Forum Debian Users Gang

#!/bin/sh

welcome () {
echo " "
echo "#####FIREWALL#################### by <ry[]Dt0fr3@k #####################"
echo "#########################################LAST UPDATE: 01-10-2015.22:10##"
}

## LSB TAGS #########################################################
  ### BEGIN INIT INFO
# Provides:        FIREWALL
# Required-Start:    $local_fs
# Required-Stop:    $local_fs
# Default-Start:    S
# Default-Stop:        0 6
# X-Start-Before:    $network
# X-Stop-After:        $network
# Short-Description:    Zapora
# Description:        Zapora z proxy dla http
  ### END INIT INFO

PATH=/bin:/sbin:/usr/bin:/usr/sbin

    if ! [ -x /sbin/iptables ]; then
                echo " NO IPTABLES!"
        exit 0
    fi

fw_clear () {
        echo " * Czyszczenie regul"
        ## czyszczenie reguł ################################################
        iptables -F
        iptables -X
        iptables -t nat -F
        iptables -t nat -X
}

fw_stop () {
    echo " * Odrzucanie polaczen"
    ## odrzucanie połączeń INPUT i FORWARD ##############################
    iptables -P INPUT DROP
    iptables -P FORWARD DROP
    iptables -P OUTPUT DROP
}

fw_start () {
    ## sledzenie ########################################################
    modprobe ip_conntrack
    modprobe iptable_nat

    ## zmienne ##########################################################
    _INTRA="1.2.5.36"
    _INTERFACE_1="rename3"

    echo " * Reguly dla INPUT..."
    ##  reguly INPUT  ###################################################
    iptables -A INPUT -i lo -j ACCEPT
    iptables -A INPUT -j ACCEPT -m conntrack --ctstate ESTABLISHED,RELATED

    iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "INPUT DROP INVALID " --log-ip-options --log-tcp-options
    iptables -A INPUT -m state --state INVALID -j DROP

    ############ stateful filtering #####################################
    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    ############ anti-spoofing ##########################################
    iptables -A INPUT -i $_INTERFACE_1 -j LOG --log-prefix "INPUT SPOOFED PKT "
    iptables -A INPUT -i $_INTERFACE_1 -j DROP

    ############ ACCEPT #################################################
    iptables -A INPUT -i $_INTERFACE_1 -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
    iptables -A INPUT -i $_INTERFACE_1 -p udp --dport 80 -m state --state NEW -j ACCEPT

    iptables -A INPUT -j LOG --log-ip-options
    iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

    ############ LOG I DROP #############################################
    iptables -A INPUT -i !lo -j LOG --log-prefix "INPUT DROP " --log-ip-options --log-tcp-options

    echo " * Reguly dla OUTPUT..."
    ## OUTPUT ###########################################################
    iptables -A OUTPUT -m state --state INVALID -j LOG --log-prefix "OUTPUT DROP INVALID " --log-ip-options --log-tcp-options
    iptables -A OUTPUT -m state --state INVALID -j DROP
    iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

    ############ ACCEPT #################################################
    iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT
    iptables -A OUTPUT -p udp --dport 80 -m state --state NEW -j ACCEPT
    iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

    ############ LOG I DROP #############################################
    iptables -A OUTPUT -o !lo -j LOG --log-prefix " OUTPUT DROP " --log-ip-options --log-tcp-options

##    echo " * Reguly dla FORWARD..."
##    ## FORWARD ##########################################################
##    iptables -A FORWARD -m state --state INVALID -j LOG --log-prefix "FORWARD DROP INVALID " --log-ip-options --log-tcp-options
##    iptables -A FORWARD -m state --state INVALID -j DROP
##    iptables -A FORWARD -i $_INTERFACE_1 -j LOG --log-prefix "FORWARD SPOOFED PKT "
##    iptables -A FORWARD -i $_INTERFACE_1 -j DROP
##
##    ############ ACCEPT #################################################
##    iptables -A FORWARD -p tcp --dport 443 -m state --state NEW -j ACCEPT
##$$$$$    iptables -A FORWARD -p tcp --dport 25 -m state --state NEW -j ACCEPT
##    iptables -A FORWARD -p tcp --dport 80 -m state --state NEW -j ACCEPT
##    iptables -A FORWARD -p udp --dport 80 -m state --state NEW -j ACCEPT
##    iptables -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT
##    iptables -A FORWARD -i !lo -j LOG --log-prefix "FORWARD DROP " --log-ip-options --log-tcp-options


    ############ NAT ####################################################
    iptables -t nat -A POSTROUTING -s $_INTRA -o $_INTERFACE_1 -j MASQUERADE

    echo " * IP forward enable"

    echo 1 > /proc/sys/net/ipv4/ip_forward
}

case "$1" in
    start)
        welcome
    echo " "
        echo "Starting firewall.."
    echo " "
        fw_start
        echo "done."
    echo " "
    echo " "
        ;;
    restart)
    echo " "
        echo "Restarting firewall..."
    echo " "
        welcome
        fw_clear
        fw_stop
        fw_start
        echo "done."
    echo " "
    echo " "
        ;;
    stop)
    echo " "
        echo "Stopping firewall.."
    echo " "
        fw_stop
    echo " "
        echo "Firewall stopped!"
    echo " "
        ;;
    clear)
    echo " "
        echo "Clearing firewall rules.."
    echo " "
        fw_clear
        echo "done."
        echo "#######################################"
        echo "# Watch out! You seems to be exposed! #"
        echo "# use firewall.sh stop to DROP it all #"
        echo "#######################################"
    echo " "
    echo " "
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|clear}"
        exit 1
        ;;
    esac
exit 0

https://deepthought.isc.org/article/AA-01091/0/ISC-DHCP-support-for-Standard-DDNS.html