $IPTABLES -A INPUT -i $WAN_INT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

    ## stop sync flood
    echo "+ Block Syn flood"
    echo "1" >/proc/sys/net/ipv4/tcp_syncookies
    echo "1024" > /proc/sys/net/ipv4/tcp_max_syn_backlog

    if [ $PING == 1 ]; then
        echo "+ PING allowed"
        iptables -A INPUT -p icmp --icmp-type ping -j ACCEPT
        iptables -A OUTPUT -p icmp --icmp-type ping -j ACCEPT
        iptables -A FORWARD -p icmp --icmp-type ping -j ACCEPT
    fi

    if [ $FTP == 1 ]; then
        echo "+ FTP allowed"
        modprobe ip_conntrack_ftp
        $IPTABLES -A INPUT -i $WAN_INT -d $IP -p tcp --dport ftp -m state --state NEW,ESTABLISHED -j ACCEPT
        $IPTABLES -A OUTPUT -o $WAN_INT -s $IP -p tcp --sport ftp -m state --state ESTABLISHED -j ACCEPT
        # Data
        $IPTABLES -A INPUT  -i $WAN_INT -d $IP -p tcp --dport ftp-data -m state --state ESTABLISHED -j ACCEPT
        $IPTABLES -A OUTPUT -o $WAN_INT -s $IP -p tcp --sport ftp-data -m state --state ESTABLISHED,RELATED -j ACCEPT
        # Passive mod
        $IPTABLES -A INPUT -i $WAN_INT -d $IP -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED -j ACCEPT
        $IPTABLES -A OUTPUT -o $WAN_INT -s $IP -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT
    fi

    ## Open Ports
    for args in "${OPEN_PORTS[@]}"; do
        open_port $args
    done

    ## Port knocking
    for args in "${PORT_KNOCK[@]}"; do
        port_knocking $args
    done

    ## Port forwading
    for args in "${TRAFFICS[@]}"; do
        forward_port $args
    done

    ## Port redirection
    for args in "${REDIRECTIONS[@]}"; do
        port_redirection $args
    done

    ## Whitelist
    for arg in "${WHITELIST_SSH[@]}"; do
        open_port $arg tcp ssh
    done

    ## NAT
    if [ $NAT == 1 ]; then
        echo "+ Activate nat"
        for proto in ftp irc sip h323; do modprobe nf_nat_$proto; done
        $IPTABLES -t nat -A POSTROUTING -o $WAN_INT -s $LAN_NETWORK -j SNAT --to-source $IP
    fi

    ipt_hook

    ## LOG
    ## Create a LOGDROP chain to log and drop packets
    $IPTABLES -N LOGDROP
    $IPTABLES -A LOGDROP -j LOG --log-prefix "iptables: " --log-level 4
    $IPTABLES -A LOGDROP -j DROP

    $IPTABLES -A INPUT -j LOGDROP
    $IPTABLES -A OUTPUT -j LOGDROP
    $IPTABLES -A FORWARD -j LOGDROP
}


stop()
{
    echo "+ Firewall stoped"
    $IPTABLES -t filter -F
    $IPTABLES -t filter -X

    $IPTABLES -t filter -P INPUT   ACCEPT
    $IPTABLES -t filter -P FORWARD ACCEPT
    $IPTABLES -t filter -P OUTPUT  ACCEPT

    $IPTABLES -t nat -F
    $IPTABLES -t nat -X

    $IPTABLES -t nat -P PREROUTING  ACCEPT
    $IPTABLES -t nat -P OUTPUT      ACCEPT
    $IPTABLES -t nat -P POSTROUTING ACCEPT

    $IPTABLES -t mangle -F
    $IPTABLES -t mangle -X

    $IPTABLES -t mangle -P PREROUTING  ACCEPT
    $IPTABLES -t mangle -P INPUT       ACCEPT
    $IPTABLES -t mangle -P FORWARD     ACCEPT
}

case "$1" in
        start|restore)
            if [ -f /etc/network/iptables-save ]; then
                iptables-restore < /etc/network/iptables-save
                echo "Firewall: rules loaded"
            else
                abort "!! No iptables rules saved please use test and save script options"
            fi
        ;;
        stop)
            stop || exit 1
        ;;
        test)
            echo "You have 30 seconds to test your new rules"
            start || exit 1
            echo "... Please test your rules"
            sleep 30
            echo "---- The test is finished ----"
            if  [ -f /etc/network/iptables-save ]; then
                iptables-restore < /etc/network/iptables-save
                echo "Old rules restored"
            else
                stop
                echo "Rules flushed"
            fi
            echo "If you are happy with this new rules please use save option"
        ;;
        save)
            start || exit 1
            iptables-save > /etc/network/iptables-save
        ;;
        *)
                N=/etc/init.d/$NAME
                abort "Usage: $N {start|restore|save|test|stop}" >&2
        ;;
esac

exit 0